### Deploy Container App Module - Basic Example

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/default/README.md

This example shows the simplest way to deploy the module, setting up a resource group, container app environment, and two container apps: one for counting and one for a dashboard. It includes basic ingress and container configurations.

```hcl
resource "random_id" "rg_name" {
  byte_length = 8
}

resource "random_id" "env_name" {
  byte_length = 8
}

resource "random_id" "container_name" {
  byte_length = 4
}

resource "azurerm_resource_group" "test" {
  location = var.location
  name     = "example-container-app-${random_id.rg_name.hex}"
}

locals {
  counting_app_name  = "counting-${random_id.container_name.hex}"
  dashboard_app_name = "dashboard-${random_id.container_name.hex}"
}

data "azurerm_client_config" "current" {}

resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "example" {
  location            = azurerm_resource_group.test.location
  name                = "my-environment"
  resource_group_name = azurerm_resource_group.test.name

  depends_on = [azapi_resource_action.register_microsoft_app]
}

module "counting" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = local.counting_app_name
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    containers = [
      {
        name   = "countingservicetest1"
        memory = "0.5Gi"
        cpu    = 0.25
        image  = "docker.io/hashicorp/counting-service:0.0.2"
        env = [
          {
            name  = "PORT"
            value = "9001"
          }
        ]
        readiness_probes = [{
          initial_delay_seconds = 5
          path                  = "/health"
          period_seconds        = 10
          port                  = 9001
          transport             = "HTTP"
        }]
      },
    ]
  }
  auth_configs = {
    fake_facebook = {
      name = "current"
      global_validation = {
        unauthenticated_client_action = "AllowAnonymous"
      }
      identity_providers = {
        facebook = {
          registration = {
            app_id                  = "123"
            app_secret_setting_name = "facebook-secret"
          }
        }
      }
      platform = {
        enabled = true
      }
    }
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = true
    client_certificate_mode    = "ignore"
    external_enabled           = true
    target_port                = 9001
    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location          = azurerm_resource_group.test.location
  resource_group_id = azurerm_resource_group.test.id
  revision_mode     = "Single"
  secrets = {
    facebook_secret = {
      name  = "facebook-secret"
      value = "very_secret"
    }
  }

  depends_on = [
    azurerm_resource_group.test,
  ]
}

module "dashboard" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = local.dashboard_app_name
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    containers = [
      {
        name   = "testdashboard"
        memory = "1Gi"
        cpu    = 0.5
        image  = "docker.io/hashicorp/dashboard-service:0.0.4"
        env = [
          {
            name  = "PORT"
            value = "8080"
          },
          {
            name  = "COUNTING_SERVICE_URL"
            value = "http://${local.counting_app_name}"
          }
        ]
        liveness_probes = [{
          initial_delay_seconds = 5
          path                  = "/health"
          period_seconds        = 10
          port                  = 8080
          transport             = "HTTP"
        }]
        startup_probe = [{
          initial_delay_seconds = 5
          period_seconds        = 10
          transport             = "HTTP"
          path                  = "/health"
          port                  = 8080
          header = [
            {
              name  = "X-Random-Header"
              value = "test"
            }
          ]
        }]
      },
    ]
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = false
    client_certificate_mode    = "ignore"
    target_port                = 8080
    external_enabled           = true

    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location = azurerm_resource_group.test.location
  managed_identities = {
    system_assigned = true
  }
  resource_group_id = azurerm_resource_group.test.id
  revision_mode     = "Single"

  depends_on = [
    azurerm_resource_group.test,
  ]
}

```

--------------------------------

### Container App Environment Setup

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/acr/README.md

Configures an Azure Container App Environment, registering the Microsoft.App provider and setting up the infrastructure subnet.

```terraform
resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "example" {
  location                 = azurerm_resource_group.test.location
  name                     = "test-environment"
  resource_group_name      = azurerm_resource_group.test.name
  infrastructure_subnet_id = azurerm_subnet.container_app.id

  depends_on = [azapi_resource_action.register_microsoft_app]

  lifecycle {
    ignore_changes = [
      infrastructure_resource_group_name,
      workload_profile
    ]
  }
}
```

