azurerm_container_app, data.azurerm_container_app - support for additional_port_mapping in ingress block

internal/services/containerapps/container_app_resource_test.go

@@ -2363,6 +2363,11 @@ resource "azurerm_container_app" "test" {
       latest_revision = true
       percentage      = 100
     }
+    additional_port_mapping {
+      external     = true
+      exposed_port = 5556
+      target_port  = 5556
+    }
   }
 }
 `, r.templateWithVnet(data), data.RandomInteger, revisionSuffix)

internal/services/containerapps/helpers/container_apps.go

@@ -12,6 +12,7 @@ import (
 	"github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2023-05-01/daprcomponents"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2024-03-01/containerapps"
 	"github.com/hashicorp/go-azure-sdk/resource-manager/containerapps/2024-03-01/managedenvironments"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/sdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/containerapps/validate"
 	keyVaultValidate "github.com/hashicorp/terraform-provider-azurerm/internal/services/keyvault/validate"
@@ -158,6 +159,7 @@ type Ingress struct {
 	TrafficWeights         []TrafficWeight         `tfschema:"traffic_weight"`
 	Transport              string                  `tfschema:"transport"`
 	IpSecurityRestrictions []IpSecurityRestriction `tfschema:"ip_security_restriction"`
+	AdditionalPortMappings []IngressPortMapping    `tfschema:"additional_port_mapping"`
 }
 
 func ContainerAppIngressSchema() *pluginsdk.Schema {
@@ -214,6 +216,7 @@ func ContainerAppIngressSchema() *pluginsdk.Schema {
 					ValidateFunc: validation.StringInSlice(containerapps.PossibleValuesForIngressTransportMethod(), false),
 					Description:  "The transport method for the Ingress. Possible values include `auto`, `http`, and `http2`, `tcp`. Defaults to `auto`",
 				},
+				"additional_port_mapping": ContainerAppIngressAdditionalPortMapping(),
 			},
 		},
 	}
@@ -266,6 +269,7 @@ func ContainerAppIngressSchemaComputed() *pluginsdk.Schema {
 					Computed:    true,
 					Description: "The transport method for the Ingress. Possible values include `auto`, `http`, and `http2`, `tcp`. Defaults to `auto`",
 				},
+				"additional_port_mapping": ContainerAppIngressAdditionalPortMappingComputed(),
 			},
 		},
 	}
@@ -286,6 +290,7 @@ func ExpandContainerAppIngress(input []Ingress, appName string) *containerapps.I
 		ExposedPort:            pointer.To(ingress.ExposedPort),
 		Traffic:                expandContainerAppIngressTraffic(ingress.TrafficWeights, appName),
 		IPSecurityRestrictions: expandIpSecurityRestrictions(ingress.IpSecurityRestrictions),
+		AdditionalPortMappings: expandAdditionalPortMappings(ingress.AdditionalPortMappings),
 	}
 	transport := containerapps.IngressTransportMethod(ingress.Transport)
 	result.Transport = &transport
@@ -308,6 +313,7 @@ func FlattenContainerAppIngress(input *containerapps.Ingress, appName string) []
 		ExposedPort:            pointer.From(ingress.ExposedPort),
 		TrafficWeights:         flattenContainerAppIngressTraffic(ingress.Traffic, appName),
 		IpSecurityRestrictions: flattenContainerAppIngressIpSecurityRestrictions(ingress.IPSecurityRestrictions),
+		AdditionalPortMappings: flattenContainerAppIngressAdditionalPortMappings(ingress.AdditionalPortMappings),
 	}
 
 	if ingress.Transport != nil {
@@ -462,6 +468,12 @@ type IpSecurityRestriction struct {
 	Name           string `tfschema:"name"`
 }
 
+type IngressPortMapping struct {
+	ExposedPort *int64 `tfschema:"exposed_port"`
+	External    bool   `tfschema:"external"`
+	TargetPort  int64  `tfschema:"target_port"`
+}
+
 func ContainerAppIngressIpSecurityRestriction() *pluginsdk.Schema {
 	return &pluginsdk.Schema{
 		Type:     pluginsdk.TypeList,
@@ -571,6 +583,59 @@ func ContainerAppIngressTrafficWeight() *pluginsdk.Schema {
 	}
 }
 
