How to replace or update existing Container App deployment revision using CLI?

[alicyn]

I am migrating from Terraform to Bicep using Azure Container Apps. For quick development testing, I have been deploying Bicep files using the Azure CLI. For example:

az deployment group create --resource-group RGdev --template-file main.bicep --parameters @envparameters.json

I cannot seem to find any documentation on the best way to update or replace an existing deployment (or in this case, revision).
According to the docs, if I make a change to an ENV variable in my container template, it should automatically create a new revision and deploy the Bicep template again with my changes. However this is not the case.

If I make a change to some env variable in a container, since there is no 'replace/update/overwrite' command, I issue the same above command again. Then I get this error about revision already existing:

 revision with suffix yb3qgt5wb6 already exists.: template.revisionsuffix

Revision mode is set to "Single" as I don't need multiple revisions. My workaround is to delete the container app completely (either from Azure CLI or the portal), wait for it to delete, and then redeploy again which takes about 10 minutes total each time. Is there an easier way to do this? I have been very stuck on this as in Azure Kubernetes Service there is no such thing as revisions since I always just use Helm charts, it updates the existing deployment with each change.

If I use the Azure portal to "Edit the deployment" for my container, I can make changes, then I'm forced to type in a revision suffix name manually and then deploy that revision. If I then go back and try to use az deployment group create it becomes completely disconnected from the revision that was created in the Azure portal. At this point, I have to delete everything and start over.

Here is an example of my bicep template (this is just a snippet):

resource containerApp 'Microsoft.App/containerApps@2022-06-01-preview' = {
  name: containerAppName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    managedEnvironmentId: containerAppEnvironmentId
    configuration: {
      activeRevisionsMode: 'Single'
      secrets: [
        {
          name: 'registry-password'
          value: registryPassword
        }
      ]
.....
.....
template: {
      revisionSuffix: sanitizedRevisionSuffix
      containers: [
        {
          env: [{
            name: 'SOME_VAR'
            value: 'newtest'
          }
         { 
           name: 'LANG' 
           value: 'en_US.UTF-8'
         }]
          name: containerAppName
          image: 'mycompanyregistry.azurecr.io/web:latest'
          probes: [
            {
              type: 'readiness'
              timeoutSeconds: 3
              failureThreshold: 3
              httpGet: {
                path: '/health'
                port: containerPort
              }
            }
          ]
          resources: {
            cpu: json('.25')
            memory: '.5Gi'
          }
        }
        {
          name: 'nginx'
          image: nginxImage
          resources: {
            cpu: json('.25')
            memory: '.5Gi'
          }
        }
      ]
      scale: {
        minReplicas: 1
        maxReplicas: 2
        rules: [
          {
            name: 'http-requests'
            http: {
              metadata: {
                concurrentRequests: '10'
              }
            }
          }
        ]
      }
    }
  }
}

[brwilkinson]

hi @alicyn

please review the activeRevisionsMode setting.

each time you deploy you will need a new revision.

• https://learn.microsoft.com/en-us/azure/container-apps/revisions-manage?tabs=bash

• https://learn.microsoft.com/en-us/azure/templates/microsoft.app/containerapps?pivots=deployment-language-bicep#configuration

Configuration

Name	Description	Value
activeRevisionsMode	ActiveRevisionsMode controls how active revisions are handled for the Container app:{list}{item}Multiple: multiple revisions can be active.{/item}{item}Single: Only one revision can be active at a time. Revision weights can not be used in this mode. If no value if provided, this is the default.{/item}{/list}	'Multiple''Single'

    configuration: {
      activeRevisionsMode: 'multiple'

[brwilkinson]

I tested out a few scenarios and it appears to be working as expected.

if you use this image for testing.
"mcr.microsoft.com/azuredocs/aks-helloworld:v1"

then you can set the ENV var below to see which version is active "title": "Hello World 4"

          env: [
            {
              name: 'TITLE'
              value: containerAppInfo.title
            }
          ]

When I deploy with the following, it

    configuration: {
      maxInactiveRevisions: 1
      activeRevisionsMode: 'Single'
      ingress: {
        external: true
        targetPort: 80
        allowInsecure: false
        transport: 'auto'
        traffic: [
          {
            weight: 100
            latestRevision: true
          }
        ]
      }
    }

It just keeps the previous version

if i set maxInactiveRevisions: 0

it drops back to 1

Then if I update the message... it serves traffic on "Hello World 4" while it provisions..

then switches to

temporarily see this..

then after a refresh, it goes back to the 0 inactive.