--------------------------------

### Container App Startup Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/vnet/README.md

Configures a Container App with specific startup parameters, managed identity, and workload profile. Ensure dependent resources like private DNS records and virtual network links are created beforehand.

```terraform
resource "azurerm_container_app" "test" {
  name                       = "test-container-app"
  location                   = azurerm_resource_group.test.location
  managed_identities = {
    system_assigned = true
  }
  resource_group_id     = azurerm_resource_group.test.id
  revision_mode         = "Single"
  workload_profile_name = "Consumption"

  depends_on = [azurerm_private_dns_a_record.containerapp_record, azurerm_private_dns_zone_virtual_network_link.vnet_link]
}
```

--------------------------------

### Define http_settings input variable

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Configuration for HTTP request handling within the authentication/authorization flow.

```hcl
object({
    require_https = optional(bool)
    forward_proxy = optional(object({
      convention               = optional(string)
      custom_host_header_name  = optional(string)
      custom_proto_header_name = optional(string)
    }))
    routes = optional(object({
      api_prefix = string
    }))
  })
```

--------------------------------

### Define platform configuration object

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Defines the structure for enabling the Authentication/Authorization feature and specifying the runtime version.

```hcl
object({
    enabled         = optional(bool)
    runtime_version = optional(string)
  })
```

--------------------------------

### Runtime Configuration Input

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Specifies runtime settings for the Container App, such as Java metrics.

```hcl
object({
    java = optional(object({
      enable_metrics = optional(bool, false)
    }))
  })
```

--------------------------------

### Define TCP Scale Rules and Volumes

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Configuration schema for defining TCP scale rules and volume mounts within the Container App resource.

```hcl
    tcp_scale_rules = optional(list(object({
      concurrent_requests = string
      name                = string
      identity            = optional(string)
      metadata            = optional(map(string))
      authentication = optional(list(object({
        secret_name       = string
        trigger_parameter = optional(string)
      })))
    })))
    volumes = optional(list(object({
      mount_options = optional(string)
      name          = string
      secrets = optional(list(object({
        path        = string
        secret_name = string
      })))
      storage_name = optional(string)
      storage_type = optional(string, "EmptyDir")
    })))
  })
```

--------------------------------

### Deploy Azure Container App with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/simple/README.md

This snippet shows the default configuration for deploying an Azure Container App. It includes setting up the naming module, resource group, container app environment, and the container app module itself. Ensure the required Terraform providers (azapi, azurerm) are configured.

```hcl
# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "australiaeast"
  name     = module.naming.resource_group.name_unique
}

data "azurerm_client_config" "current" {}

resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "this" {
  location            = azurerm_resource_group.this.location
  name                = module.naming.container_app_environment.name_unique
  resource_group_name = azurerm_resource_group.this.name

  depends_on = [azapi_resource_action.register_microsoft_app]
}

# This is the module call
module "container_app" {
  source = "../../"

  container_app_environment_resource_id = azurerm_container_app_environment.this.id
  name                                  = module.naming.container_app.name_unique
  resource_group_name                   = azurerm_resource_group.this.name
  template = {
    containers = [{
      image  = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
      name   = "containerapps-helloworld"
      cpu    = "0.25"
      memory = "0.5Gi"
    }]
    min_replicas = 1
    max_replicas = 1
  }
  enable_telemetry = false
  ingress = {
    external_enabled = true
    target_port      = 80
    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location          = azurerm_resource_group.this.location
  resource_group_id = azurerm_resource_group.this.id
  revision_mode     = "Single"
}

```

--------------------------------

### Define encryption_settings input variable

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Configuration for secrets references used in Service Authentication/Authorization.

```hcl
object({
    container_app_auth_encryption_secret_name = optional(string)
    container_app_auth_signing_secret_name    = optional(string)
  })
```

--------------------------------

### Define login configuration object

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Defines the structure for the login flow, including routes, token store settings, and cookie expiration.

```hcl
object({
    routes = optional(object({
      logout_endpoint = string
    }))
    token_store = optional(object({
      enabled                       = bool
      token_refresh_extension_hours = number
      azure_blob_storage = optional(object({
        sas_url_setting_name = string
      }))
    }))
    preserve_url_fragments_for_logins = optional(bool)
    allowed_external_redirect_urls    = optional(list(string))
    cookie_expiration = optional(object({
      convention         = optional(string)
      time_to_expiration = optional(string)
    }))
    nonce = optional(object({
      validate_nonce            = bool
      nonce_expiration_interval = string
    }))
  })
```

