Azure Container Apps

The Azure plugin supports deploying Azure Container Apps (azure.ContainerApp) with full configuration for containers, ingress, secrets, volumes, scaling, and service bindings.

Prerequisites

Before you begin, ensure you have:

• Set up an Azure Cloud connection.
• A Resource Group (azure.ResourceGroup) provisioned in your environment CI.

Create a Container App

An azure.ContainerApp is the top-level resource that holds all Container App configuration. Sub-components—containers, ingress rules, secrets, volumes, and registries—are defined as nested CIs within it.

1. In the side navigation bar, click Explorer.
2. Under Applications, expand your provisioning package.
3. Click , then select New > azure > ContainerAppSpec.
4. Configure the Container App properties as required, then add sub-components as described in the sections below.
5. Click Save and close and deploy.

Add Containers

Add a Container

Use azure.container to define a container that runs within the Container App.

1. On the Container App CI, click , then select New > azure > containerSpec.

2. Specify the following properties:

   Property	Required	Description
   Image	Yes	Container image name and tag (for example, myregistry.azurecr.io/myapp:latest).
   CPU	No	CPU cores allocated to the container.
   Memory	No	Memory allocation (for example, 0.5Gi).
   Command	No	Entrypoint command override for the container.
   Args	No	Arguments passed to the container command.

3. Add environment variables, probes, and volume mounts to the container using the sub-components below.

Add an Init Container

Use azure.initContainer to define an initialization container that runs to completion before the main containers start.

1. On the Container App CI, click , then select New > azure > initContainerSpec.
2. Specify image, CPU, memory, command, and args in the same way as a regular container.

Add Container Environment Variables

Use azure.containerAppEnvVariable to define environment variables on a container. Variables can reference plain-text values or Container App secrets.

1. On the container CI, click , then select New > azure > containerAppEnvVariableSpec.

2. Specify the following properties:

   Property	Required	Description
   Name	Yes	Environment variable name.
   Value	No	Plain-text value (use either this or Secret Ref, not both).
   Secret Ref	No	Name of a Container App secret whose value to inject.

Add Container Probes

Use azure.containerProbe to configure liveness, readiness, or startup probes on a container.

1. On the container CI, click , then select New > azure > containerProbeSpec.
2. Specify the probe type (liveness, readiness, or startup) and configure HTTP path, port, initial delay, period, and failure thresholds as required.

Add Volume Mounts

Use azure.containerVolumeMount to mount a named volume into a container.

1. On the container CI, click , then select New > azure > containerVolumeMountSpec.

2. Specify the following properties:

   Property	Required	Description
   Volume Name	Yes	Name of the volume to mount (must match a volume defined on the Container App).
   Mount Path	Yes	Absolute path inside the container at which to mount the volume.
   Sub Path	No	Sub-path within the volume source to mount into the container.

Configure Ingress

Map Custom Domains

Use azure.ingressCustomDomain to map a custom domain to the Container App.

On the Container App CI, click , then select New > azure > ingressCustomDomainSpec.

Property	Required	Description
Domain Name	Yes	The custom domain to associate (for example, app.example.com).
Certificate ID	No	Resource ID of the managed or imported certificate for TLS.
Binding Type	No	SNI or Disabled.

Configure Traffic Weights

Use azure.ingressTrafficWeight to distribute traffic between revisions, enabling canary or blue-green patterns.

On the Container App CI, click , then select New > azure > ingressTrafficWeightSpec.

Property	Required	Description
Revision Name	No	Name of a specific revision. Leave empty to target the latest revision.
Weight	Yes	Percentage of incoming traffic to route to this revision (0–100).
Latest Revision	No	If true, routes traffic to the latest active revision automatically.

Restrict Inbound IP Addresses

Use azure.ingressIpSecurityRestriction to allow or deny traffic from specific IP address ranges.

On the Container App CI, click , then select New > azure > ingressIpSecurityRestrictionSpec.

Property	Required	Description
Name	Yes	Descriptive name for this restriction rule.
IP Address Range	Yes	CIDR block to match (for example, 10.0.0.0/8).
Action	Yes	Allow or Deny.

Configure Secrets

Use azure.containerAppSecret to define secrets that can be referenced by environment variables or projected into volumes.

On the Container App CI, click , then select New > azure > containerAppSecretSpec.

Property	Required	Description
Name	Yes	Secret name. Referenced in env variables via secretRef.
Value	No	Plain-text secret value.
Key Vault URL	No	Azure Key Vault secret reference URL for managed secret rotation.
Identity	No	Managed identity resource ID to use when accessing Key Vault.

Configure Volumes

Add a Volume

Use azure.containerVolume to define a named volume that containers can mount.

On the Container App CI, click , then select New > azure > containerVolumeSpec.

Property	Required	Description
Volume Name	Yes	Name of the volume. Must be unique within the Container App.
Storage Type	No	AzureFile, EmptyDir, or Secret.
Storage Name	No	Name of the Azure Files storage mount. Required when Storage Type is AzureFile.

Project Secrets into a Volume

Use azure.volumeSecret to list individual secrets to project as files into a Secret-type volume.

On the volume CI, click , then select New > azure > volumeSecretSpec.

Property	Required	Description
Secret Name	Yes	Name of the Container App secret to project.
Path	No	File name within the volume at which to write the secret value. Defaults to the secret name.

Configure a Private Container Registry

Use azure.privateContainerRegistry to allow the Container App to pull images from a private registry using credentials or a managed identity.

On the Container App CI, click , then select New > azure > privateContainerRegistrySpec.

Property	Required	Description
Server	Yes	Registry server URL (for example, myregistry.azurecr.io).
Username	No	Registry username. Not required when using managed identity.
Password Secret	No	Name of a Container App secret that holds the registry password.
Identity	No	Managed identity resource ID to use for registry authentication.

Configure Service Bindings

Use azure.serviceBind to bind the Container App to a dev Container App Service (such as a managed Redis or PostgreSQL instance).

On the Container App CI, click , then select New > azure > serviceBindSpec.

Property	Required	Description
Name	Yes	Name of the service binding.
Service ID	Yes	Full resource ID of the Container App Service to bind to.