Azure / Azure/azure-functions-host
Misconfigured Key Vault references cause silent errors in Az Function runtime
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
#### Check for a solution in the Azure portal
For issues in production, please check for a solution to common issues in the Azure portal before opening a bug. In the Azure portal, navigate to your function app, select `Diagnose and solve problems` from the left, and view relevant dashboards before opening your issue.
#### Investigative information
Please provide the following:
- Timestamp: N/A
- Function App version: `4.27.2.21466`
- Function App name: N/A
- Function name(s) (as appropriate): N/A
- Invocation ID: N/A
- Region: West US
#### Repro steps
Provide the steps required to reproduce the problem:
1. Deploy one or more Functions into a Function App. The deployed function should access an environment variable (ex. `SAMPLE_ENV_VAR`).
2. Add a value in the Azure UI for the environment variable (ex. `SAMPLE_ENV_VAR`).
3. Confirm the Functions appear in the Function App in the Azure Portal UI and that the Functions can be executed.
4. Set the environment variable that the code accesses (ex. `SAMPLE_ENV_VAR`) to a KeyVault reference that the app does not have access to (ex. `@Microsoft.KeyVault(VaultName=my-keyvault-name;SecretName=my-secret-name)`)
5. Restart the function
#### Expected behavior
Provide a description of the expected behavior.
- The Function App throws an error which is visible in the logs showing a permission error when attempting to deference the Key Vault reference
- The Function App displays all Functions in the list of functions
#### Actual behavior
Provide a description of the actual behavior observed.
- The Function App's Functions disappear from the list
- The Function App does not throw a permissions error
#### Known workarounds
Provide a description of any known workarounds.
- Hardcode the Key Vault secret's value and restart the app. The app works just fine.
#### Related information
Provide any related information
* Programming language used: Node 18 - ESM
Contributor guide
Research direction
No repository file or test is named. Start by reproducing the Azure Functions host behavior with an inaccessible Key Vault reference and inspect runtime logs during restart. Done means the permission error is visible and the app continues to display its Functions instead of silently removing them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, node.js
- Domain
- authorization, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100