Skip to content
eSHARS Operations

INFRA-0003: Training Slot Uses Key Vault Refs + App Gateway (Not Direct Private IP)

Status

Accepted

Date

2026-03-25

Context

When fixing SSRS connectivity for nonprod App Service slots (see INFRA-0001), we discovered the training slot (wa-eshars-nonprod/trn) uses a different configuration pattern from the other slots (dev, qa, regression, uat).

Other slots: App settings directly set MvcReportViewer.ReportServerUrl to the SSRS private IP (e.g., http://10.1.0.4/QAReportServer).

Training slot: App settings use Azure Key Vault references pointing to kv-eshars-training, which returns https://trainingreports.myeshars.com/ — the App Gateway public hostname. Traffic flows: App Service → App Gateway (public DNS) → private IP 10.1.0.6 (SSRS training instance).

Decision

Leave the training slot pattern as-is. Do not change the training slot to use direct private IP routing.

Rationale

  1. It works. The training slot was functioning correctly before and after the SSRS networking changes. The App Gateway backend for trainingreports.myeshars.com already routes to private IP 10.1.0.6.

  2. Training is intentionally isolated. The training environment has its own Key Vault (kv-eshars-training) and its own SSRS instance, suggesting it was deliberately set up as a more independent environment. Changing the pattern risks breaking isolation.

  3. Unknown history. The training slot pattern appears to predate the nonprod VNet integration work. Whoever set it up may have had reasons not documented here. The risk of changing a working system for no operational gain is not justified.

Consequences

Positive

  • No disruption to training environment during nonprod networking changes
  • Training maintains its independent configuration chain (kv-eshars-training)

Negative

  • Two different patterns exist for SSRS connectivity across slots in the same App Service. New engineers must understand that training behaves differently.
  • Training traffic routes via App Gateway (public DNS round-trip) rather than direct private routing. Minor latency difference.

Neutral

  • If the training App Gateway is ever reconfigured or trainingreports.myeshars.com DNS changes, training reports will break independently of the other slots.

Pattern Summary

SlotConfig SourceSSRS URL PatternRoutes Via
devApp Service settingshttp://10.1.0.4/QAReportServerVNet (private)
qaApp Service settingshttp://10.1.0.4/QAReportServerVNet (private)
regressionApp Service settingshttp://10.1.0.4/REGReportServerVNet (private)
uatApp Service settingshttp://10.1.0.4/UATReportServerVNet (private)
trnKey Vault ref → kv-eshars-traininghttps://trainingreports.myeshars.com/App Gateway (public DNS → private)