Azure 容器应用 ARM 和 YAML 模板规范

项目
09/09/2024

Azure 容器应用部署由 Azure 资源管理器 (ARM) 模板提供支持。某些容器应用 CLI 命令还支持使用 YAML 模板来指定资源。

本文包含常用容器应用资源的 ARM 和 YAML 配置示例。有关 Azure 容器应用资源的完整列表，请参阅用于 Azure 容器应用的 Azure 资源管理器模板。本文中列出的代码仅用于举例目的。有关完整架构和类型信息，请参阅所需 API 版本的 JSON 定义。

API 版本

Azure 容器应用的最新管理 API 版本为：

2023-05-01 (稳定)
2023-08-01-preview（预览版）

若要了解有关 API 版本之间差异的更多信息，请参阅 Microsoft.App 更改日志。

更新 API 版本

要在 ARM 或 Bicep 中使用特定 API 版本，请更新模板中引用的版本。若要在 Azure CLI 或 Azure PowerShell 中使用最新的 API 版本，请将其更新到最新版本。

通过运行以下命令更新 Azure CLI 和 Azure 容器应用扩展：

az upgrade
az extension add -n containerapp --upgrade

若要更新 Azure PowerShell，请参阅如何安装 Azure PowerShell。

若要使用最新 API 版本以编程方式管理 Azure 容器应用，请使用最新版本的管理 SDK：

容器应用环境

下表描述了 Azure 容器应用环境资源中可用的常用属性。有关属性的完整列表，请参阅 Azure 容器应用 REST API 参考。

资源

Azure 容器应用环境资源包括以下属性：

properties	说明	数据类型	只读
`daprAIInstrumentationKey`	Dapr 使用的 Application Insights 检测密钥。	string	否
`appLogsConfiguration`	环境的日志记录配置。	Object	否
`peerAuthentication`	如何启用 mTLS 加密。	Object	否

示例

以下示例 ARM 模板片段部署 Azure 容器应用环境。

注意

用于创建容器应用环境的命令不支持 YAML 配置输入。

{
  "location": "China East",
  "properties": {
    "daprAIConnectionString": "InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://chinanorth3-0.in.applicationinsights.azure.com/",
    "appLogsConfiguration": {
      "logAnalyticsConfiguration": {
        "customerId": "string",
        "sharedKey": "string"
      }
    },
    "zoneRedundant": true,
    "vnetConfiguration": {
      "infrastructureSubnetId": "/subscriptions/<subscription_id>/resourceGroups/RGName/providers/Microsoft.Network/virtualNetworks/VNetName/subnets/subnetName1"
    },
    "customDomainConfiguration": {
      "dnsSuffix": "www.my-name.com",
      "certificateValue": "Y2VydA==",
      "certificatePassword": "1234"
    },
    "workloadProfiles": [
      {
        "name": "My-GP-01",
        "workloadProfileType": "GeneralPurpose",
        "minimumCount": 3,
        "maximumCount": 12
      },
      {
        "name": "My-MO-01",
        "workloadProfileType": "MemoryOptimized",
        "minimumCount": 3,
        "maximumCount": 6
      },
      {
        "name": "My-CO-01",
        "workloadProfileType": "ComputeOptimized",
        "minimumCount": 3,
        "maximumCount": 6
      },
      {
        "name": "My-consumption-01",
        "workloadProfileType": "Consumption"
      }
    ],
    "infrastructureResourceGroup": "myInfrastructureRgName"
  }
}

容器应用

下表描述了容器应用资源中的常用属性。有关属性的完整列表，请参阅 Azure 容器应用 REST API 参考。

资源

容器应用资源的 properties 对象包含以下属性：

properties	说明	数据类型	只读
`provisioningState`	长时间运行的操作的状态，例如创建新的容器修订时。可能的值包括：正在预配、已预配、失败。检查应用是否启动并正在运行。	字符串	是
`environmentId`	容器应用的环境 ID。这是创建容器应用所需的属性。如果使用 YAML，则可以使用 Azure CLI 中的 `--environment` 选项指定环境 ID。	string	否
`latestRevisionName`	最新修订的名称。	字符串	是
`latestRevisionFqdn`	最新修订的 URL。	字符串	是

environmentId 值采用以下形式：

/subscriptions/<SUBSCRIPTION_ID>/resourcegroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.App/environmentId/<ENVIRONMENT_NAME>

在本示例中，输入你的值，代替由 <> 括号括起来的占位符标记。

`properties.configuration`

资源的 properties.configuration 对象包含以下属性：

properties	说明	数据类型
`activeRevisionsMode`	设置为 `single` 可自动停用旧的修订，并仅使最新修订保持活动状态。设置为 `multiple` 可让你维护多个修订。	字符串
`secrets`	在容器应用中定义机密值。	object
`ingress`	定义容器应用的公共可访问性配置的对象。	object
`registries`	引用专用容器注册表凭据的配置对象。使用 `secretref` 定义的条目引用机密配置对象。	object
`dapr`	定义容器应用的 Dapr 设置的配置对象。	object