---

So I guess we can take a look at revisionSuffix: sanitizedRevisionSuffix and see why using that fails in activeRevisionsMode: 'Single' mode?

[brwilkinson]

when I set this revisionSuffix: 'abc'

Are you using some buildId etc that iterates for this value or a static value?

• I don't believe you would want to set this as static, otherwise It cannot spin up the new instance on the side, not serving any traffic, then move traffic to the new instance once it has been provisioned.

If you remove that property... you will get the random name used here, see previous images.

---

I can repro your issue

ERROR: The following field(s) are either invalid or missing. Invalid value: "abc": revision with suffix abc already exists.

I would say this is expected behavior, Since the suffix is set to a static value, there is no way to create the new deployment on the side without taking this instance offline, which would mean an outage for your app.

[alicyn]

The sanitizedRevisionSuffix is constructed using the uniqueString function.

param containerAppName string = 'staging-${uniqueString(resourceGroup().id)}'
param containerImage string = 'mycompanyregistry.azurecr.io/web:mytag'

param revisionSuffix string = uniqueString(containerImage, containerAppName)
var sanitizedRevisionSuffix = substring(revisionSuffix, 0, 10)

It seems to be in the proper format:

Here is the updated template with maxInactiveRevisions added:

resource containerApp 'Microsoft.App/containerApps@2022-06-01-preview' = {
  name: containerAppName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    managedEnvironmentId: containerAppEnvironmentId
    configuration: {
      maxInactiveRevisions: 1
      activeRevisionsMode: 'Single'
      ingress: {
        external: true 
        targetPort: containerPort
        allowInsecure: false
        traffic: [
          {
            latestRevision: true
            weight: 100
          }
        ]
      }
    }
    template: {
      revisionSuffix: sanitizedRevisionSuffix
      containers: [
        {
          env: [
            {
              name: 'TITLE'
              value: 'test 2'
            }
          ]

After changing the env variable value from test 1 to test 2 (I could not find a .title property in the resource), I get the same error when trying to deploy:

{"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"Conflict","message":"{\r\n  \"status\": \"Failed\",\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.\",\r\n    \"details\": [\r\n      {\r\n        \"code\": \"DeploymentFailed\",\r\n        \"target\": \"/subscriptions/redacted/resourceGroups/RGdev/providers/Microsoft.Resources/deployments/containerAppModule\",\r\n        \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.\",\r\n        \"details\": [\r\n          {\r\n            \"code\": \"WebhookInvalidParameterValue\",\r\n            \"message\": \"The following field(s) are either invalid or missing. Invalid value: \\\"yb3qgt5wb6\\\": revision with suffix yb3qgt5wb6 already exists.: template.revisionsuffix.\"\r\n          }\r\n        ]\r\n      }\r\n    ]\r\n  }\r\n}"}]}}

I noticed that I was using an old version Microsoft.App/containerApps@2022-06-01-preview so I changed it to use Microsoft.App/containerApps@2022-11-01-preview, deleted both the container app and the environment, but this didn't seem to make any difference regarding the "revision already exists" error.

[brwilkinson]

oh great, I was going to mention the api version. there is a new workloadprofiles feature that is worth looking at.

---

You need to ensure each time you deploy that you get a new suffix value.

• is there a specific reason why you are setting this value ? it's not a required property, if you comment that out, it will generate its own random unique value.

[brwilkinson]

You likely would need some deterministic method to implement traffic splitting etc.

• These are harder problems to solve with 'Declarative' deployment methods.
• It looks like you can use labels here as well.
  • it's probably better to totally separate environments between: dev, staging and prod for that if deploying with Bicep.

https://learn.microsoft.com/en-us/azure/container-apps/traffic-splitting?pivots=azure-resource-manager
https://learn.microsoft.com/en-us/azure/container-apps/traffic-splitting?pivots=azure-resource-manager#configure-traffic-splitting

[alicyn]

@brwilkinson Thank you, yes! that was it. It seemed like all the bicep examples on various websites for container apps included that revisionSuffix parameter. I figured it was a static value, but I didn't realize it would solve the issue of generating a unique suffix if I had just omitted it.