--------------------------------

### Deploy Container App with Init Container

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/init-container/README.md

This Terraform configuration defines a Container App with an init container that writes a file to a shared volume, and a main Nginx container that serves content from that volume. The init container runs before the main container, ensuring the shared volume is prepared.

```hcl
resource "random_id" "rg_name" {
  byte_length = 8
}

resource "random_id" "env_name" {
  byte_length = 8
}

resource "random_id" "container_name" {
  byte_length = 4
}

resource "azurerm_resource_group" "test" {
  location = var.location
  name     = "example-container-app-${random_id.rg_name.hex}-init-container"
}

data "azurerm_client_config" "current" {}

resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "example" {
  location            = azurerm_resource_group.test.location
  name                = "my-environment"
  resource_group_name = azurerm_resource_group.test.name

  depends_on = [azapi_resource_action.register_microsoft_app]
}

module "container_apps" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = "app-with-init-container-${random_id.container_name.hex}"
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    init_containers = [
      {
        name   = "debian"
        image  = "debian:latest"
        memory = "0.5Gi"
        cpu    = 0.25
        command = [
          "/bin/sh",
        ]
        args = [
          "-c", "echo Hello from the debian container > /shared/index.html"
        ]
        volume_mounts = [
          {
            name = "shared"
            path = "/shared"
          }
        ]
      }
    ],
    containers = [
      {
        name   = "nginx"
        image  = "nginx:latest"
        memory = "1Gi"
        cpu    = 0.5
        volume_mounts = [{
          name = "shared"
          path = "/usr/share/nginx/html"
        }]
      }
    ],
    volumes = [
      {
        name         = "shared"
        storage_type = "EmptyDir"
      }
    ]
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = false
    target_port                = 80
    external_enabled           = true

    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location          = azurerm_resource_group.test.location
  resource_group_id = azurerm_resource_group.test.id
  revision_mode     = "Single"
}

```

--------------------------------

### Define Container Registry Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

List of registry objects for authentication and image pulling.

```hcl
list(object({
    identity             = optional(string)
    password_secret_name = optional(string)
    server               = optional(string)
    username             = optional(string)
  }))
```

--------------------------------

### Role Assignments Input

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Configures a map of role assignments for the resource, using arbitrary keys to prevent plan-time errors.

```hcl
map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))
```

--------------------------------

### Deploying Counting Service with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/vnet/README.md

This module deploys a 'counting' microservice. It configures the container, environment, ingress settings, and dependencies. Ensure the private DNS zone and VNet link are established before deploying.

```hcl
module "counting" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = local.counting_app_name
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    containers = [
      {
        name   = "countingservicetest1"
        memory = "0.5Gi"
        cpu    = 0.25
        image  = "docker.io/hashicorp/counting-service:0.0.2"
        env = [
          {
            name  = "PORT"
            value = "9001"
          }
        ]
      },
    ]
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = true
    external_enabled           = true
    target_port                = 9001
    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location              = azurerm_resource_group.test.location
  resource_group_name                   = azurerm_resource_group.test.name
  resource_group_id     = azurerm_resource_group.test.id
  revision_mode         = "Single"
  workload_profile_name = "Consumption"

  depends_on = [azurerm_private_dns_a_record.containerapp_record, azurerm_private_dns_zone_virtual_network_link.vnet_link]
}

```

--------------------------------

### Define Container App Input Template

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Defines the complex object structure for configuring Azure Container Apps, including scale rules, container definitions, and probes.

```hcl
azure_queue_scale_rules = optional(list(object({
  name         = string
  queue_length = number
  queue_name   = string
  account_name = optional(string)
  identity     = optional(string)
  authentication = list(object({
    secret_name       = string
    trigger_parameter = string
  }))
})))
containers = list(object({
  args    = optional(list(string))
  command = optional(list(string))
  cpu     = number
  image   = string
  memory  = string
  name    = string
  env = optional(list(object({
    name        = string
    secret_name = optional(string)
    value       = optional(string)
  })))
  liveness_probes = optional(list(object({
    failure_count_threshold          = optional(number, 3)
    host                             = optional(string)
    initial_delay                    = optional(number, 1)
    interval_seconds                 = optional(number, 10)
    path                             = optional(string)
    port                             = number
    termination_grace_period_seconds = optional(number)
    timeout                          = optional(number, 1)
    transport                        = string
    header = optional(list(object({
      name  = string
      value = string
    })))
  })))
  readiness_probes = optional(list(object({
    failure_count_threshold = optional(number, 3)
    host                    = optional(string)
    initial_delay           = optional(number, 0)
    interval_seconds        = optional(number, 10)
    path                    = optional(string)
    port                    = number
    success_count_threshold = optional(number, 3)
    timeout                 = optional(number, 1)
    transport               = string
    header = optional(list(object({
      name  = string
      value = string
    })))
  })))
  #TODO:Remove startup_probe in v1.0.0
  startup_probe = optional(list(object({
    failure_count_threshold          = optional(number, 3)
    host                             = optional(string)
    initial_delay                    = optional(number, 0)
    interval_seconds                 = optional(number, 10)
    path                             = optional(string)
    port                             = number
    termination_grace_period_seconds = optional(number)
    timeout                          = optional(number, 1)
    transport                        = string
    header = optional(list(object({
      name  = string
      value = string
    })))
  })))
  startup_probes = optional(list(object({
    failure_count_threshold          = optional(number, 3)
    host                             = optional(string)
    initial_delay                    = optional(number, 0)
    interval_seconds                 = optional(number, 10)
    path                             = optional(string)
    port                             = number
    termination_grace_period_seconds = optional(number)
    timeout                          = optional(number, 1)
    transport                        = string
    header = optional(list(object({
      name  = string
      value = string
    })))
  })))
  volume_mounts = optional(list(object({
    name     = string
    path     = string
    sub_path = optional(string)
  })))
}))
custom_scale_rules = optional(list(object({
  custom_rule_type = string
  metadata         = map(string)
  name             = string
  identity         = optional(string)
  authentication = optional(list(object({
    secret_name       = string
    trigger_parameter = string
  })))
})))
http_scale_rules = optional(list(object({
  concurrent_requests = string
  name                = string
  identity            = optional(string)
  metadata            = optional(map(string))
  authentication = optional(list(object({
    secret_name       = string
    trigger_parameter = optional(string)
  })))
})))
init_containers = optional(list(object({
  args    = optional(list(string))
  command = optional(list(string))
  cpu     = optional(number)
  image   = string
  memory  = optional(string)
  name    = string
  env = optional(list(object({
    name        = string
    secret_name = optional(string)
    value       = optional(string)
  })))
  volume_mounts = optional(list(object({
    name     = string
    path     = string
    sub_path = optional(string)
  })))
})))

service_binds = optional(list(object({
  name       = string
  service_id = string
})))
```

--------------------------------

### Configure Telemetry

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Boolean flag to enable or disable module telemetry collection.

```hcl
bool
```

--------------------------------

### Define Ingress Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Configuration object for ingress settings including traffic weights, CORS policies, and custom domains.

```hcl
object({
    allow_insecure_connections = optional(bool, false)
    client_certificate_mode    = optional(string)
    exposed_port               = optional(number, 0)
    external_enabled           = optional(bool, false)
    target_port                = optional(number)
    transport                  = optional(string, "auto")

    traffic_weight = list(object({
      label           = optional(string)
      latest_revision = optional(bool, false)
      revision_suffix = optional(string)
      percentage      = number
    }))

    additional_port_mappings = optional(list(object({
      exposed_port = number
      external     = bool
      target_port  = number
    })))

    cors_policy = optional(object({
      allow_credentials = optional(bool, false)
      allowed_headers   = optional(list(string))
      allowed_methods   = optional(list(string))
      allowed_origins   = optional(list(string))
      expose_headers    = optional(list(string))
      max_age           = optional(number)
    }), null)

    # TODO: Remove custom_domain in v1.0.0 - replaced by custom_domains list
    custom_domain = optional(object({
      certificate_binding_type = optional(string)
      certificate_id           = optional(string)
      name                     = optional(string)
    }))

    custom_domains = optional(list(object({
      certificate_binding_type = optional(string)
      certificate_id           = optional(string)
      name                     = string
    })), [])

    ip_restrictions = optional(list(object({
      action      = optional(string)
      description = optional(string)
      ip_range    = optional(string)
      name        = optional(string)
    })))

    sticky_sessions = optional(object({
      affinity = optional(string, "none")
    }))
  })
```

