New Resource: `azurerm_container_app_environment_managed_certificate` by jiaweitao001 · Pull Request #31137 · hashicorp/terraform-provider-azurerm

jiaweitao001 · 2025-11-19T05:49:58Z

Community Note

Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR add support for the azurerm_container_app_environment_managed_certificate resource. This PR replaces #28366 since it has been inactivate for a while.

PR Checklist

I have followed the guidelines in our Contributing Documentation.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
I have written new tests for my resource or datasource changes & updated any relevant documentation.
I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
(For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

--- PASS: TestAccContainerAppEnvironmentManagedCertificate_basic (973.35s)
--- PASS: TestAccContainerAppEnvironmentManagedCertificate_domainControlValidationHTTP (971.67s)
--- PASS: TestAccContainerAppEnvironmentManagedCertificate_update (1021.90s)
--- PASS: TestAccContainerAppEnvironmentManagedCertificate_requiresImport (902.01s)
PASS

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

New Resource: azurerm_container_app_environment_managed_certificate

This is a (please select all that apply):

Bug Fix
New Feature (ie adding a service, resource, or data source)
Enhancement
Breaking Change

Related Issue(s)

Fixes #27362

AI Assistance Disclosure

AI Assisted - This contribution was made by, or with the assistance of, AI/LLMs

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

sreallymatt

Thanks @jiaweitao001 - I've left some comments inline

- Use consistent error message format with retrieving/updating - Add nil check for env.Model before accessing nested fields - Use pointer.FromEnum for DomainControlValidation - Add CNAME and TXT domain control validation tests - Shorten DNS record name to avoid exceeding 64 char limit - Add custom domain with depends_on to docs example Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sreallymatt · 2026-04-08T16:50:57Z

Hi @jiaweitao001 - it looks like TestAccContainerAppEnvironmentManagedCertificate_domainControlValidationTXT is having some issues, could you investigate?

TXT domain control validation requires longer polling time due to DNS propagation and CA signing chain being slower than HTTP/CNAME methods. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The CNAME record was pointing to latest_revision_fqdn instead of the container app's ingress FQDN. Azure requires the CNAME to map directly to the app's generated domain name (ingress fqdn) for domain validation to succeed. This was causing TXT validation to stay in Pending state indefinitely, resulting in context deadline exceeded. Also reverts the temporary timeout increase from the previous commit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

TXT validation is accepted by the API but does not appear to be functional on the Azure service side - certificates remain in Pending state indefinitely. Remove the TXT test case and update documentation to only advertise CNAME and HTTP as supported validation methods. The validation code still accepts TXT to match the API definition. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jiaweitao001 · 2026-04-10T05:37:01Z

Hi @jiaweitao001 - it looks like TestAccContainerAppEnvironmentManagedCertificate_domainControlValidationTXT is having some issues, could you investigate?

Hi @sreallymatt, I removed the TXT validation test case and updated the documentation to only advertise CNAME and HTTP as supported validation methods. TXT exists as an enum value in the API definition, but the service side does not appear to support it currently.

sreallymatt · 2026-04-13T14:17:34Z

+			ForceNew: true,
+			Default:  string(managedenvironments.ManagedCertificateDomainControlValidationHTTP),
+			ValidateFunc: validation.StringInSlice(
+				managedenvironments.PossibleValuesForManagedCertificateDomainControlValidation(),


Given TXT does not currently appear to function, we should omit it from this ValidateFunc as well. If/when support is added, we can revisit and add it back to the resource.

Sure. Removed.

Per review feedback, remove TXT from the allowed validation values since it does not currently function on the Azure service side. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sreallymatt

Thanks @jiaweitao001 - LGTM ✅

jiaweitao001 added 2 commits November 19, 2025 13:25

New resource: azurerm_container_app_environment_managed_certificate

fe3269d

Fixing indent

c10a6f9

jiaweitao001 requested review from a team, WodansSon and magodo as code owners November 19, 2025 05:49

github-actions Bot added ai-assisted documentation service/container-apps size/XL labels Nov 19, 2025

jiaweitao001 mentioned this pull request Nov 19, 2025

New Resource and Data Source: container_app_environment_managed_certificate #28366

Closed

13 tasks

rcskosir added the new-resource label Mar 25, 2026

sreallymatt requested changes Apr 6, 2026

View reviewed changes

github-actions Bot assigned sreallymatt Apr 6, 2026

github-actions Bot added the waiting-response label Apr 6, 2026

github-actions Bot removed the waiting-response label Apr 7, 2026

github-actions Bot added the waiting-response label Apr 9, 2026

Increase create timeout for managed certificate to 60 minutes

630b677

TXT domain control validation requires longer polling time due to DNS propagation and CA signing chain being slower than HTTP/CNAME methods. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jiaweitao001 force-pushed the container_app_env_managed_cert branch from edefc78 to 630b677 Compare April 9, 2026 02:12

github-actions Bot added waiting-response and removed waiting-response labels Apr 9, 2026

jiaweitao001 force-pushed the container_app_env_managed_cert branch from e358342 to 74be517 Compare April 10, 2026 02:31

github-actions Bot removed the waiting-response label Apr 10, 2026

sreallymatt requested changes Apr 13, 2026

View reviewed changes

github-actions Bot added the waiting-response label Apr 13, 2026

Omit TXT from domain control validation ValidateFunc

08d04ca

Per review feedback, remove TXT from the allowed validation values since it does not currently function on the Azure service side. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions Bot removed the waiting-response label Apr 14, 2026

sreallymatt approved these changes Apr 14, 2026

View reviewed changes

sreallymatt merged commit f894a39 into hashicorp:main Apr 14, 2026
31 checks passed

github-actions Bot added this to the v4.69.0 milestone Apr 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Resource: `azurerm_container_app_environment_managed_certificate`#31137

New Resource: `azurerm_container_app_environment_managed_certificate`#31137
sreallymatt merged 7 commits intohashicorp:mainfrom
jiaweitao001:container_app_env_managed_cert

jiaweitao001 commented Nov 19, 2025

Uh oh!

sreallymatt left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sreallymatt commented Apr 8, 2026

Uh oh!

jiaweitao001 commented Apr 10, 2026

Uh oh!

sreallymatt Apr 13, 2026

Uh oh!

jiaweitao001 Apr 14, 2026

Uh oh!

sreallymatt left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jiaweitao001 commented Nov 19, 2025

Community Note

Description

PR Checklist

Changes to existing Resource / Data Source

Testing

Change Log

Related Issue(s)

AI Assistance Disclosure

Rollback Plan

Changes to Security Controls

Uh oh!

sreallymatt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sreallymatt commented Apr 8, 2026

Uh oh!

jiaweitao001 commented Apr 10, 2026

Uh oh!

sreallymatt Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

jiaweitao001 Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

sreallymatt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants