DGX Spark to Azure Private Endpoint 7

Reach a private-only Microsoft Foundry account from an NVIDIA DGX Spark at home through a fourteen-dollar-a-month WireGuard VM, with split DNS that sends only the Azure AI names to Azure DNS, and watch every DNS answer and HTTP status flip in Grafana.

Built Level: Intermediate Time: about 90 minutes Runs on: azure-cli + WireGuard (Azure VM) + docker-compose (local probe) Observability: OpenTelemetry SDK + Grafana LGTM (local) Stack: Azure VNet, Private Endpoint, Private DNS, Foundry (AIServices), WireGuard, dnsmasq, systemd-resolved Connectivity cost: about $14/month (B1s VM + static IP + 32 GB SSD) vs about $157 for a VPN Gateway 7 of 7 parts written

About $0.75/day while the lab runs (VM, IP, disk, private endpoint, zones); make down deletes it all

Parts

1 Overview and Architecture

What you build, what you need, and how requests and signals travel through it.

2 Write the Code

The application and its instrumentation, file by file.

3 Set Up the Infrastructure

The cluster, the app manifests and the observability stack that receives the signals.

4 Deploy

Bring everything up, check the rollout and smoke-test the endpoints.

5 Monitor

A tour of the dashboard, the query behind each panel, and how long each signal takes to arrive.

6 Experiments

Perform an action, predict the signal, then check the dashboard and explain what changed.

7 Understand and Review

What the experiments proved, where this setup stops, and what production would change.

Experiments

Name resolves to stat panel showing PUBLIC for cognitiveservices, openai and services-ai

1 Call the account over the internet

See what the DGX gets today: all three names resolve to a public IP and the account's firewall answers 403.

metricslogs

Tunnel stat panel after wg0 is up: all three checks UP

2 Bring up the tunnel, change nothing else

Prove that routing alone is not enough: the private endpoint's IP answers over WireGuard, but the names still resolve to the public IP.

metrics

Name resolves to stat panel after split DNS: cognitiveservices PRIVATE, openai and services-ai NO ANSWER

3 Send the Azure AI names through the tunnel

Turn on split DNS and watch the cognitiveservices name flip to the private endpoint's IP and the call succeed, while the openai name stays public.

metricslogstraces

Animated state timeline over 20 minutes: after the fix at 17:06 the openai and services-ai rows stay red PUBLIC until about 17:21 and 17:23, then turn green PRIVATE

4 Add the missing openai and services.ai zones

Fix the mistake from the brief: give the private endpoint's zone group the privatelink.openai and privatelink.services.ai zones, and time how long the DNS answers take to change.

metricslogs