Managed identity not changed after swap slots operation
- Dominant language
- PowerShell
- Stars
- 1.1k
- Forks
- 215
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
### Description
We sometimes encounter an issue that after a swap slots operation, the production slot is running using the managed identity of the deployment slot. When this happens, we restart the function app and everything works again.
The issue happens (but probably is not limited to) with Http and ServiceBus triggers and the CosmosDB and ServiceBus .NET client libraries.
However, that behaviour is problematic for our continuous deployment pipeline, which automatically performs a zip deployment and a subsequent slot swap if the zip deployment was successful.
We are using:
- Latest version of dotnet-isolated (~4 .NET 8) and worker (1.22.0)
- Consumption Windows plan
- Deployment using ARM (via pulumi)
- AzureWebJobsStorage and WEBSITE_CONTENTAZUREFILECONNECTIONSTRING using connection strings since managed identity is not supported on consumption plan for these
- WEBSITE_RUN_FROM_PACKAGE=1
We also tried setting the AzureFunctionsWebHost__hostid setting explicitly for deployment and production slots (but they were unique before anyways). This had no effect.
I suspect the issue is just a missing refresh of the managed identity or a missing cache invalidation.
Let me know if you need more information.
### Steps to reproduce
1. Create function app using latest dotnet-isolated worker
2. Use managed identity and log/assert it on trigger (e.g. check managed identity and compare to cloud_RoleName/url)
3. Repeat a couple of times (~ every 3rd to 5th time in our case):
1. Deploy new zip file `az functionapp deployment source config-zip`
2. Swap slots `az functionapp deployment slot swap`
3. Trigger function
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.