azurerm_container_app: add support for ip_security_restriction in…

… data source (#24518)

* azurerm_container_app: add support for ip_security_restriction

* fix golint

* address comments on docs

internal/services/containerapps/container_app_data_source_test.go

@@ -24,6 +24,18 @@ func TestAccContainerAppDataSource_basic(t *testing.T) {
 	})
 }
 
+func TestAccContainerAppDataSource_complete(t *testing.T) {
+	data := acceptance.BuildTestData(t, "data.azurerm_container_app", "test")
+	r := ContainerAppDataSource{}
+
+	data.DataSourceTest(t, []acceptance.TestStep{
+		{
+			Config: r.complete(data, "rev1"),
+			Check:  acceptance.ComposeTestCheckFunc(),
+		},
+	})
+}
+
 func (d ContainerAppDataSource) basic(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 %s
@@ -34,3 +46,14 @@ data "azurerm_container_app" "test" {
 }
 `, ContainerAppResource{}.basic(data))
 }
+
+func (d ContainerAppDataSource) complete(data acceptance.TestData, revisionSuffix string) string {
+	return fmt.Sprintf(`
+%s
+
+data "azurerm_container_app" "test" {
+  name                = azurerm_container_app.test.name
+  resource_group_name = azurerm_container_app.test.resource_group_name
+}
+`, ContainerAppResource{}.complete(data, revisionSuffix))
+}

internal/services/containerapps/helpers/container_apps.go

@@ -243,6 +243,8 @@ func ContainerAppIngressSchemaComputed() *pluginsdk.Schema {
 					Description: "The FQDN of the ingress.",
 				},
 
+				"ip_security_restriction": ContainerAppIngressIpSecurityRestrictionComputed(),
+
 				"target_port": {
 					Type:        pluginsdk.TypeInt,
 					Computed:    true,
@@ -493,6 +495,40 @@ func ContainerAppIngressIpSecurityRestriction() *pluginsdk.Schema {
 	}
 }
 
+func ContainerAppIngressIpSecurityRestrictionComputed() *pluginsdk.Schema {
+	return &pluginsdk.Schema{
+		Type:     pluginsdk.TypeList,
+		Computed: true,
+		Elem: &pluginsdk.Resource{
+			Schema: map[string]*pluginsdk.Schema{
+				"action": {
+					Type:        pluginsdk.TypeString,
+					Computed:    true,
+					Description: "The action. Allow or Deny.",
+				},
+
+				"description": {
+					Type:        pluginsdk.TypeString,
+					Computed:    true,
+					Description: "Describe the IP restriction rule that is being sent to the container-app.",
+				},
+
+				"ip_address_range": {
+					Type:        pluginsdk.TypeString,
+					Computed:    true,
+					Description: "CIDR notation to match incoming IP address.",
+				},
+
+				"name": {
+					Type:        pluginsdk.TypeString,
+					Computed:    true,
+					Description: "Name for the IP restriction rule.",
+				},
+			},
+		},
+	}
+}
+
 func ContainerAppIngressTrafficWeight() *pluginsdk.Schema {
 	return &pluginsdk.Schema{
 		Type:     pluginsdk.TypeList,

website/docs/d/container_app.html.markdown

@@ -265,6 +265,8 @@ An `ingress` block supports the following:
 
 * `external_enabled` - Is this an external Ingress.
 
+* `ip_security_restriction` - One or more `ip_security_restriction` blocks for IP-filtering rules as defined below.
+
 * `target_port` - The target port on the container for the Ingress traffic.
 
 * `traffic_weight` - A `traffic_weight` block as detailed below.
@@ -283,6 +285,18 @@ A `custom_domain` block supports the following:
 
 ---
 
+A `ip_security_restriction` block exports the following:
+
+* `action` - The IP-filter action.
+
+* `description` - Description of the IP restriction rule that is being sent to the container-app.
+
+* `ip_address_range` - CIDR notation that matches the incoming IP address.
+
+* `name` - Name for the IP restriction rule.
+
+---
+
 A `traffic_weight` block supports the following:
 
 * `label` - The label to apply to the revision as a name prefix for routing traffic.