Anyscale on Azure Networking: Outbound HTTPS, Load Balancers and Controllers

Separate outbound control connections from client ingress

Anyscale on Azure runs Ray distributed Python workloads in your own Azure Kubernetes Service cluster, or AKS, while the Anyscale-hosted control plane handles management such as scheduling and monitoring. Anyscale announced general availability on October 7, 2026. This guide explains deployment conditions from documentation checked on November 11; it is not a new launch announcement.

Egress-only in the networking guide means the Operator and Ray nodes initiate connections to the Anyscale control plane. You do not need inbound firewall rules for Anyscale to initiate connections to those nodes. Client access to a workspace or service follows a separate path.

Record four flows separately: client to control plane, client through an Azure load balancer to AKS, AKS to control plane, and AKS to storage and container registries. One successful outbound check does not establish that the other paths work.

Check the destinations that need outbound HTTPS on port 443

Control connections use HTTPS on port 443. The current guide lists console.azure.anyscale.com, *.azure.anyscale-cloud.dev, grafana-*.azure.anyscale-cloud.dev and registry-*.azure.anyscale-cloud.dev. It also requires access to bootstrap storage at anyscaleazwestus2prod.blob.core.windows.net.

Workspace dashboards, terminals and Jupyter use *.i.azure.anyscaleuserdata.com; VS Code uses vscode-*.i.azure.anyscaleuserdata.com; Anyscale Services use *.s.azure.anyscaleuserdata.com. Match each destination to its purpose in the official tables instead of allowing only the console domain.

Clusters also need their Azure storage and container registries. Custom ACR images introduce their own dependencies. For restricted egress, check the complete official tables against actual cloud IDs and resource addresses; the hostnames above are not a complete dependency inventory for every deployment.

A load balancer still needs a controller behind it

Client ingress requires a Layer 4 TCP load balancer. Azure Load Balancer meets that requirement. The networking guide explicitly does not support Azure Application Gateway as the primary ingress load balancer, so it is not a direct substitute for this path.

The cluster also needs an Ingress or Gateway API controller to handle routing. The Anyscale Operator creates routing resources but does not install the controller; your team installs and maintains it. The official quickstart uses Envoy Gateway, and the networking guide specifies networking.gateway.enabled=true for this approach.

Without a controller, routing resources may receive no load balancer address, with connectivity timeouts when creating workspaces, jobs or services. The documented anyscale cloud verify check includes detecting a missing controller. Relate its result to the actual client path as well. No installation, verification command or cluster connectivity test was performed for this guide.

Private AKS still needs a reachable client path

Private clusters with no public node IPs are supported, but they still need an ingress controller. The documented private-access arrangement includes an internal load balancer, private DNS and client connectivity through VPN or ExpressRoute.

Control-plane connections need a working route too. When using public endpoints, a private cluster can reach required destinations through a NAT Gateway or equivalent egress; an internal load balancer does not provide cluster egress. In a hypothetical example, nodes can reach the control plane but a client cannot reach the internal load balancer, leaving the workspace inaccessible to that client.

The overview lists Azure Private Link as a preview feature. It offers private endpoints for control-plane connections, but does not establish that every feature is GA, client routing is unnecessary or the cluster can run fully offline. Evaluate the architecture and preview conditions separately.

Check the US control plane alongside your data-plane region

The current region page lists 12 supported regions, including Southeast Asia (southeastasia), West Europe (westeurope) and several US regions. Match your deployment to the complete source list. Service availability in a region does not establish availability or quota for a particular GPU SKU; GPU-family vCPU quotas commonly require approval.

The region guide places the control plane in the United States, separately from the selected data-plane region. Operational metadata sent to it includes system logs, observability metrics and cluster state. Structured application logs are also included when log ingestion is enabled. Running workloads in your own Azure subscription is not a promise that all information stays in the chosen region.

For residency requirements, record dataset locations, control-plane metadata and log-ingestion settings separately before assessing suitability. An exit location or proxy configuration does not change service regions, quotas, account permissions or data-processing conditions.

Check permissions and budget for both charge components

The Azure CLI quickstart requires an Azure subscription with the Owner or Administrator role and permission to create service principals from external Entra tenants. Existing AKS clusters also need the OIDC issuer and workload identity enabled. Check the actual tenant permissions rather than treating ordinary subscription access as sufficient preparation.

After cloud creation, every user creating workspaces, jobs or services needs an explicit Anyscale Platform Contributor assignment on that Anyscale cloud. An underlying Owner or Contributor role does not automatically replace this product-specific role.

Billing has two components: Anyscale runtime usage and underlying Azure resources such as AKS compute, storage and networking, billed through Azure. The public pricing page currently displays $- placeholders while retaining Preview pricing and preview-period SLA wording, which is out of step with the GA announcement.

The reviewed pages therefore do not establish current contract rates or the runtime SLA. Do not read $- as zero cost. Before creating billable resources, check your applicable Azure quote, agreement and resource budget; the GA announcement cannot supply unverified prices or commitments.