Terraform部署Azure Container App Job：Secret与连接字符串配置错误排查

问题说明 #

使用Terraform部署Azure Container App Job时，需要将Service Bus连接字符串注入容器应用，但因env块位置错误导致配置失败，同时存在资源索引引用错误。

错误代码 #

data "azurerm_servicebus_namespace" "iccm_servicebus" {
  for_each = var.iccm_primary_regions
  name                = "iccm-${var.environment}-service-bus-${each.key}"
  resource_group_name = "iccm_${var.environment}_shared_rg"
}
resource "azurerm_container_app_job" "caj-relay" {
  for_each = var.iccm_primary_regions
  name                         = "caj-relay-${var.environment}-${each.key}"
  location                     = each.key
  resource_group_name          = azurerm_resource_group.relay[each.key].name
  container_app_environment_id = azurerm_container_app_environment.relay-container-app-environment[each.key].id
  secret {
    name = "servicebus-connection-string"
    value = data.azurerm_servicebus_namespace.iccm_servicebus[each.value].default_primary_connection_string
  }
 
replica_timeout_in_seconds = 10
replica_retry_limit = 10
schedule_trigger_config {
  cron_expression = "* * * * *"
  parallelism = 4
  replica_completion_count = 1
}
 
template {
  container {
    image = "${var.container_registry_configuration.server}/outbox-message-relay-service:latest"
    name = "outbox-message-relay-service"
    readiness_probe {
      transport = "HTTP"
      port = 5000
    }
    liveness_probe {
      transport = "HTTP"
      port = 5000
      path = "/health"
      initial_delay = 5
      interval_seconds = 20
      timeout = 2
      failure_count_threshold = 1
    }
    startup_probe {
      transport = "TCP"
      port = 5000
    }
    cpu = 0.5
    memory = "1Gi"
  }
}
    env {
      name = "AzureServiceBus__ConnectionString"
      secret_name = "servicebus-connection-string"
     
    }
    env {
      name = "ApplicationInsights__ConnectionString"
      secret_name = "application-insights-connection-string"
     
    }
    env {
      name = "ConnectionStrings__CustDbConnection"
      secret_name = "customer-database-connection-string"
 
    }
 
lifecycle {
  ignore_changes = [
    template[0].container[0].name,
    template[0].container[0].image,
    template[0].container[0].env
   ]
}

错误信息 #

error:Block of type "****" are not expected here. Did you mean "***s"?

解决方案 #

关键修正点 #

1. env块必须移入template.container内部：Azure Container App Job的环境变量属于容器定义的一部分，不能放在template或资源根层级。
2. 修正Service Bus资源索引：data.azurerm_servicebus_namespace.iccm_servicebus使用for_each = var.iccm_primary_regions，索引需用each.key而非each.value（此处var.iccm_primary_regions以区域名为key）。
3. 保持lifecycle路径正确：修正后env在container内部，原lifecycle中的路径无需修改，可正常匹配。

修正后的完整代码 #

data "azurerm_servicebus_namespace" "iccm_servicebus" {
  for_each = var.iccm_primary_regions
  name                = "iccm-${var.environment}-service-bus-${each.key}"
  resource_group_name = "iccm_${var.environment}_shared_rg"
}

resource "azurerm_container_app_job" "caj-relay" {
  for_each = var.iccm_primary_regions
  name                         = "caj-relay-${var.environment}-${each.key}"
  location                     = each.key
  resource_group_name          = azurerm_resource_group.relay[each.key].name
  container_app_environment_id = azurerm_container_app_environment.relay-container-app-environment[each.key].id

  secret {
    name  = "servicebus-connection-string"
    value = data.azurerm_servicebus_namespace.iccm_servicebus[each.key].default_primary_connection_string
  }

  replica_timeout_in_seconds = 10
  replica_retry_limit        = 10

  schedule_trigger_config {
    cron_expression          = "* * * * *"
    parallelism              = 4
    replica_completion_count = 1
  }

  template {
    container {
      image = "${var.container_registry_configuration.server}/outbox-message-relay-service:latest"
      name  = "outbox-message-relay-service"

      readiness_probe {
        transport = "HTTP"
        port      = 5000
      }

      liveness_probe {
        transport               = "HTTP"
        port                    = 5000
        path                    = "/health"
        initial_delay           = 5
        interval_seconds        = 20
        timeout                 = 2
        failure_count_threshold = 1
      }

      startup_probe {
        transport = "TCP"
        port      = 5000
      }

      cpu    = 0.5
      memory = "1Gi"

      # 环境变量块移入container内部
      env {
        name        = "AzureServiceBus__ConnectionString"
        secret_name = "servicebus-connection-string"
      }

      env {
        name        = "ApplicationInsights__ConnectionString"
        secret_name = "application-insights-connection-string"
      }

      env {
        name        = "ConnectionStrings__CustDbConnection"
        secret_name = "customer-database-connection-string"
      }
    }
  }

  lifecycle {
    ignore_changes = [
      template[0].container[0].name,
      template[0].container[0].image,
      template[0].container[0].env
    ]
  }
}

验证要点 #

• 执行terraform plan检查是否仍有块位置错误
• 确认Service Bus连接字符串对应的secret已正确关联到环境变量
• 部署完成后，通过Azure门户查看容器应用的环境变量是否成功注入

内容的提问来源于stack exchange，提问作者Nevin