+func ContainerAppIngressAdditionalPortMapping() *pluginsdk.Schema {
+	return &pluginsdk.Schema{
+		Type:     pluginsdk.TypeList,
+		Optional: true,
+		Elem: &pluginsdk.Resource{
+			Schema: map[string]*schema.Schema{
+				"external": {
+					Type:        pluginsdk.TypeBool,
+					Required:    true,
+					Description: "Whether the app port is accessible outside of the environment",
+				},
+				"target_port": {
+					Type:        pluginsdk.TypeInt,
+					Required:    true,
+					Description: "The additional target port on the container for the Ingress traffic.",
+				},
+				"exposed_port": {
+					Type:         pluginsdk.TypeInt,
+					Optional:     true,
+					ValidateFunc: validation.IntBetween(1, 65535),
+					Description:  "The additional exposed port for the Ingress traffic.",
+				},
+			},
+		},
+	}
+}
+
+func ContainerAppIngressAdditionalPortMappingComputed() *pluginsdk.Schema {
+	return &pluginsdk.Schema{
+		Type:     pluginsdk.TypeList,
+		Optional: true,
+		Elem: &pluginsdk.Resource{
+			Schema: map[string]*schema.Schema{
+				"external": {
+					Type:        pluginsdk.TypeBool,
+					Computed:    true,
+					Description: "Whether the app port is accessible outside of the environment",
+				},
+				"target_port": {
+					Type:        pluginsdk.TypeInt,
+					Computed:    true,
+					Description: "The additional target port on the container for the Ingress traffic.",
+				},
+				"exposed_port": {
+					Type:        pluginsdk.TypeInt,
+					Computed:    true,
+					Description: "The additional exposed port for the Ingress traffic.",
+				},
+			},
+		},
+	}
+}
+
 func ContainerAppIngressTrafficWeightComputed() *pluginsdk.Schema {
 	return &pluginsdk.Schema{
 		Type:     pluginsdk.TypeList,
@@ -670,6 +735,36 @@ func expandIpSecurityRestrictions(input []IpSecurityRestriction) *[]containerapp
 	return &result
 }
 
+func expandAdditionalPortMappings(input []IngressPortMapping) *[]containerapps.IngressPortMapping {
+	if input == nil {
+		return &[]containerapps.IngressPortMapping{}
+	}
+	result := make([]containerapps.IngressPortMapping, len(input))
+	for i, mapping := range input {
+		result[i] = containerapps.IngressPortMapping{
+			ExposedPort: mapping.ExposedPort,
+			External:    mapping.External,
+			TargetPort:  mapping.TargetPort,
+		}
+	}
+	return &result
+}
+
+func flattenContainerAppIngressAdditionalPortMappings(input *[]containerapps.IngressPortMapping) []IngressPortMapping {
+	if input == nil {
+		return []IngressPortMapping{}
+	}
+	result := make([]IngressPortMapping, len(*input))
+	for i, v := range *input {
+		result[i] = IngressPortMapping{
+			ExposedPort: v.ExposedPort,
+			External:    v.External,
+			TargetPort:  v.TargetPort,
+		}
+	}
+	return result
+}
+
 type Dapr struct {
 	AppId       string `tfschema:"app_id"`
 	AppPort     int64  `tfschema:"app_port"`

website/docs/d/container_app.html.markdown

@@ -43,6 +43,8 @@ In addition to the Arguments listed above - the following Attributes are exporte
 
 * `ingress` - An `ingress` block as detailed below.
 
+* `additional_port_mapping` - One or more `additional_port_mapping` blocks as detailed below.
+
 * `registry` - A `registry` block as detailed below.
 
 * `secret` - One or more `secret` block as detailed below.
@@ -285,6 +287,16 @@ An `ingress` block supports the following:
 
 ---
 
+An `additional_port_mapping` block supports the following:
+
+* `external` - Whether the app port is accessible outside of the environment.
+
+* `target_port` - The additional target port on the container for the Ingress traffic.
+
+* `exposed_port` - The additional exposed port for the Ingress traffic.
+
+---
+
 A `custom_domain` block supports the following:
 
 * `certificate_binding_type` - The Binding type. Possible values include `Disabled` and `SniEnabled`. Defaults to `Disabled`.

website/docs/r/container_app.html.markdown

@@ -398,6 +398,8 @@ An `ingress` block supports the following:
 
 ~> **Note:**  if `transport` is set to `tcp`, `exposed_port` and `target_port` should be set at the same time.
 
+* `additional_port_mapping` - (Optional) One or more `additional_port_mapping` blocks as detailed below.
+
 ---
 
 A `ip_security_restriction` block supports the following:
@@ -432,6 +434,16 @@ A `traffic_weight` block supports the following:
 
 ---
 
+An `additional_port_mapping` block supports the following:
+
+* `external` - (Required) Whether the app port is accessible outside of the environment.
+
+* `target_port` - (Required) The additional target port on the container for the Ingress traffic.
+
+* `exposed_port` - (Optional) The additional exposed port for the Ingress traffic.
+
+---
+
 A `dapr` block supports the following:
 
 * `app_id` - (Required) The Dapr Application Identifier.