azurerm container app traffic weight bug?

[garyw-xlabs]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.4.2

AzureRM Provider Version

4.0.1

Affected Resource(s)/Data Source(s)

azurerm_container_app

Terraform Configuration Files

terraform {
  required_version = ">= 1.1.7, < 2.0.0"
  required_providers {
    azurerm = {
      version = "3.86.0"
      source  = "hashicorp/azurerm"
    }
  }

}

provider "azurerm" {
  features {}
}

data "azurerm_client_config" "current" {}

locals {
  environment_name = "test"
  location         = "ukSouth"
  tags             = { azd-env-name : local.environment_name }
  sha              = base64encode(sha256("${local.environment_name}${local.location}${data.azurerm_client_config.current.subscription_id}"))
  resource_token   = substr(replace(lower(local.sha), "[^A-Za-z0-9_]", ""), 0, 13)
  stack            = "playground-tf"
}
resource "azurecaf_name" "rg_name" {
  name          = local.environment_name
  resource_type = "azurerm_resource_group"
  random_length = 0
  clean_input   = true
}

resource "azurerm_resource_group" "rg" {
  name     = azurecaf_name.rg_name.result
  location = local.location
  tags     = local.tags
}

resource "azurerm_user_assigned_identity" "acr_reader" {
  location            = local.location
  name                = "mi-ca-${local.resource_token}"
  resource_group_name = azurerm_resource_group.rg.name
}
resource "azurerm_container_registry" "acr" {
  name                = "acr${local.resource_token}"
  location            = local.location
  resource_group_name = azurerm_resource_group.rg.name
  admin_enabled       = true
  sku                 = "Basic"
}

resource "azurerm_role_assignment" "containerapp" {
  scope                = lower("/subscriptions/bb87627c-ce2f-4c01-8257-2e5c1f074a28/resourceGroups/${azurerm_resource_group.rg.name}/providers/Microsoft.ContainerRegistry/registries/${azurerm_container_registry.acr.name}")
  role_definition_name = "AcrPull"
  principal_id         = azurerm_user_assigned_identity.acr_reader.principal_id
}

resource "azurerm_log_analytics_workspace" "log" {
  name                = "log-${local.resource_token}"
  location            = local.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "PerGB2018"
  retention_in_days   = 30
  tags                = local.tags
}

resource "azurerm_container_app_environment" "cae" {
  name                       = "cae-${local.resource_token}"
  location                   = local.location
  resource_group_name        = azurerm_resource_group.rg.name
  log_analytics_workspace_id = azurerm_log_analytics_workspace.log.id

  tags = local.tags
}

resource "azurerm_container_app" "app" {
  name = "ca-${local.resource_token}"

  container_app_environment_id = azurerm_container_app_environment.cae.id
  resource_group_name          = azurerm_resource_group.rg.name
  revision_mode                = "Multiple"
  tags                         = merge(tomap({ "azd-service-name" = "app" }), local.tags, )
  depends_on                   = [azurerm_role_assignment.containerapp, azurerm_user_assigned_identity.acr_reader]

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.acr_reader.id]
  }

  registry {
    server   = azurerm_container_registry.acr.login_server
    identity = azurerm_user_assigned_identity.acr_reader.id
  }
  template {
    revision_suffix = "1"
    container {
      name   = "ca-${local.resource_token}"
      image  = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
      cpu    = 0.25
      memory = "0.5Gi"

      env {
        name  = "AZURE_CLIENT_ID"
        value = azurerm_user_assigned_identity.acr_reader.client_id
      }
    }
    min_replicas = 1
    max_replicas = 1
  }
  ingress {
    external_enabled = true
    target_port      = 80

    traffic_weight {
      revision_suffix = "1"
      label           = "blue"
      percentage      = 100
    }

    dynamic "traffic_weight" {
      for_each = []
      content {
        revision_suffix = ""
        label           = "green"
        percentage      = 0
      }
    }
  }
}

Debug Output/Panic Output

│ Error: `ingress.0.traffic_weight.0.latest_revision` must be set to true during creation
│
│   with azurerm_container_app.app,
│   on main.tf line 80, in resource "azurerm_container_app" "app":
│   80: resource "azurerm_container_app" "app" {
│
╵

Expected Behaviour

A new container app should have been created in multiple revision mode, with label of "blue" and traffic set 100%.

Actual Behaviour

The terraform currently fails with nothing been created.

the same terraform works as expected if the azurerm version is pinned to 3.86.0

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[magodo]

This validation is added in #24042. The reason for this specific check on the latest revision is that if you create a new ACA without specifying the latest revision, it will defaults to false, which causes the creation request hang and fail as a result, with error message similar to:

{"id":"/subscriptions/xxxx/providers/Microsoft.App/locations/eastus2/containerappOperationStatuses/bbbe0a7b-3499-4873-956b-83356e5ca94d","name":"bbbe0a7b-3499-4873-956b-83356e5ca94d","status":"Failed","error":{"code":"ContainerAppOperationError","message":"Failed to provision revision for container app 'acctest-capp-222'. Error details: Operation expired."},"startTime":"2024-08-29T02:52:45.1333427"}

So during the creation, you'll have to ensure the ingress.0.traffic_weight.0.latest_revision is set to true.

[garyw-xlabs]

@magodo thanks for your response, it seems like you are saying this is not a bug.
however, it is not possible to set both latest_revision and revision_suffix in the terraform as we then get the following error

without setting the revision_suffix we dont have control over the containers to allow blue green deployments in subsequent deployments.
can you please advise on the correct combination of properties to create a new container app in multiple revision mode with both a revision suffix and a label after version 3.86.0, which did allow this behaviour.
im completely stumped.

[magodo]

Could you please share with me a minimal config that you used to work in v3.86.0, with all values interpolated, so I can take a further look?

[garyw-xlabs]

@magodo thanks, the above terraform in the original comment has the minimal config required. all values are either hard coded or taken from the locals section.
it is also pinned to the last version that worked