Azure Function ARM Deployment with listkeys results in BadRequest Error

I too have had this problem deploying Function Apps and app settings with ARM templates.

After a back-and-forth with Azure support, we realised that the persistence of the app settings causes a restart of the Function App during deployment, which results in a 503 Service Unavailable while it spins back up. This happens while the deployment is still in progress, which then causes intermittent failures of the Microsoft.Web/sites/host. This is also despite the ARM deployment mode being set to incremental, which seems to be ignored completely for function app settings.

The Diagnostics Settings of the Function App will list the hard restarts for you and might give some insight into the app setting that caused it.

A suggestion was made from Azure support to separate the app settings into their own Microsoft.Web/sites/config section in the ARM template, which dependsOn the Function App having finished deployment. I've not tried this yet, and this also goes against what's in the Function App ARM examples, where they are a child config resource of a Microsoft.Web/sites.

I think you can change the way you are establishing communication between your functions, and you will also fix your issue. I would recommend you to use Azure Managed Identity to configure the communication between your functions, instead of using the function keys. Please have a look at this article to get more details of what I am saying.

first of all, i would suggest to use Azure KeyVault as a default storage for your keys, like described here. But it seems, that this is related also some issues regarding Appservice and Package Deployments. Take a look here: https://github.com/microsoft/azure-pipelines-tasks/issues/10961 and here: https://github.com/microsoft/azure-pipelines-tasks/issues/11444. The documentation also says something like this: https://docs.microsoft.com/de-de/azure/azure-functions/run-functions-from-deployment-package

Hope this is helpfull.

I had, sort of, the same problem in a template, that deployed EventGrid Topic subscribers to a Topic. Precense of the the listkey() function in the json template resulted in the same, very non-descriptive error message.

I've made it work, by updating the ARM template schema to the newest schema supported on Azure: 2019-08-01

Like this: Top line in the file: "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentParameters.json#",

and inline, in the listkeys function:

listkeys(concat(resourceId('Microsoft.Web/sites', parameters('functionAppName')), '/host/default'), '2019-08-01').functionKeys.default)

Now, several, subsequent deployments work again, at least for me.

I have had this problem recently and contacted the Azure Functions team, and what I understood from them is this: (I am using ARM Template should be same logic to all with different approaches)

1- using WEBSITE_RUN_FROM_PACKAGE = 1 must be set before deploying the Zip File, meaning adding dependency between the ZipDeploy with deploying AppSettings.

why? if this flag is not set at first, the function would take the ZipFile and extract it to wwroot folder, leading to empty SitePackage folder and breaking the deployment and function. this flag makes the function upload a zip file to a folder in the function shared file system under data/SitePackage, with also a package.txt that has the name of the related Zip.

this flag aren't supposed to be changed back and forth, because it would break the deployment due to confusing whether it should upload the zip to SitePackages or Extract it to wwroot.

an answer i was given if turning your flag for the first time, it could happen that the first deployment fail, and you need to try again.

2- when using WEBSITE_RUN_FROM_PACAKAGE the function go through a sort of restart, that is written on the docs here you see that after deployment a restart is done.

so the step of "listKeys" could fall on a restart and leading to failure, what you need to do is Add a "wait" step for 1-2 minutes after the function deployed to be sure that everything is done.

Good Luck

I have faced pretty much the same issue. I need to feed the Azure Function which its own host key. After several different test scenarios my conclusion is that there is some delay between the Azure Function App deployment finish and the moment the Host keys are available.

My current workaround is to create previously a key in the KeyVault a use this key in two different places:

1. To create a new host key in the Azure Function
2. To feed the Azure Function appsettings

Some sample codes:

Generating Key in the KeyVault from PS

$secureSecret = ConvertTo-SecureString New-Guid.ToString() -AsPlainText -Force

Set-AzureKeyVaultSecret -VaultName $keyVaultName -Name "azure-function-key" -SecretValue $secureSecret

Create the host key and passing it to the function

Note that parameters('internalKey') would be fed from the KeyVault reference

"apiVersion": "2019-08-01",
"type": "Microsoft.Web/sites",
"kind": "functionapp",
"name": "[variables('functionAppName')]",
"location": "[variables('location')]",
"resources": [{
   "dependsOn": ["[resourceId(resourceGroup().name, 'Microsoft.Web/sites', variables('functionAppName'))]"],
   "type": "Microsoft.Web/sites/host/functionKeys",
   "apiVersion": "2018-11-01",
   "name": "[concat(variables('functionAppName'), '/default/internalkey')]",
   "properties": {
      "name": "internalkey",
      "value": "[parameters('internalKey')]"
   }
},
{
   "apiVersion": "2019-08-01",
   "name": "appsettings",
   "type": "config",
   "dependsOn": [
      "[resourceId(resourceGroup().name, 'Microsoft.Web/sites', variables('functionAppName'))]"
   ],
   "properties": {
      "FUNCTIONS_EXTENSION_VERSION": "~3",
      "HostFunctionKey": "[parameters('internalKey')]"
   }
}]

Even in you try the listKeys approach with your new host key it won't get the value. First time it will fail and successive times it will get the previous value if it has changed.