Bicep: Redis private endpoint wired to wrong Private DNS zone, blocks all Redis connectivity #1483

Summary

On a fresh deploy from PR #1477 (deploy/azure/), every app service (api, report-generator, coder-acp-copilot, coder-acp-claude-code, etc.) fails to connect to the provisioned Azure Managed Redis instance with connect ETIMEDOUT, even though the pods themselves are healthy and can reach MongoDB/Storage fine.

Root cause

The Redis private endpoint's DNS zone group is attached to privatelink.redisenterprise.cache.azure.net, which has zero record sets in this environment. Azure Managed Redis's actual hostname CNAMEs into *.privatelink.redis.azure.net instead:

redis-<name>.<region>.redis.azure.net
  → CNAME → redis-<name>.<region>.privatelink.redis.azure.net

Since no private DNS zone matches privatelink.redis.azure.net, in-cluster DNS falls through to the public record, which resolves to a public IP. The Redis resource has publicNetworkAccess: Disabled, so every connection to that public IP times out.

Repro

# From any pod in the AKS cluster:
nslookup redis-<name>.<region>.redis.azure.net
# CNAME → ...privatelink.redis.azure.net, resolves to a PUBLIC IP (e.g. 172.168.x.x),
# not an address in the cluster's VNet range.

az network private-endpoint dns-zone-group list \
  --endpoint-name pep-redis-<name>-redisEnterprise-0 \
  -g <resource-group>
# privateDnsZoneConfigs[0].name == "privatelink.redisenterprise.cache.azure.net"
# recordSets: []

Fix

The Bicep template's private endpoint for the Redis Enterprise (Azure Managed Redis) resource should create/link a Private DNS zone named privatelink.redis.azure.net (not privatelink.redisenterprise.cache.azure.net), linked to the AKS VNet, matching the hostname Azure Managed Redis actually publishes.

Workaround validated live

On a test environment (oss-scope-jduffney6), manually:

az network private-dns zone create -g <rg> -n privatelink.redis.azure.net
az network private-dns link vnet create -g <rg> \
  -n <vnet-name>-redis-vnetlink -z privatelink.redis.azure.net \
  -v <vnet-id> -e false
az network private-endpoint dns-zone-group create -g <rg> \
  --endpoint-name pep-redis-<name>-redisEnterprise-0 \
  --name default --private-dns-zone privatelink.redis.azure.net --zone-name redis

After this, DNS resolved to the private IP and all pods (api, report-generator, both ACP workers) connected to Redis successfully with no further changes.

Impact

• Every service's Redis-backed heartbeat/caching silently fails.
• Worker agent "online" status in the Portal depends on Redis heartbeats, so workers never show as available even when their pods are healthy and running correctly.

Related: #1477 (Bicep "Deploy to Azure" template), #1481 (Helm chart deploy).