对 configuration 部分所做的更改是应用程序范围的更改，这不会触发新的修订。

`properties.template`

资源的 properties.template 对象包含以下属性：

properties	说明	数据类型
`revisionSuffix`	修订的易记名称。此值必须是唯一的，因为运行时拒绝与现有修订名称后缀值的任何冲突。	字符串
`containers`	定义容器应用中包含的容器映像的配置对象。	object
`scale`	定义容器应用的缩放规则的配置对象。	object

对 template 部分所做的更改是修订范围的更改，这会触发新的修订。

示例

有关运行状况探测的详细信息，请参阅 Azure 容器应用中的运行状况探测。

ARM 模板
YAML

以下示例 ARM 模板片段部署容器应用。

{
  "identity": {
    "userAssignedIdentities": {
      "/subscriptions/<subscription_id>/resourcegroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-user": {
      }
    },
    "type": "UserAssigned"
  },
  "properties": {
    "environmentId": "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube",
    "workloadProfileName": "My-GP-01",
    "configuration": {
      "ingress": {
        "external": true,
        "targetPort": 3000,
        "customDomains": [
          {
            "name": "www.my-name.com",
            "bindingType": "SniEnabled",
            "certificateId": "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube/certificates/my-certificate-for-my-name-dot-com"
          },
          {
            "name": "www.my-other-name.com",
            "bindingType": "SniEnabled",
            "certificateId": "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube/certificates/my-certificate-for-my-other-name-dot-com"
          }
        ],
        "traffic": [
          {
            "weight": 100,
            "revisionName": "testcontainerApp0-ab1234",
            "label": "production"
          }
        ],
        "ipSecurityRestrictions": [
          {
            "name": "Allow work IP A subnet",
            "description": "Allowing all IP's within the subnet below to access containerapp",
            "ipAddressRange": "192.168.1.1/32",
            "action": "Allow"
          },
          {
            "name": "Allow work IP B subnet",
            "description": "Allowing all IP's within the subnet below to access containerapp",
            "ipAddressRange": "192.168.1.1/8",
            "action": "Allow"
          }
        ],
        "stickySessions": {
          "affinity": "sticky"
        },
        "clientCertificateMode": "accept",
        "corsPolicy": {
          "allowedOrigins": [
            "https://a.test.com",
            "https://b.test.com"
          ],
          "allowedMethods": [
            "GET",
            "POST"
          ],
          "allowedHeaders": [
            "HEADER1",
            "HEADER2"
          ],
          "exposeHeaders": [
            "HEADER3",
            "HEADER4"
          ],
          "maxAge": 1234,
          "allowCredentials": true
        }
      },
      "dapr": {
        "enabled": true,
        "appPort": 3000,
        "appProtocol": "http",
        "httpReadBufferSize": 30,
        "httpMaxRequestSize": 10,
        "logLevel": "debug",
        "enableApiLogging": true
      },
      "maxInactiveRevisions": 10,
      "service": {
        "type": "redis"
      }
    },
    "template": {
      "containers": [
        {
          "image": "repo/testcontainerApp0:v1",
          "name": "testcontainerApp0",
          "probes": [
            {
              "type": "Liveness",
              "httpGet": {
                "path": "/health",
                "port": 8080,
                "httpHeaders": [
                  {
                    "name": "Custom-Header",
                    "value": "Awesome"
                  }
                ]
              },
              "initialDelaySeconds": 3,
              "periodSeconds": 3
            }
          ],
          "volumeMounts": [
            {
              "mountPath": "/myempty",
              "volumeName": "myempty"
            },
            {
              "mountPath": "/myfiles",
              "volumeName": "azure-files-volume"
            },
            {
              "mountPath": "/mysecrets",
              "volumeName": "mysecrets"
            }
              ]
        }
      ],
      "initContainers": [
        {
          "image": "repo/testcontainerApp0:v4",
          "name": "testinitcontainerApp0",
          "resources": {
            "cpu": 0.2,
            "memory": "100Mi"
          },
          "command": [
            "/bin/sh"
          ],
          "args": [
            "-c",
            "while true; do echo hello; sleep 10;done"
          ]
        }
      ],
      "scale": {
        "minReplicas": 1,
        "maxReplicas": 5,
        "rules": [
          {
            "name": "httpscalingrule",
            "custom": {
              "type": "http",
              "metadata": {
                "concurrentRequests": "50"
              }
            }
          }
        ]
      },
      "volumes": [
        {
          "name": "myempty",
          "storageType": "EmptyDir"
        },
        {
          "name": "azure-files-volume",
          "storageType": "AzureFile",
          "storageName": "myazurefiles"
        },
        {
          "name": "mysecrets",
          "storageType": "Secret",
          "secrets": [
            {
              "secretRef": "mysecret",
              "path": "mysecret.txt"
            }
          ]
        }
      ],
      "serviceBinds": [
        {
          "serviceId": "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/containerApps/redisService",
          "name": "redisService"
        }
      ]
    }
  }
}

