Why will my deployment always modify Container App "runningStatus" ?

[trylvis]

I am creating a reusable Container App module in Bicep.

Each time I deploy with "--what-if" , it wants to modify.

Resource and property changes are indicated with these symbols:
  - Delete
  ~ Modify
  = Nochange

The deployment will update the following scopes

Scope: /subscriptions/xyz

  = resourceGroups/rg-apps-01 [2021-04-01]

Scope: /subscriptions/xyz/resourceGroups/rg-apps-01

  ~ Microsoft.App/containerApps/ca-api-01 [2024-03-01]
    - properties.runningStatus:                     "Running"

Resource changes: 1 to modify, 1 no change.

What is causing this?

Here is my code:

// ==================== //
//   Parameters         //
// ==================== //

@description('Required. Container App configuration.')
param app containerAppType

@description('Required. Resource ID of environment.')
param environmentResourceId string

@description('Environment type')
param environmentType string = 'dev'

@description('Location of the Container App Environment')
param location string = 'westeurope'

@description('Optional. Tags of the resource.')
param tags object?

// ==================== //
//      Variables       //
// ==================== //

// Mapping of CPU cores to memory
var cpuToMemoryMap = {
  '0.25': '0.5'
  '0.5': '1.0'
  '0.75': '1.5'
  '1.0': '2.0'
  '1.25': '2.5'
  '1.5': '3.0'
  '1.75': '3.5'
  '2.0': '4.0'
  '2.25': '4.5'
  '2.5': '5.0'
  '2.75': '5.5'
  '3.0': '6.0'
  '3.25': '6.5'
  '3.5': '7.0'
  '3.75': '7.5'
  '4.0': '8.0'
}

var memory = cpuToMemoryMap[app.?cpuCores ?? '0.25']

var secretList = !empty(app.?secrets) ? app.secrets.secureList : []

// Container App Name
var name = 'ca-${app.workload}-01'

// ==================== //
//      Resources       //
// ==================== //

resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
  name: name
  tags: tags
  location: location
  identity: { type: 'SystemAssigned' }
  properties: {
    environmentId: environmentResourceId
    configuration: {
      activeRevisionsMode: app.?activeRevisionsMode ?? null
      ingress: {
        traffic: [
          {
            latestRevision: true
            weight: 100
          }
        ]
        customDomains: !empty(app.?customDomains) ? app.?customDomains : null
        external: app.?ingressExternal ?? false
        exposedPort: 0
        ipSecurityRestrictions: !empty(app.?ipSecurityRestrictions) ? app.?ipSecurityRestrictions : null
        targetPort: app.?ingressTargetPort ?? 80
        transport: app.?ingressTransport ?? 'auto'
      }
      registries: !empty(app.?registryUrl)
        ? [
            {
              server: app.?registryUrl
              username: app.?dockerRegistryUserName
              passwordSecretRef: 'container-registry-password'
            }
          ]
        : null
      secrets: secretList
    }
    template: {
      containers: [
        {
          image: toLower(app.containerImage)
          name: app.workload
          env: app.?environmentVariables

          // ]
          resources: {
            cpu: json('${app.?cpuCores ?? '0.25'}')
            memory: '${memory}Gi'
          }
        }
      ]
      revisionSuffix: revisionSuffix
      scale: {
        maxReplicas: app.?scaleMaxReplicas ?? 1
        minReplicas: app.?scaleMinReplicas ?? 0
        rules: !empty(app.?scaleRules) ? app.?scaleRules : null
      }
    }
    workloadProfileName: app.?workloadProfileName ?? 'Consumption'
  }
}

// ==================== //
//       Outputs        //
// ==================== //

// ==================== //
//        Types         //
// ==================== //

@export()
type containerAppType = {
  @description('Required. The workload of the app')
  workload: string

  @description('Optional. Workload profile name to pin for container app execution.')
  workloadProfileName: string?

  @description('Optional. Number of CPU cores to allocate to the container app.')
  cpuCores:
    | '0.25'
    | '0.5'
    | '0.75'
    | '1.0'
    | '1.25'
    | '1.5'
    | '1.75'
    | '2.0'
    | '2.25'
    | '2.5'
    | '2.75'
    | '3.0'
    | '3.25'
    | '3.5'
    | '3.75'
    | '4.0'?

  @description('Optional. Minimum number of container replicas. Defaults to 0 if not set.')
  scaleMinReplicas: int?

  @description('Optional. Maximum number of container replicas. Defaults to 3 if not set.')
  scaleMaxReplicas: int?

  @description('Optional. Scaling rules.')
  scaleRules: array?

  @description('Optional. Ingress transport protocol.')
  ingressTransport: 'auto' | 'http' | 'http2' | 'tcp'?

  @description('Optional. Target Port in containers for traffic from ingress.')
  ingressTargetPort: int?

  @description('Optional. Bool indicating if the App exposes an external HTTP endpoint.')
  ingressExternal: bool?

  @description('Optional. Controls how active revisions are handled for the Container app.')
  activeRevisionsMode: 'Multiple' | 'Single'?

  @description('Optional. Additional port mappings for the container app.')
  additionalPortMappings: portMappingsType[]?

  @description('Optional. Environment variables of the Container APp')
  environmentVariables: array?

  @description('Optional. The secrets of the Container App.')
  @secure()
  secrets: object?

  @description('Optional. The path for the startup health probe.')
  startupPath: string?

  @description('Optional. The path for the readiness health probe.')
  readinessPath: string?

  @description('Optional. The path for the liveness health probe.')
  livenessPath: string?

  @description('Container Registry UserName')
  dockerRegistryUserName: string?

  @description('Container Registry URL')
  registryUrl: string?

  @description('The name of the container image. This is the image name including the registry URL.')
  containerImage: string

  @description('Optional. Rules to restrict incoming IP address.')
  ipSecurityRestrictions: array?

  @description('Optional. CORS Allowed Origins')
  corsAllowedOrigins: string[]?

  @description('Optional. Custom domains for the container app.')
  customDomains: array?
}

type portMappingsType = {
  @description('Specifies the exposed port for the target port. If not specified, it defaults to target port.')
  exposedPort: int?

  @description('Specifies whether the app port is accessible outside of the environment.')
  external: bool

  @description('Specifies the port user\'s container listens on.')
  targetPort: int
}