Add support for secrets from KV

README.md

@@ -134,13 +134,13 @@ docker run --rm -v ${pwd}:/src -w /src -e ARM_SUBSCRIPTION_ID -e ARM_TENANT_ID -
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.2 |
-| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 3.87, < 4.0 |
+| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | >= 3.98, < 4.0 |
 
 ## Providers
 
 | Name | Version |
 |------|---------|
-| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | >= 3.87, < 4.0 |
+| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | >= 3.98, < 4.0 |
 
 ## Modules
 
@@ -166,7 +166,7 @@ No modules.
 | <a name="input_container_app_environment_internal_load_balancer_enabled"></a> [container\_app\_environment\_internal\_load\_balancer\_enabled](#input\_container\_app\_environment\_internal\_load\_balancer\_enabled) | (Optional) Should the Container Environment operate in Internal Load Balancing Mode? Defaults to `false`. Changing this forces a new resource to be created. | `bool` | `null` | no |
 | <a name="input_container_app_environment_name"></a> [container\_app\_environment\_name](#input\_container\_app\_environment\_name) | (Required) The name of the container apps managed environment. Changing this forces a new resource to be created. | `string` | n/a | yes |
 | <a name="input_container_app_environment_tags"></a> [container\_app\_environment\_tags](#input\_container\_app\_environment\_tags) | A map of the tags to use on the resources that are deployed with this module. | `map(string)` | `{}` | no |
-| <a name="input_container_app_secrets"></a> [container\_app\_secrets](#input\_container\_app\_secrets) | (Optional) The secrets of the container apps. The key of the map should be aligned with the corresponding container app. | <pre>map(list(object({<br>    name  = string<br>    value = string<br>  })))</pre> | `{}` | no |
+| <a name="input_container_app_secrets"></a> [container\_app\_secrets](#input\_container\_app\_secrets) | (Optional) The secrets of the container apps. The key of the map should be aligned with the corresponding container app. | <pre>map(list(object({<br>    name                = string<br>    value               = optional(string, null)<br>    identity            = optional(string, null)<br>    key_vault_secret_id = optional(string, null)<br>  })))</pre> | `{}` | no |
 | <a name="input_container_apps"></a> [container\_apps](#input\_container\_apps) | The container apps to deploy. | <pre>map(object({<br>    name                  = string<br>    tags                  = optional(map(string))<br>    revision_mode         = string<br>    workload_profile_name = optional(string)<br><br>    template = object({<br>      init_containers = optional(set(object({<br>        args    = optional(list(string))<br>        command = optional(list(string))<br>        cpu     = optional(number)<br>        image   = string<br>        name    = string<br>        memory  = optional(string)<br>        env = optional(list(object({<br>          name        = string<br>          secret_name = optional(string)<br>          value       = optional(string)<br>        })))<br>        volume_mounts = optional(list(object({<br>          name = string<br>          path = string<br>        })))<br>      })), [])<br>      containers = set(object({<br>        name    = string<br>        image   = string<br>        args    = optional(list(string))<br>        command = optional(list(string))<br>        cpu     = string<br>        memory  = string<br>        env = optional(set(object({<br>          name        = string<br>          secret_name = optional(string)<br>          value       = optional(string)<br>        })))<br>        liveness_probe = optional(object({<br>          failure_count_threshold = optional(number)<br>          header = optional(object({<br>            name  = string<br>            value = string<br>          }))<br>          host             = optional(string)<br>          initial_delay    = optional(number, 1)<br>          interval_seconds = optional(number, 10)<br>          path             = optional(string)<br>          port             = number<br>          timeout          = optional(number, 1)<br>          transport        = string<br>        }))<br>        readiness_probe = optional(object({<br>          failure_count_threshold = optional(number)<br>          header = optional(object({<br>            name  = string<br>            value = string<br>          }))<br>          host                    = optional(string)<br>          interval_seconds        = optional(number, 10)<br>          path                    = optional(string)<br>          port                    = number<br>          success_count_threshold = optional(number, 3)<br>          timeout                 = optional(number)<br>          transport               = string<br>        }))<br>        startup_probe = optional(object({<br>          failure_count_threshold = optional(number)<br>          header = optional(object({<br>            name  = string<br>            value = string<br>          }))<br>          host             = optional(string)<br>          interval_seconds = optional(number, 10)<br>          path             = optional(string)<br>          port             = number<br>          timeout          = optional(number)<br>          transport        = string<br>        }))<br>        volume_mounts = optional(list(object({<br>          name = string<br>          path = string<br>        })))<br>      }))<br>      max_replicas    = optional(number)<br>      min_replicas    = optional(number)<br>      revision_suffix = optional(string)<br>      custom_scale_rule = optional(list(object({<br>        custom_rule_type = string<br>        metadata         = map(string)<br>        name             = string<br>        authentication = optional(list(object({<br>          secret_name       = string<br>          trigger_parameter = string<br>        })))<br>      })))<br>      http_scale_rule = optional(list(object({<br>        concurrent_requests = string<br>        name                = string<br>        authentication = optional(list(object({<br>          secret_name       = string<br>          trigger_parameter = optional(string)<br>        })))<br>      })))<br>      volume = optional(set(object({<br>        name         = string<br>        storage_name = optional(string)<br>        storage_type = optional(string)<br>      })))<br>    })<br><br>    ingress = optional(object({<br>      allow_insecure_connections = optional(bool, false)<br>      external_enabled           = optional(bool, false)<br>      ip_security_restrictions = optional(list(object({<br>        action           = string<br>        ip_address_range = string<br>        name             = string<br>        description      = optional(string)<br>      })), [])<br>      target_port = number<br>      transport   = optional(string)<br>      traffic_weight = object({<br>        label           = optional(string)<br>        latest_revision = optional(string)<br>        revision_suffix = optional(string)<br>        percentage      = number<br>      })<br>    }))<br><br>    identity = optional(object({<br>      type         = string<br>      identity_ids = optional(list(string))<br>    }))<br><br>    dapr = optional(object({<br>      app_id       = string<br>      app_port     = number<br>      app_protocol = optional(string)<br>    }))<br><br>    registry = optional(list(object({<br>      server               = string<br>      username             = optional(string)<br>      password_secret_name = optional(string)<br>      identity             = optional(string)<br>    })))<br><br>  }))</pre> | n/a | yes |
 | <a name="input_dapr_component"></a> [dapr\_component](#input\_dapr\_component) | (Optional) The Dapr component to deploy. | <pre>map(object({<br>    name           = string<br>    component_type = string<br>    version        = string<br>    ignore_errors  = optional(bool, false)<br>    init_timeout   = optional(string, "5s")<br>    scopes         = optional(list(string))<br>    metadata = optional(set(object({<br>      name        = string<br>      secret_name = optional(string)<br>      value       = string<br>    })))<br>  }))</pre> | `{}` | no |
 | <a name="input_dapr_component_secrets"></a> [dapr\_component\_secrets](#input\_dapr\_component\_secrets) | (Optional) The secrets of the Dapr components. The key of the map should be aligned with the corresponding Dapr component. | <pre>map(list(object({<br>    name  = string<br>    value = string<br>  })))</pre> | `{}` | no |