以下示例 YAML 配置在与以下 Azure CLI 命令中的 --yaml 参数一起使用时将部署容器应用：

identity:
  userAssignedIdentities:
    "/subscriptions/<subscription_id>/resourcegroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-user": {}
  type: UserAssigned
properties:
  environmentId: "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube"
  workloadProfileName: My-GP-01
  configuration:
    ingress:
      external: true
      targetPort: 3000
      customDomains:
      - name: www.my-name.com
        bindingType: SniEnabled
        certificateId: "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube/certificates/my-certificate-for-my-name-dot-com"
      - name: www.my-other-name.com
        bindingType: SniEnabled
        certificateId: "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube/certificates/my-certificate-for-my-other-name-dot-com"
      traffic:
      - weight: 100
        revisionName: testcontainerApp0-ab1234
        label: production
      ipSecurityRestrictions:
      - name: Allow work IP A subnet
        description: Allowing all IP's within the subnet below to access containerapp
        ipAddressRange: 192.168.1.1/32
        action: Allow
      - name: Allow work IP B subnet
        description: Allowing all IP's within the subnet below to access containerapp
        ipAddressRange: 192.168.1.1/8
        action: Allow
      stickySessions:
        affinity: sticky
      clientCertificateMode: accept
      corsPolicy:
        allowedOrigins:
        - https://a.test.com
        - https://b.test.com
        allowedMethods:
        - GET
        - POST
        allowedHeaders:
        - HEADER1
        - HEADER2
        exposeHeaders:
        - HEADER3
        - HEADER4
        maxAge: 1234
        allowCredentials: true
    dapr:
      enabled: true
      appPort: 3000
      appProtocol: http
      httpReadBufferSize: 30
      httpMaxRequestSize: 10
      logLevel: debug
      enableApiLogging: true
    maxInactiveRevisions: 10
    service:
      type: redis
  template:
    containers:
    - image: repo/testcontainerApp0:v1
      name: testcontainerApp0
      probes:
      - type: Liveness
        httpGet:
          path: "/health"
          port: 8080
          httpHeaders:
          - name: Custom-Header
            value: Awesome
        initialDelaySeconds: 3
        periodSeconds: 3
      volumeMounts:
      - mountPath: "/myempty"
        volumeName: myempty
      - mountPath: "/myfiles"
        volumeName: azure-files-volume
      - mountPath: "/mysecrets"
        volumeName: mysecrets
    initContainers:
    - image: repo/testcontainerApp0:v4
      name: testinitcontainerApp0
      resources:
        cpu: 0.2
        memory: 100Mi
      command:
      - "/bin/sh"
      args:
      - "-c"
      - while true; do echo hello; sleep 10;done
    scale:
      minReplicas: 1
      maxReplicas: 5
      rules:
      - name: httpscalingrule
        custom:
          type: http
          metadata:
            concurrentRequests: '50'
    volumes:
    - name: myempty
      storageType: EmptyDir
    - name: azure-files-volume
      storageType: AzureFile
      storageName: myazurefiles
    - name: mysecrets
      storageType: Secret
      secrets:
      - secretRef: mysecret
        path: mysecret.txt
    serviceBinds:
    - serviceId: "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/containerApps/redisService"
      name: redisService

Azure 容器应用作业

下表描述了 Azure 容器应用作业资源中的常用属性。有关属性的完整列表，请参阅 Azure 容器应用 REST API 参考。

资源

Azure 容器应用作业资源的 properties 对象包含以下属性：

properties	说明	数据类型	只读
`environmentId`	Azure 容器应用作业的环境 ID。创建 Azure 容器应用作业需要此属性。如果使用 YAML，则可以使用 Azure CLI 中的 `--environment` 选项指定环境 ID。	string	否

environmentId 值采用以下形式：

/subscriptions/<SUBSCRIPTION_ID>/resourcegroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.App/environmentId/<ENVIRONMENT_NAME>

在本示例中，输入你的值，代替由 <> 括号括起来的占位符标记。

`properties.configuration`

资源的 properties.configuration 对象包含以下属性：

properties	说明	数据类型
`triggerType`	Azure 容器应用作业的触发器类型。有关每种触发器类型的具体配置，请参阅作业触发器类型	string
`replicaTimeout`	Azure 容器应用作业的超时（以秒为单位）。	integer
`replicaRetryLimit`	重试 Azure 容器应用作业的次数。	integer

