Improve documentation surrounding how function keys are managed when AzureWebJobsSecretStorageType=kubernetes
- Dominant language
- PowerShell
- Stars
- 1.1k
- Forks
- 215
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
First, I will refe[r you to this question I put on the microsoft community help](https://learn.microsoft.com/en-us/answers/questions/2237333/my-function-in-my-function-app-executes-but-doesnt?orderby=newest&page=1&translated=false#answers) fora a couple days ago.
Please read ^^^^ this question ^^^^ thoroughly as well as the answer I reported earlier today to get a good grip on the background of this request, and to understand how I ultimately found the solution.
The primary documentation I found on how to manage function app secrets in k8s was on [this](https://learn.microsoft.com/en-us/answers/questions/2237333/my-function-in-my-function-app-executes-but-doesnt?orderby=newest&page=1&translated=false#answers ) and [this](https://learn.microsoft.com/en-us/azure/azure-functions/function-keys-how-to?tabs=azure-portal#manage-key-storage) Microsoft Learn page.
It took me forever to find an example k8s manifest for how to declare the secret, but I eventually found one in a description of a PR [here](https://github.com/Azure/azure-functions-host/pull/4462). I used this to come up with this manifest for my own application
```
apiVersion: v1
data:
function.HttpTrigger.default: ++++++++
host.master: ++++++++
kind: Secret
immutable: true
metadata:
annotations:
ecosystem: dotnet
owning-team: vrbe
pillar: VR
runtime: Azure functions host runtime in docker
creationTimestamp: '2025-03-25T18:57:09Z'
labels:
app: vrbe-auth
argocd.argoproj.io/instance: vrbe-auth
helm.sh/chart: common-1.0.0
name: vrbe-auth-fn-keys
namespace: vrbe
resourceVersion: '336197458'
uid: 26460870-c4a2-409c-aab6-0ea21fdd5d3b
type: Opaque
```
I can't say for sure exactly what was going on and what was causing that 500 since I have no context inside the transport that modifies the k8s secret or that routes requests from the http entry down to the function, but my best guess is that my application runtime was unable to update this k8s secret, and therefore, the application container was facing errors.
There are a few problems with this:
- I would expect the container runtime to report problems interacting with k8s in the form of a load of error logs if it cannot modify the a kubernetes secret. There was no visibility into what the problem even was by reviewing application logs. There was simply nothing there.
- If there is a logging configuration one can set up in order to get these logs to be reported to the console, then [the logging documentation makes no mention of it.](https://learn.microsoft.com/en-us/azure/azure-functions/functions-host-json#logging)
- There is no documentation inside of the linked Microsoft Learn documents as to what the `data` of the secret should be. I pulled `host.master` and `function.HttpTrigger.default` from a 6-year-old PR, and it magically seemed to work. There needs to be improved documentation about what would constitute well-formed k8s secret data, not to mention a huge warning that the `immutable` flag on the manifest cannot be set.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.