0

It seems like I have a chicken-and-egg problem with deploying my Azure Container App Apps. So I have one project that deploys let's say 'the base infrastructure' for my multi-service app in Azure. It deploys an Azure Container App Environment where those multiple apps can land on. Because these apps have a different lifecycles, I need those apps to deploy independently.

One of the apps is an API that I would like to expose over HTTP(S) with a custom domain and a managed cert. Now when I deploy the Container App Environment, I cannot add a managed cert because the now the resource manager stars complaining there is no app that has the custom domain I want to create a cert for, configured as a custom domain:

{
"message": "Creating managed certificate requires hostname 'xxx.xxxxxx.xxx' added as a custom hostname to a container app in environment 'container-app-environment-name'"
}

On the other hand, I cannot deploy the Container App with a custom domain name, and attach a managed certificate to it, because it requires you to provide the resource ID of the managed certificate, which is not there.

So the workflow must be:

  • add a custom domain name the the app
  • request a managed cert for the domain name
  • attach the managed cert to the app's custom domain name

And to be honest, I really don't know how to do this in an automated way. The current deployments are all GitHub Actions deployments which push containers to a registry, and deploys those containers in Az Container Apps using Bicep.

Any ideas?

Eduard Keilholz
  • 820
  • 8
  • 27

1 Answers1

2

The way to do it currently is to have two separate deployment steps:

First deployment step:

  1. Create the app with the custom domain (in a 'Disabled' state)
  2. Create the managed cert

Second deployment step:

  1. Change the app's custom domain from 'Disabled' to 'SniEnabled'

This a simple example: https://github.com/microsoft/azure-container-apps/tree/main/docs/templates/bicep/managedCertificates

Vini Soto
  • 376
  • 1
  • 5
  • Thanks Vini, I leaned the item is tracked here: https://github.com/microsoft/azure-container-apps/issues/796 Maybe allowing certs to be requested in the ACA Environment before the binding is used by one of the apps it contains could be a solution to prevent a two-step approach? – Eduard Keilholz Aug 30 '23 at 10:20