Container Apps Health Check

I've used the maximum allowed values for the Health Probes. I haven't disabled them. Why does the Ingress replace my Health Probes configuration? Other than disabling HTTP, what can I do?

This doesn't seem like a good behaviour. I've already wasted almost 6 hours trying to figure out why the Health Probes I've set weren't respected.
I've found this in the docs:
If ingress is enabled, the following default probes are automatically added to the main app container if none is defined for each type, except for GPU workload profiles (both dedicated and consumption).

I have a consumption GPU workload profile. So, why does this happen?

Hi, what’s really happening is that when HTTP ingress is enabled, Container Apps always expects a TCP startup probe on the ingress target port; if it doesn’t find one, it injects its own, even on GPU workloads; the “except GPU profiles” in the docs only means nothing is injected if all three probe types already exist; in your case, since the startup probe is HTTP, the platform still considers the required TCP probe missing and adds its default, which fails early, killing the replica before your model is ready. To fix this, either add your own TCP startup probe pointing to the ingress port with generous timings so no defaults are injected, or switch ingress to TCP if you don’t need HTTP features; both options work fine on consumption GPUs and avoid the auto-restart loop.

Hi, thanks a lot for the explanations. Could you please redirect me to the docs where all these are mentioned? :)
I'll keep trying, it still doesn't work.
All of the probes are now TCP, Start-Up at maximum values.
Ingress disabled, works. I only see 1-2 Warnings (color orange) from the Start-Up probe and then it works.
Ingress enabled, it doesn't work. Beside the already mentioned 1-2 warnings, I see a lot of Start-Up probes (from the Ingress I think)

I've forgot to mention. The port 8000 is specified everywhere, including the Ingress, Health Probes and the actual model uses it as well. If I start up my application while Ingress is disabled, wait for it to be Ready and the enable Ingress, I can access it for a short time. Until the new revision fails.

These are the logs:

{"TimeStamp":"2025-05-16 13:43:33 \u002B0000 UTC","Type":"Normal","ContainerAppName":"ca-poc-dev-swc-ai","RevisionName":"ca-poc-dev-swc-ai--tcp","ReplicaName":"ca-poc-dev-swc-ai--tcp-probes-bfb98d75-rh24t","Msg":"The TargetPort 8000 does not match any of the listening ports: [40241 34559 32829 42839 40817].","Reason":"Pending:PortsMismatch","EventSource":"ContainerAppController","Count":25}
{"TimeStamp":"2025-05-16T13:44:36Z","Type":"Normal","ContainerAppName":null,"RevisionName":null,"ReplicaName":null,"Msg":"No events since last 60 seconds","Reason":"NoNewEvents","EventSource":"ContainerAppController","Count":1} 
{"TimeStamp":"2025-05-16 13:45:10 \u002B0000 UTC","Type":"Normal","ContainerAppName":"ca-poc-dev-swc-ai","RevisionName":"ca-poc-dev-swc-ai--tcp-probes","ReplicaName":"","Msg":"Deactivated apps/v1.Deployment k8se-apps/ca-poc-dev-swc-ai--tcp-probes from 1 to 0","Reason":"KEDAScaleTargetDeactivated","EventSource":"KEDA","Count":2} 
{"TimeStamp":"2025-05-16 13:45:10.3247081 \u002B0000 UTC","Type":"Warning","ContainerAppName":"ca-poc-dev-swc-ai","RevisionName":"ca-poc-dev-swc-ai--tcp","ReplicaName":"ca-poc-dev-swc-ai--tcp-probes-bfb98d75-rh24t","Msg":"Container \u0027ca-poc-dev-swc-ai\u0027 was terminated with exit code \u0027\u0027 and reason \u0027ManuallyStopped\u0027","Reason":"ContainerTerminated","EventSource":"ContainerAppController","Count":1}

Hi, the issue comes from how Azure Container Apps always requires a TCP startup probe on the ingress port when using HTTP ingress, no matter what. Even if you define an HTTP startup probe in your YAML, the platform still sees it as missing the required TCP probe and injects its own default TCP startup probe with a short 4-minute timeout.

Because during model warm-up vLLM hasn't yet bound to port 8000, the TCP probe fails, the platform thinks the container is unhealthy, and keeps restarting it in a loop.

To fix this, you need to explicitly define your own TCP startup probe on port 8000, with long enough timeouts to cover the model warm-up phase (for example, 2 hours). Once you do that, Azure won’t inject its default probe anymore, and your replica will stay up during warm-up.

As alternatives, if you don’t need HTTP features, you can switch ingress to TCP mode, which makes things simpler. Or, if you're using a queue or Dapr sidecar, you can disable ingress altogether and no probes will be injected at all.

This behavior is partially documented, but the wording is still a bit unclear and there’s an internal PR ongoing to clarify it. For now, the takeaway is simple: when using HTTP ingress, always define your own TCP startup probe on the ingress port, with generous timeouts, or the platform will inject its own and cause restarts.