--------------------------------

### Define service input variable

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Specifies the service type configuration for the Container App.

```hcl
object({
    type = string
  })
```

--------------------------------

### Define timeouts configuration object

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Defines the per-operation timeout durations for create, delete, read, and update actions.

```hcl
object({
    create = optional(string)
    delete = optional(string)
    read   = optional(string)
    update = optional(string)
  })
```

--------------------------------

### Configure Authentication Providers

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Defines the complex object structure for various identity providers including Google, Twitter, Apple, and custom OpenID Connect configurations.

```hcl
      }))
      google = optional(object({
        enabled = optional(bool)
        registration = optional(object({
          client_id                  = optional(string)
          client_secret_setting_name = optional(string)
        }))
        login = optional(object({
          scopes = list(string)
        }))
        validation = optional(object({
          allowed_audiences = list(string)
        }))
      }))
      twitter = optional(object({
        enabled = optional(bool)
        registration = optional(object({
          consumer_key                 = string
          consumer_secret_setting_name = optional(string)
        }))
      }))
      apple = optional(object({
        enabled = optional(bool)
        registration = optional(object({
          client_id                  = string
          client_secret_setting_name = optional(string)
        }))
        login = optional(object({
          scopes = list(string)
        }))
      }))
      azure_static_web_apps = optional(object({
        enabled = optional(bool)
        registration = optional(object({
          client_id = string
        }))
      }))
      custom_open_id_connect_providers = optional(map(object({
        enabled = optional(bool)
        registration = optional(object({
          client_id = optional(string)
          client_credential = optional(object({
            method                     = string
            client_secret_setting_name = string
          }))
          open_id_connect_configuration = optional(object({
            authorization_endpoint           = string
            token_endpoint                   = string
            issuer                           = string
            certification_uri                = string
            well_known_open_id_configuration = optional(string)
          }))
        }))
        login = optional(object({
          name_claim_type = string
          scopes          = list(string)
        }))
      })), {})
    }))
    login = optional(object({
      routes = optional(object({
        logout_endpoint = string
      }))
      token_store = optional(object({
        enabled                       = bool
        token_refresh_extension_hours = number
        azure_blob_storage = optional(object({
          sas_url_setting_name = string
        }))
      }))
      preserve_url_fragments_for_logins = optional(bool)
      allowed_external_redirect_urls    = optional(list(string))
      cookie_expiration = optional(object({
        convention         = optional(string)
        time_to_expiration = optional(string)
      }))
      nonce = optional(object({
        validate_nonce            = bool
        nonce_expiration_interval = string
      }))
    }))
    http_settings = optional(object({
      require_https = optional(bool)
      forward_proxy = optional(object({
        convention               = optional(string)
        custom_host_header_name  = optional(string)
        custom_proto_header_name = optional(string)
      }))
      routes = optional(object({
        api_prefix = string
      }))
    }))
    encryption_settings = optional(object({
      container_app_auth_encryption_secret_name = optional(string)
      container_app_auth_signing_secret_name    = optional(string)
    }))
  }))
```

--------------------------------

### Define Scaling Configuration Object

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Defines the HCL object structure for container scaling settings, including cooldown periods and replica counts.

```hcl
object({
    cooldown_period = optional(number, 300)
    max_replicas    = optional(number, 10)
    #TODO:Set `min_replicas` default value to `0` in `v1.0.0`
    min_replicas     = optional(number)
    polling_interval = optional(number, 30)
    revision_suffix  = optional(string)
    #TODO:Set `termination_grace_period_seconds` default value to `0` in `v1.0.0`
    termination_grace_period_seconds = optional(number)
```

