通过Terraform修改Azure Linux Web App容器存储挂载路径

使用Azure Linux Web App通过Terraform托管Keycloak Docker容器，需导入自定义主题。当前已将Blob存储挂载到容器的/keycloak/custom-themes路径，但Keycloak默认读取主题的路径是/opt/keycloak/themes，需要将挂载路径调整到该位置。

直接修改Terraform配置中azurerm_linux_web_app资源内storage_account块的mount_path参数值即可，同时需确保Blob存储中的主题目录结构符合Keycloak要求——即主题文件夹直接放在Blob容器根目录，对应挂载后的/opt/keycloak/themes下的子目录（比如login、admin等主题目录）。

仅需调整存储挂载部分的mount_path值，完整配置如下：

resource "azurerm_linux_web_app" "keycloak_web_app" {
  name                = local.app_service_name
  location            = local.default_region
  resource_group_name = data.azurerm_resource_group.resource_group.name
  service_plan_id     = azurerm_service_plan.access_service_plan.id
  https_only          = true

  app_settings = {
    DOCKER_REGISTRY_SERVER_URL = "https://${local.keycloak_registry_server}"
    PROXY_ADDRESS_FORWARDING   = true
    KC_HOSTNAME                = var.keycloak_hostname
    KC_HTTP_ENABLED            = true
    KC_METRICS_ENABLED         = true
    KC_DB_URL_HOST             = azurerm_postgresql_flexible_server.keycloak_postgresql_server.fqdn
    KC_DB_URL_PORT             = 5432
    KC_DB_SCHEMA               = "public"
    KC_DB_USERNAME             = local.postgres_admin_username
    KC_DB_PASSWORD             = local.postgres_admin_password
    KEYCLOAK_ADMIN             = local.keycloak_admin_username
    KEYCLOAK_ADMIN_PASSWORD    = local.keycloak_admin_password
    WEBSITES_PORT              = 8080
    KC_PROXY                   = "edge"
    KC_HOSTNAME_STRICT         = false
  }

  identity {
    type = "SystemAssigned"
  }

  site_config {
    always_on                = true
    http2_enabled            = true
    minimum_tls_version      = 1.2
    app_command_line         = "start --optimized --proxy=edge --hostname-strict-https=false"
    health_check_path        = "/"
    remote_debugging_enabled = false

    application_stack {
      docker_image     = "${local.keycloak_registry_server}/${local.keycloak_image}"
      docker_image_tag = "19.0.3"
    }
  }

  storage_account {
    access_key   = azurerm_storage_account.access_service_storage_account.primary_connection_string
    account_name = local.storage_account_name
    name         = "LinuxThemeMount"
    share_name   = "themes"
    type         = "AzureBlob"
    # 修改挂载路径为Keycloak默认主题目录
    mount_path   = "/opt/keycloak/themes"
  }

  tags = local.resource_tags
}

• 确保Blob容器themes内的目录结构正确：比如自定义主题my-theme应直接放在容器根目录，挂载后容器内路径为/opt/keycloak/themes/my-theme，Keycloak才能识别该主题。
• 若Keycloak容器内原/opt/keycloak/themes目录已有默认主题，挂载Blob存储后会覆盖该目录内容（仅显示Blob中的主题）；如需保留默认主题，可将自定义主题放在Blob子目录，再通过Keycloak启动参数指定额外主题路径，但直接替换默认主题目录在该场景下更简洁。

内容的提问来源于stack exchange，提问作者William Zink