[ContainerApp] Fix #501: az containerapp create --allow-insecure: Add Flag to Allow Container App Insecure Ingress

src/containerapp/HISTORY.rst

@@ -8,6 +8,7 @@ Upcoming
 * 'az containerapp job start': update start execution payload format to exlude template property from API version 2023-05-01 onwards
 * 'az containerapp service': add support for creation and deletion of MariaDB
 * 'az containerapp create/list': support --environment-type parameter
+* 'az containerapp create': add support for insecure ingress with flag --allow-insecure
 
 0.3.36
 ++++++

src/containerapp/azext_containerapp/_models.py

@@ -169,6 +169,7 @@
     "targetPort": None,
     "transport": None,  # 'auto', 'http', 'http2', 'tcp'
     "exposedPort": None,
+    "allowInsecure": False,
     "traffic": None,  # TrafficWeight
     "customDomains": None,  # [CustomDomain]
     "ipSecurityRestrictions": None,  # [IPSecurityRestrictions]

src/containerapp/azext_containerapp/_params.py

@@ -12,7 +12,8 @@
 
 from ._validators import (validate_memory, validate_cpu, validate_managed_env_name_or_id, validate_registry_server,
                           validate_registry_user, validate_registry_pass, validate_target_port, validate_ingress,
-                          validate_storage_name_or_id, validate_cors_max_age, validate_env_name_or_id)
+                          validate_storage_name_or_id, validate_cors_max_age, validate_env_name_or_id,
+                          validate_allow_insecure)
 from ._constants import UNAUTHENTICATED_CLIENT_ACTION, FORWARD_PROXY_CONVENTION, MAXIMUM_CONTAINER_APP_NAME_LENGTH, LOG_TYPE_CONSOLE, LOG_TYPE_SYSTEM
 
 
@@ -115,6 +116,7 @@ def load_arguments(self, _):
         c.argument('target_port', type=int, validator=validate_target_port, help="The application port used for ingress traffic.")
         c.argument('transport', arg_type=get_enum_type(['auto', 'http', 'http2', 'tcp']), help="The transport protocol used for ingress traffic.")
         c.argument('exposed_port', type=int, help="Additional exposed port. Only supported by tcp transport protocol. Must be unique per environment if the app ingress is external.")
+        c.argument('allow_insecure', validator=validate_allow_insecure, arg_type=get_three_state_flag(), help='Allow insecure connections for ingress traffic.')
 
     with self.argument_context('containerapp create') as c:
         c.argument('traffic_weights', nargs='*', options_list=['--traffic-weight'], help="A list of revision weight(s) for the container app. Space-separated values in 'revision_name=weight' format. For latest revision, use 'latest=weight'")

src/containerapp/azext_containerapp/_validators.py

@@ -139,6 +139,15 @@ def validate_ingress(namespace):
                 raise ValidationError("Usage error: must specify --target-port with --ingress")
 
 
+def validate_allow_insecure(namespace):
+    if "create" in namespace.command.lower():
+        if namespace.allow_insecure:
+            if not namespace.ingress or not namespace.target_port:
+                raise ValidationError("Usage error: must specify --ingress and --target-port with --allow-insecure")
+            if namespace.transport == "tcp":
+                raise ValidationError("Usage error: --allow-insecure is not supported for TCP ingress")
+
+
 def _set_ssh_defaults(cmd, namespace):
     app = ContainerAppClient.show(cmd, namespace.resource_group_name, namespace.name)
     if not app:

src/containerapp/azext_containerapp/containerapp_decorator.py

@@ -223,6 +223,9 @@ def get_argument_transport(self):
     def get_argument_ingress(self):
         return self.get_param("ingress")
 
+    def get_argument_allow_insecure(self):
+        return self.get_param("allow_insecure")
+
     def get_argument_revisions_mode(self):
         return self.get_param("revisions_mode")
 
@@ -392,6 +395,7 @@ def construct_containerapp(self):
             ingress_def["targetPort"] = self.get_argument_target_port()
             ingress_def["transport"] = self.get_argument_transport()
             ingress_def["exposedPort"] = self.get_argument_exposed_port() if self.get_argument_transport() == "tcp" else None
+            ingress_def["allowInsecure"] = self.get_argument_allow_insecure()
 
         secrets_def = None
         if self.get_argument_secrets() is not None:

src/containerapp/azext_containerapp/custom.py

@@ -445,6 +445,7 @@ def create_containerapp(cmd,
                         exposed_port=None,
                         transport="auto",
                         ingress=None,
+                        allow_insecure=False,
                         revisions_mode="single",
                         secrets=None,
                         env_vars=None,

src/containerapp/azext_containerapp/tests/latest/test_containerapp_commands.py

@@ -160,11 +160,12 @@ def test_containerapp_ingress_e2e(self, resource_group):
 
         create_containerapp_env(self, env_name, resource_group)
 
-        self.cmd('containerapp create -g {} -n {} --environment {} --ingress external --target-port 80'.format(resource_group, ca_name, env_name))
+        self.cmd('containerapp create -g {} -n {} --environment {} --ingress external --target-port 80 --allow-insecure'.format(resource_group, ca_name, env_name))
 
         self.cmd('containerapp ingress show -g {} -n {}'.format(resource_group, ca_name, env_name), checks=[
             JMESPathCheck('external', True),
             JMESPathCheck('targetPort', 80),
+            JMESPathCheck('allowInsecure', True),
         ])
 
         self.cmd('containerapp ingress disable -g {} -n {}'.format(resource_group, ca_name, env_name))