--------------------------------

### Deploying Dashboard Service with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/vnet/README.md

This module deploys a 'dashboard' microservice that depends on the 'counting' service. It configures the container, environment, ingress, and environment variables, including the URL for the counting service. Ingress is secured by default.

```hcl
module "dashboard" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = local.dashboard_app_name
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    containers = [
      {
        name   = "testdashboard"
        memory = "1Gi"
        cpu    = 0.5
        image  = "docker.io/hashicorp/dashboard-service:0.0.4"
        env = [
          {
            name  = "PORT"
            value = "8080"
          },
          {
            name  = "COUNTING_SERVICE_URL"
            value = "http://${local.counting_app_name}"
          }
        ]
      },
    ]
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = false
    target_port                = 8080
    external_enabled           = true

    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
}

```

--------------------------------

### Define identity_settings input

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Specifies the structure for identity settings, including the user-assigned managed identity ID and its lifecycle state.

```hcl
list(object({
    identity  = string
    lifecycle = optional(string, "All")
  }))
```

--------------------------------

### Terraform Configuration for Container App with Revision Suffix

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/revision_suffix/README.md

This Terraform configuration sets up an Azure Container App environment and deploys a container app. It specifically shows how to use the `revision_suffix` variable to manage revisions.

```hcl
resource "random_id" "rg_name" {
  byte_length = 8
}

resource "random_id" "container_name" {
  byte_length = 4
}

resource "azurerm_resource_group" "test" {
  location = var.location
  name     = "example-revision-suffix-${random_id.rg_name.hex}"
}

data "azurerm_client_config" "current" {}

resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "example" {
  location            = azurerm_resource_group.test.location
  name                = "my-environment"
  resource_group_name = azurerm_resource_group.test.name

  depends_on = [azapi_resource_action.register_microsoft_app]
}

module "container_app" {
  source = "../.."

  container_app_environment_resource_id = azurerm_container_app_environment.example.id
  name                                  = "app-${random_id.container_name.hex}"
  resource_group_name                   = azurerm_resource_group.test.name
  template = {
    revision_suffix = var.revision_suffix
    containers = [
      {
        name   = "myapp"
        memory = "0.5Gi"
        cpu    = 0.25
        image  = var.container_image
      },
    ]
  }
  enable_telemetry = false
  ingress = {
    allow_insecure_connections = true
    external_enabled           = true
    target_port                = 80
    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location          = azurerm_resource_group.test.location
  resource_group_id = azurerm_resource_group.test.id
  revision_mode     = "Multiple"

  depends_on = [
    azurerm_resource_group.test,
  ]
}

```

--------------------------------

### Define retry configuration object

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Defines the retry logic for azapi_resource operations, including error regex patterns and interval settings.

```hcl
object({
    error_message_regex  = optional(list(string))
    interval_seconds     = optional(number)
    max_interval_seconds = optional(number)
  })
```

--------------------------------

### Define Resource Lock Configuration

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Configuration for applying Azure Resource Locks to the container app.

```hcl
object({
    kind = string
    name = optional(string, null)
  })
```

--------------------------------

### Define secrets input variable

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/README.md

Configures secrets for the Container App, supporting either direct values or Key Vault references.

```hcl
map(object({
    identity            = optional(string)
    key_vault_secret_id = optional(string)
    name                = string
    value               = optional(string)
  }))
```

--------------------------------

### Define identity_providers HCL object structure

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/modules/auth-config/README.md

