dtos-devops-templates/infrastructure/modules/container-app-job/main.tf at c252bfc0f1a2f54cc31750f9b364c3d8507741eb · NHSDigital/dtos-devops-templates · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# Merge the identities passed in via a variables:
locals {
  all_identity_ids = compact(concat(
    [var.acr_managed_identity_id],
    var.user_assigned_identity_ids,
    [module.container_app_identity.id]
  ))
}

module "container_app_identity" {
  source              = "../managed-identity"
  resource_group_name = var.resource_group_name
  location            = var.location
  uai_name            = "mi-${var.name}"
}

module "key_vault_reader_role_app" {
  count = var.fetch_secrets_from_app_key_vault ? 1 : 0

  source = "../rbac-assignment"

  scope                = var.app_key_vault_id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = module.container_app_identity.principal_id
}

resource "azurerm_container_app_job" "this" {
  name                = var.name
  location            = var.location
  resource_group_name = var.resource_group_name

  container_app_environment_id = var.container_app_environment_id
  replica_timeout_in_seconds   = var.replica_timeout_in_seconds
  replica_retry_limit          = var.replica_retry_limit
  workload_profile_name        = var.workload_profile_name

  identity {
    type         = "UserAssigned"
    identity_ids = local.all_identity_ids
  }

  dynamic "secret" {

    for_each = var.fetch_secrets_from_app_key_vault ? data.azurerm_key_vault_secrets.app[0].secrets : []

    content {
      # KV secrets are uppercase and hyphen separated
      # app container secrets are lowercase and hyphen separated
      name                = lower(secret.value.name)
      identity            = module.container_app_identity.id
      key_vault_secret_id = secret.value.id
    }
  }

  # Configure manual trigger for on-demand execution via CLI
  dynamic "manual_trigger_config" {
    for_each = var.cron_expression == null ? [1] : []
    content {
      parallelism              = var.job_parallelism
      replica_completion_count = var.replica_completion_count
    }
  }

  # Configure schedule trigger for scheduled execution
  dynamic "schedule_trigger_config" {
    for_each = var.cron_expression != null ? [1] : []
    content {
      cron_expression          = var.cron_expression
      parallelism              = var.job_parallelism
      replica_completion_count = var.replica_completion_count
    }
  }

  dynamic "secret" {
    for_each = var.secret_variables
    content {
      name  = replace(lower(secret.key), "_", "-")
      value = secret.value
    }
  }

  # Define the container template for the job.
  template {

    container {
      name   = var.name
      image  = var.docker_image
      cpu    = local.cpu
      memory = local.memory

      # Optional: Command to execute in the container.
      command = var.container_command
      args    = var.container_args

      # Optional: Environment variables for the container.
      dynamic "env" {
        for_each = var.environment_variables
        content {
          name  = env.key
          value = env.value
        }
      }

      dynamic "env" {
        for_each = var.fetch_secrets_from_app_key_vault ? data.azurerm_key_vault_secrets.app[0].secrets : []
        content {
          # Env vars are uppercase and underscore separated
          name = upper(replace(env.value.name, "-", "_"))
          # KV secrets are uppercase and hyphen separated
          # app container secrets are lowercase and hyphen separated
          secret_name = lower(env.value.name)
        }
      }

      dynamic "env" {
        for_each = var.secret_variables
        content {
          # Env vars are uppercase and underscore separated
          name = upper(replace(env.key, "-", "_"))
          # app container secrets are lowercase and hyphen separated
          secret_name = replace(lower(env.key), "_", "-")
        }
      }
    }
  }

  # Optional: Configure private registry access using Managed Identity
  dynamic "registry" {
    for_each = var.acr_login_server != null && var.acr_managed_identity_id != null ? [1] : []

    content {
      server   = var.acr_login_server
      identity = var.acr_managed_identity_id
    }
  }
}