examples/acr/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.11, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
     docker = {
       source  = "kreuzwerker/docker"

examples/dapr/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.11, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
     curl = {
       source  = "anschoewe/curl"

examples/existing-env/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.11, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
     modtm = {
       source  = "Azure/modtm"

examples/init-container/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.85, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
     modtm = {
       source  = "Azure/modtm"

examples/startup/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.11, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
     modtm = {
       source  = "Azure/modtm"

locals.tf

@@ -1,4 +1,4 @@
 locals {
-  container_app_secrets  = { for k, v in var.container_app_secrets : k => { for i in v : i.name => i.value } }
+  container_app_secrets  = { for k, v in var.container_app_secrets : k => { for i in v : i.name => i } }
   dapr_component_secrets = { for k, v in var.dapr_component_secrets : k => { for i in v : i.name => i.value } }
 }

main.tf

@@ -361,8 +361,10 @@ resource "azurerm_container_app" "container_app" {
     for_each = nonsensitive(toset([for pair in lookup(var.container_app_secrets, each.key, []) : pair.name]))
 
     content {
-      name  = secret.key
-      value = local.container_app_secrets[each.key][secret.key]
+      name                = secret.key
+      value               = local.container_app_secrets[each.key][secret.key].value
+      identity            = local.container_app_secrets[each.key][secret.key].identity
+      key_vault_secret_id = local.container_app_secrets[each.key][secret.key].key_vault_secret_id
     }
   }
 }

variables.tf

@@ -219,8 +219,10 @@ variable "container_app_environment_tags" {
 
 variable "container_app_secrets" {
   type = map(list(object({
-    name  = string
-    value = string
+    name                = string
+    value               = optional(string, null)
+    identity            = optional(string, null)
+    key_vault_secret_id = optional(string, null)
   })))
   default     = {}
   description = "(Optional) The secrets of the container apps. The key of the map should be aligned with the corresponding container app."

versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = ">= 3.87, < 4.0"
+      version = ">= 3.98, < 4.0"
     }
   }
 }