Skip to content

XAppService

Experimental

This API is experimental and may change without notice.

An Azure Linux Web App and its Service Plan, using a container image.

API

Property Value
Group azure.platform.example.org
Kind XAppService
Plural xappservices
Scope Namespaced
Versions v1alpha1 (referenceable)
Source compositions/apis/azure/appservice/schema.yaml

Spec

Field Type Required Default Description
customDomain object no — Optional custom hostname with a free App Service managed certificate. The CNAME and asuid TXT records are created in an existing Azure public DNS zone. Omitted or empty fields mean no custom domain.
    customDomain.dnsZone string no — Existing Azure public DNS zone name.
    customDomain.dnsZoneResourceGroup string no — Resource group holding the DNS zone.
    customDomain.hostname string no — Fully qualified hostname inside dnsZone, e.g. portal.example.com.
envVars (nullable) map[string]string no null Plain (non-secret) application settings exposed to the container as environment variables.
image string yes — Container image reference to run, e.g. docker.io/library/nginx:latest.
keyVaultSecretEnvVars (nullable) map[string]object no null Application settings resolved through App Service Key Vault references. The XAppService identity must have Key Vault Secrets User on each referenced vault.
    keyVaultSecretEnvVars[key].secretName string yes — Azure Key Vault secret name.
    keyVaultSecretEnvVars[key].secretVersion string no — Optional Azure Key Vault secret version.
    keyVaultSecretEnvVars[key].vaultName string yes — Azure Key Vault name.
location string no swedencentral Azure region for the App Service.
name immutable string yes — Name of the App Service.
port integer no 8080 Port the container listens on.
resourceGroupRef object yes — Resource group hosting the App Service.
    resourceGroupRef.name string yes — Logical name of the XResourceGroup.
size string no small T-shirt size: small = B1, medium = P1v3, large = P2v3. One of: small, medium, large.
systemAssignedIdentity immutable boolean no false Enable a system-assigned managed identity for the App Service.

Fields marked immutable are fixed once the resource is created; changing one is rejected by the API server. An immutable object pins the fields nested under it too. To change one, delete the resource and create it again.

Example

Create the referenced XResourceGroup before creating the app. The team example is disabled by default in its kustomization.yaml. Set the optional customDomain to add CNAME and asuid TXT records in an existing Azure DNS zone, bind the hostname, and issue a free App Service managed certificate. Key Vault secret references may pin a version; changing it updates app settings and forces App Service to refresh the referenced credential. XAppService readiness also waits for both the Service Plan and web app to report Synced=True; inspect their events for transient Azure API errors. With a custom domain, all required resources must report Synced=True and Ready=True, including both DNS records, the hostname binding, the managed certificate, and the SNI binding. Missing verification data keeps the app unready rather than reporting the custom hostname as available.

---
apiVersion: azure.platform.example.org/v1alpha1
kind: XAppService
metadata:
  name: appservicedemo01
spec:
  name: appservicedemo01
  size: small
  resourceGroupRef:
    name: crd-dev-apps
  image: docker.io/library/nginx:latest
  port: 80

Taken from teams/crd-dev/apps.yaml, which is applied to the cluster by Flux, so it cannot drift from a working manifest.

Status

Populated by Crossplane once the underlying Azure resources exist. Every composite in this repository exposes the provisioned Azure resource ID as status.id.

Field Type Required Default Description
defaultHostname string no — Default public hostname of the App Service.
id string no — Azure resource ID of the Linux Web App.
identityPrincipalId string no — Microsoft Entra principal ID of the system-assigned managed identity.
servicePlanId string no — Azure resource ID of the App Service Plan.
url string no — Public HTTPS URL: the custom hostname when set, otherwise the default hostname.

Reference