Configuration map

The Canadian traffic path follows a request through the public controls. This map locates those controls in the demonstration’s Terraform source.

Control	Objects or fields	Terraform source
Tenant-managed DNS and HTTP listener	domains, http.dns_volterra_managed: false, port 80	main.tf; DNS is maintained by the tenant
Regional advertisement	RE virtual site, public-IP virtual_sites binding, advertise_custom	main.tf
Client authorization	Explicit active_service_policies, COUNTRY_CA, default denial, disabled header trust	main.tf
Canadian origin discovery	Default route pool, CE virtual site, outside-network endpoint	main.tf
Origin infrastructure ACL	Provider-published RE/CDN ranges and authorized infrastructure sources	origin.tf
Canadian deployment and ownership	Azure hub, three CE nodes, two FRR relays, client and origin	main.tf, locals.tf
Internal diagnostic listeners	CE BGP, primary-IP, application ILB and Site Console frontend	main.tf, ca_ilb.tf

The public listener references the reserved allocation only. A separate internal listener exposes diagnostic CE/ILB paths without public advertisement or managed public DNS. The internal client learns the application VIP through Azure Route Server and two FRR next hops. The expected routing inventory has six CE-to-FRR and four FRR-to-Route-Server sessions.

The CE selector identifies owned sites; Azure placement establishes their region. Origin ingress ACLs govern infrastructure connections independently of the public country policy. Failover exercise explains the tested node scope, and resource cleanup identifies retained platform resources.