azurerm_container_app - Does not allow multiple custom_domain blocks

[srjobinar]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.3.5

AzureRM Provider Version

3.45.0

Affected Resource(s)/Data Source(s)

azurerm_container_app

Terraform Configuration Files

# Relevant section of terraform with dummy values

resource "azurerm_container_app" "container_app" {
  name                         = "container-app"
  container_app_environment_id = "<env_id>"
  resource_group_name          = "container-app-rg"
  revision_mode                = "Single"

  ingress {
    target_port = 80
    external_enabled = true
    traffic_weight {
      percentage = 100
    }
    custom_domain {
      certificate_id = "<certificate_id_from_container_apps_environment>"
      name          = "customDomain1"
    }
    custom_domain {
      certificate_id = "<certificate_id_from_container_apps_environment>"
      name          = "customDomain2"
    }
  }

  registry {
    server               = "containerappeun.azurecr.io"
    identity             = "<user_assigned_identity>"
  }

  identity {
    type = "UserAssigned"
    identity_ids = ["<user_assigned_identity>"]
  }

  template {
    container {
      name   = "container-app"
      image  = "<valid_image>"
      cpu    = var.container_cpu_request
      memory = var.container_mem_request
    }
    min_replicas = var.container_min_replicas
    max_replicas = var.container_max_replicas
  }
}

Debug Output/Panic Output

│ Error: Too many custom_domain blocks
│ 
│   on main.tf line 127, in resource "azurerm_container_app" "container_app":
│  127:     custom_domain {
│ 
│ No more than 1 "custom_domain" blocks are allowed

Expected Behaviour

According to the documentation:
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_app#custom_domain

One or more custom_domain block should be allowed and hence when applying terraform,
Container App should be created with 2 custom domains configured.

Actual Behaviour

terraform plan fails with the following validation error:

│ Error: Too many custom_domain blocks
│ 
│   on main.tf line 127, in resource "azurerm_container_app" "container_app":
│  127:     custom_domain {
│ 
│ No more than 1 "custom_domain" blocks are allowed

Looking at the code (With my very limited knowledge of Go)
In the customDomain schema maxitems seems to be set to one which could be the problem.

Steps to Reproduce

terraform plan

Important Factoids

No response

References

No response

[caiola]

You should have a list of objects:

resource "azurerm_container_app" "container_app" {
(...)
dynamic "ingress" {
    for_each = each.value.ingress != null ? [each.value.ingress] : []
    content {
      allow_insecure_connections = try(ingress.value.allow_insecure_connections, null)
      external_enabled           = try(ingress.value.external_enabled, null)
      target_port                = ingress.value.target_port
      transport                  = ingress.value.transport

      dynamic "traffic_weight" {
        for_each = coalesce(ingress.value.traffic_weight, [])
        content {
          label           = traffic_weight.value.label
          latest_revision = traffic_weight.value.latest_revision
          revision_suffix = traffic_weight.value.revision_suffix
          percentage      = traffic_weight.value.percentage
        }
      }

      # Custom domain configuration
      dynamic custom_domain {
        for_each = coalesce(ingress.value.custom_domain, [])
        content {
          name                     = custom_domain.value.name
          certificate_binding_type = custom_domain.value.certificate_binding_type  # Use "SniEnabled" for SSL/TLS support
          certificate_id           = custom_domain.value.certificate_id
        }
      }
    }
  }
(...)

[jackofallops]

I believe this needs to be implemented as an external resource in the same pattern as per azurerm_static_site_custom_domain which will update the existing resource.

[milesbarnard]

Any update on this? I'm also having this issue. The PR appears to be mostly done

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.