Az Function Elastic Premium doesn't creates its file share

[caioqueirozkr]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.2.0

AzureRM Provider Version

= 2.82.0, < 3.0.0

Affected Resource(s)/Data Source(s)

azurerm_function_app

Terraform Configuration Files

resource "azurerm_storage_account" "this" {
  name                     = "sasample"
  resource_group_name      = var.resource_group_name
  location                 = var.region
  account_tier             = "Standard"
  account_replication_type = "GRS"
  account_kind             = "StorageV2"

  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [azurerm_subnet.this.id]
    bypass = [
      "Metrics",
      "Logging",
      "AzureServices"
    ]
  }
}

resource "azurerm_app_service_plan" "service_plan" {
  name                = var.serviceplan_name
  location            = var.region
  resource_group_name = var.resource_group_name
  tags                = var.tags

  kind             = "linux"
  is_xenon         = false
  per_site_scaling = false
  reserved         = true

  sku {
    tier     = "ElasticPremium"
    size     = "EP1"
    capacity = 30
  }
}

resource "azurerm_function_app" "azure_function" {

  name                            = var.azure_function_name
  location                        = var.region
  resource_group_name             = var.resource_group_name
  app_service_plan_id             = azurerm_app_service_plan.service_plan.id
  storage_account_name            = azurerm_storage_account.this.name
  storage_account_access_key      = azurerm_storage_account.this.primary_access_key
  version                         = "~4"
  os_type                         = "linux"

  app_settings = {
    FUNCTIONS_WORKER_RUNTIME  = "python"
    FUNCTION_APP_EDIT_MODE    = "readonly"
    WEBSITE_VNET_ROUTE_ALL    = "1"
    APP_STORAGE_ACCOUNT_URL   = azurerm_storage_account.this.primary_blob_endpoint
    WEBSITE_CONTENTOVERVNET   = 1
    AZURE_CLIENT_ID           = azurerm_user_assigned_identity.this.client_id
    AZURE_SUBSCRIPTION_ID     = data.azurerm_client_config.current.subscription_id
    AZURE_TENANT_ID           = data.azurerm_client_config.current.tenant_id
  }

  site_config {
    linux_fx_version          = "PYTHON|3.9"
    use_32_bit_worker_process = false
    pre_warmed_instance_count = 2
    vnet_route_all_enabled    = true
  }

  identity {
    type         = var.identity_type
    identity_ids = var.identity_ids
  }
}

resource "azurerm_app_service_virtual_network_swift_connection" "func_conn" {
  app_service_id = azurerm_function_app.azure_function.id
  subnet_id      = var.subnet_id
}

resource "azurerm_role_assignment" "role_binding_storage_function_systemassigned" {
  scope                = azurerm_storage_account.this.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_function_app.azure_function.identity.0.principal_id
}

Debug Output/Panic Output

There is no output/panic, the apply runs gracefully but checking the function i see the error below :

Azure Function runtime unreachable.

Expected Behaviour

Azure Fileshare into the Azure storage account associated to the Azure Function created automatically after terraform apply.

Actual Behaviour

Azure Function runtime unreachable.

Steps to Reproduce

1. Create a Vnet
2. Create a subnet with a Microsoft.Storage service endpoint and a delegation for Microsoft.Web/serverFarms
3. Create a storage account with the subnet created previously
4. Create a function with Premium P1v2 ASP and connect to the subnet previously created (Vnet Integration)
5. Change the ASP from Premium P1v2 to Elastic Premium EP1

Important Factoids

No response

References

#14167
https://docs.microsoft.com/en-us/azure/azure-functions/functions-app-settings
https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-vnet#configure-your-function-app-settings

[mkprizzle]

This is unsupported, you must upgrade to provider 3.x and manually create contentshare with azurerm_storage_share and point to that with WEBSITE_CONTENTSHARE = azurerm_storage_share.example.name

VNet integration and storage share auto provisioning stopped working in 2.77 and support was ceased

[xiaxyi]

@caioqueirozkr have you tried the new resource provider azurerm_linux_function_app as azurerm_function_app is being deprecated?

[caioqueirozkr]

Hello @xiaxyi, yes i just replaced my code to sue the new resource provider, same behavior.

[caioqueirozkr]

This is unsupported, you must upgrade to provider 3.x and manually create contentshare with azurerm_storage_share and point to that with WEBSITE_CONTENTSHARE = azurerm_storage_share.example.name

VNet integration and storage share auto provisioning stopped working in 2.77 and support was ceased

Hello @mkprizzle thanks,

i upgraded the azurerm provider to 3.x and manually created the share, i also added the WEBSITE_CONTENTSHARE to my function settings, but after deploy, i still have the same error, Function unreachable.

Maybe if should be done in a specific order, currently my deploy will do everything together.

[mkprizzle]

If you are using storage account ACLs and vnet integration, make sure storage account whitelists the azure websites subnet (or has a private endpoint)

[caioqueirozkr]

I just checked and the Function Vnet is added to storage account firewall, the Vnet integration is enabled. i could create a private endpoint for the storage account, would Vnet Integration and vnet route all disabled in this case?

[xiaxyi]

Hi @caioqueirozkr, have you tried to create the storage file share manually and see if the function app can be created as expected?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.