`properties.template`

资源的 properties.template 对象包含以下属性：

properties	说明	Data type
`containers`	配置对象，定义作业中包含哪些容器映像。	object
`scale`	定义作业规模规则的配置对象。	object

以下示例 ARM 模板片段部署 Azure 容器应用作业。

{
  "identity": {
    "userAssignedIdentities": {
      "/subscriptions/<subscription_id>/resourcegroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-user": {
      }
    },
    "type": "UserAssigned"
  },
  "properties": {
    "environmentId": "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube",
    "configuration": {
      "replicaTimeout": 10,
      "replicaRetryLimit": 10,
      "manualTriggerConfig": {
        "replicaCompletionCount": 1,
        "parallelism": 4
      },
      "triggerType": "Manual"
    },
    "template": {
      "containers": [
        {
          "image": "repo/testcontainerAppsJob0:v1",
          "name": "testcontainerAppsJob0",
          "probes": [
            {
              "type": "Liveness",
              "httpGet": {
                "path": "/health",
                "port": 8080,
                "httpHeaders": [
                  {
                    "name": "Custom-Header",
                    "value": "Awesome"
                  }
                ]
              },
              "initialDelaySeconds": 5,
              "periodSeconds": 3
            }
          ],
          "volumeMounts": [
            {
              "mountPath": "/myempty",
              "volumeName": "myempty"
            },
            {
              "mountPath": "/myfiles",
              "volumeName": "azure-files-volume"
            },
            {
              "mountPath": "/mysecrets",
              "volumeName": "mysecrets"
            }
          ]
        }
      ],
      "initContainers": [
        {
          "image": "repo/testcontainerAppsJob0:v4",
          "name": "testinitcontainerAppsJob0",
          "resources": {
            "cpu": 0.2,
            "memory": "100Mi"
          },
          "command": [
            "/bin/sh"
          ],
          "args": [
            "-c",
            "while true; do echo hello; sleep 10;done"
          ]
        }
      ],
      "volumes": [
        {
          "name": "myempty",
          "storageType": "EmptyDir"
        },
        {
          "name": "azure-files-volume",
          "storageType": "AzureFile",
          "storageName": "myazurefiles"
        },
        {
          "name": "mysecrets",
          "storageType": "Secret",
          "secrets": [
            {
              "secretRef": "mysecret",
              "path": "mysecret.txt"
            }
          ]
        }
      ]
    }
  }
}

以下示例 YAML 配置在与以下 Azure CLI 命令中的 --yaml 参数一起使用时部署容器应用作业：

identity:
  userAssignedIdentities:
    "/subscriptions/<subscription_id>/resourcegroups/my-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-user": {}
  type: UserAssigned
properties:
  environmentId: "/subscriptions/<subscription_id>/resourceGroups/rg/providers/Microsoft.App/managedEnvironments/demokube"
  configuration:
    replicaTimeout: 10
    replicaRetryLimit: 10
    manualTriggerConfig:
      replicaCompletionCount: 1
      parallelism: 4
    triggerType: Manual
  template:
    containers:
    - image: repo/testcontainerAppsJob0:v1
      name: testcontainerAppsJob0
      probes:
      - type: Liveness
        httpGet:
          path: "/health"
          port: 8080
          httpHeaders:
          - name: Custom-Header
            value: Awesome
        initialDelaySeconds: 5
        periodSeconds: 3
      volumeMounts:
      - mountPath: "/myempty"
        volumeName: myempty
      - mountPath: "/myfiles"
        volumeName: azure-files-volume
      - mountPath: "/mysecrets"
        volumeName: mysecrets
    initContainers:
    - image: repo/testcontainerAppsJob0:v4
      name: testinitcontainerAppsJob0
      resources:
        cpu: 0.2
        memory: 100Mi
      command:
      - "/bin/sh"
      args:
      - "-c"
      - while true; do echo hello; sleep 10;done
    volumes:
    - name: myempty
      storageType: EmptyDir
    - name: azure-files-volume
      storageType: AzureFile
      storageName: myazurefiles
    - name: mysecrets
      storageType: Secret
      secrets:
      - secretRef: mysecret
        path: mysecret.txt

通过

Azure 容器应用 ARM 和 YAML 模板规范

API 版本

更新 API 版本

容器应用环境

资源

示例

容器应用

资源

properties.configuration

properties.template

示例

Azure 容器应用作业

资源

properties.configuration

properties.template

示例

其他资源

`properties.configuration`

`properties.template`

`properties.configuration`

`properties.template`