Use this object structure to configure authentication providers for the ContainerApp resource.

```hcl
object({
    azure_active_directory = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        open_id_issuer                                     = optional(string)
        client_id                                          = optional(string)
        client_secret_setting_name                         = optional(string)
        client_secret_certificate_issuer                   = optional(string)
        client_secret_certificate_subject_alternative_name = optional(string)
        client_secret_certificate_thumbprint               = optional(string)
      }))
      login = optional(object({
        login_parameters         = list(string)
        disable_www_authenticate = bool
      }))
      validation = optional(object({
        jwt_claim_checks = optional(object({
          allowed_groups              = optional(list(string))
          allowed_client_applications = optional(list(string))
        }))
        allowed_audiences = optional(list(string))
        default_authorization_policy = optional(object({
          allowed_principals = optional(object({
            groups     = optional(list(string))
            identities = optional(list(string))
          }))
          allowed_applications = optional(list(string))
        }))
      }))
      is_auto_provisioned = optional(bool)
    }))
    facebook = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        app_id                  = optional(string)
        app_secret_setting_name = optional(string)
      }))
      graph_api_version = optional(string)
      login = optional(object({
        scopes = list(string)
      }))
    }))
    github = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        client_id                  = optional(string)
        client_secret_setting_name = optional(string)
      }))
      login = optional(object({
        scopes = list(string)
      }))
    }))
    google = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        client_id                  = optional(string)
        client_secret_setting_name = optional(string)
      }))
      login = optional(object({
        scopes = list(string)
      }))
      validation = optional(object({
        allowed_audiences = list(string)
      }))
    }))
    twitter = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        consumer_key                 = string
        consumer_secret_setting_name = optional(string)
      }))
    }))
    apple = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        client_id                  = string
        client_secret_setting_name = optional(string)
      }))
      login = optional(object({
        scopes = list(string)
      }))
    }))
    azure_static_web_apps = optional(object({
      enabled = optional(bool)
      registration = optional(object({
        client_id = string
      }))
    }))
    custom_open_id_connect_providers = optional(map(object({
      enabled = optional(bool)
      registration = optional(object({
        client_id = optional(string)
        client_credential = optional(object({
          method                     = string
          client_secret_setting_name = string
        }))
        open_id_connect_configuration = optional(object({
          authorization_endpoint           = string
          token_endpoint                   = string
          issuer                           = string
          certification_uri                = string
          well_known_open_id_configuration = optional(string)
        }))
      }))
      login = optional(object({
        name_claim_type = string
        scopes          = list(string)
      }))
    })), {})
  })
```

--------------------------------

### Default Azure Container App Deployment

Source: https://github.com/azure/terraform-azurerm-avm-res-app-containerapp/blob/main/examples/secret_path/README.md

This Terraform configuration deploys a basic Azure Container App with an Nginx container. It includes setting up the necessary Azure resources like resource group and container app environment. Use this for a straightforward deployment.

```hcl
# This ensures we have unique CAF compliant names for our resources.
module "naming" {
  source  = "Azure/naming/azurerm"
  version = "0.4.0"
}

# This is required for resource modules
resource "azurerm_resource_group" "this" {
  location = "australiaeast"
  name     = module.naming.resource_group.name_unique
}

data "azurerm_client_config" "current" {}

resource "azapi_resource_action" "register_microsoft_app" {
  action      = "/providers/Microsoft.App/register"
  method      = "POST"
  resource_id = "/subscriptions/${data.azurerm_client_config.current.subscription_id}"
  type        = "Microsoft.Resources/subscriptions@2021-04-01"
}

resource "azurerm_container_app_environment" "this" {
  location            = azurerm_resource_group.this.location
  name                = module.naming.container_app_environment.name_unique
  resource_group_name = azurerm_resource_group.this.name

  depends_on = [azapi_resource_action.register_microsoft_app]
}

locals {
  test_nginx_config = file("${path.module}/nginx.conf")
}

# This is the module call
module "container_app" {
  source = "../../"

  container_app_environment_resource_id = azurerm_container_app_environment.this.id
  name                                  = module.naming.container_app.name_unique
  resource_group_name                   = azurerm_resource_group.this.name
  template = {
    containers = [{
      image  = "nginx:alpine"
      name   = "nginx"
      cpu    = "0.25"
      memory = "0.5Gi"
      readiness_probes = [{
        initial_delay_seconds = 5
        path                  = "/health"
        period_seconds        = 10
        port                  = 80
        transport             = "HTTP"
      }]
      volume_mounts = [{
        name = "nginx-config"
        path = "/etc/nginx/conf.d"
      }]
    }]
    volumes = [{
      name         = "nginx-config"
      storage_type = "Secret"
      secrets = [{
        secret_name = "nginx-config"
        path        = "default.conf"
      }]
    }]
  }
  enable_telemetry = false
  ingress = {
    external_enabled = true
    target_port      = 80
    traffic_weight = [{
      latest_revision = true
      percentage      = 100
    }]
  }
  location          = azurerm_resource_group.this.location
  resource_group_id = azurerm_resource_group.this.id
  revision_mode     = "Single"
  secrets = {
    nginx_config = {
      name  = "nginx-config"
      value = local.test_nginx_config
    }
  }
}

```