Function app unexpected changes in WEBSITE_CONTENTSHARE after apply

[uolter]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

• Terraform version: v0.13.3
• Azurerm provider: 2.46.1

Affected Resource(s)

• azurerm_function_app
• azurerm_function_app_slot

Terraform Configuration Files

provider "azurerm" {
  version = "2.46.1"
  features {}
}

variable "resource_group" {
  default = "dev-walter"
}

variable "location" {
  default = "West Europe"
}

resource "azurerm_storage_account"  "fn4_test_storage" {
 name = "fn4teststorage"
 resource_group_name = var.resource_group
 location = var.location
 account_tier = "Standard"
 account_replication_type = "LRS"
}

resource "azurerm_app_service_plan"  "fn4_test_plan" {
  name = "fn4-test-plan"
  location = var.location
  resource_group_name = var.resource_group
  kind = "elastic"

  sku {
    capacity = 1
    tier = "ElasticPremium"
    size = "EP1"
  }
}

resource "azurerm_function_app"  "fn4_test" {
  name = "fn4-test"
  location = var.location
  resource_group_name = var.resource_group
  app_service_plan_id = azurerm_app_service_plan.fn4_test_plan.id
  storage_account_name = azurerm_storage_account.fn4_test_storage.name
  storage_account_access_key = azurerm_storage_account.fn4_test_storage.primary_access_key
  version = "~3"
  enable_builtin_logging = false
  
  app_settings = {
    ENABLE_ORYX_BUILD = "false"
    FUNCTIONS_WORKER_RUNTIME = "node"
    SCM_DO_BUILD_DURING_DEPLOYMENT = "false"
    WEBSITE_NODE_DEFAULT_VERSION = "~14"
    DUMMY = 1
    WEBSITE_CONTENTSHARE = "fn4-test-content"
  }
}

resource "azurerm_function_app_slot"  "fn4_test_slot" {
    name = "staging"
    location = var.location
    resource_group_name = var.resource_group
    app_service_plan_id = azurerm_app_service_plan.fn4_test_plan.id
    function_app_name = azurerm_function_app.fn4_test.name
    storage_account_name = azurerm_storage_account.fn4_test_storage.name
    storage_account_access_key = azurerm_storage_account.fn4_test_storage.primary_access_key
    version = "~3"
    enable_builtin_logging = false

    app_settings = {
        FUNCTIONS_WORKER_RUNTIME = "node"
        WEBSITE_NODE_DEFAULT_VERSION = "~14"
        ENABLE_ORYX_BUILD = "false"
        SCM_DO_BUILD_DURING_DEPLOYMENT = "false"
        WEBSITE_CONTENTSHARE = "staging-content"
    }
}

Debug Output

I changed the value of the DUMMY app settings from 1 to 2 and this is the only change I see running the plan command:

  ....
  ~ app_settings                   = {
         
          ~ "DUMMY"                                 = "1" -> "2"
            "ENABLE_ORYX_BUILD"                     = "false"
            "FUNCTIONS_WORKER_RUNTIME"              = "node"
            "SCM_DO_BUILD_DURING_DEPLOYMENT"        = "false"
            "WEBSITE_CONTENTSHARE"                  = "staging-content"
            "WEBSITE_NODE_DEFAULT_VERSION"          = "~14"
        }
        client_affinity_enabled        = false
....        

Panic Output

Expected Behaviour

I am expecting to go in azure portal Home → dev-walter → fn4-test → Configuration and see only one change: the value of the app setting DUMMY

Actual Behaviour

The app settings DUMMY is correctly set to 2 while the WEBSITE_CONTENTSHARE changed from staging-content to fn4-test-content even if within the plan there is no evidence that setting is going to change.
This is very dangerous because it can cause an "hidden swap" of the running software from a stable version to an unstable one.

Steps to Reproduce

1. terraform apply
2. Deploy on the "production" slot version 1.0 of your function
3. Deploy on "staging" slot version 2.0 of your function
4. Go to the portal and swap staging and production slots. When your run the swap azure behind the hood also swap the values inside the settings WEBSITE_CONTENTSHARE.
   - before the swap: production is equal to fn4-test-content staging is equal to staging-content
   - after the swap: production is equal to staging-content production is equal to fn4-test-content
   (as far as I know this is how azure works)
   Now version 2.0 runs in production while version 1.0 is in stating
5. Edit your terraform configuration file: for instance change the value of the app settings DUMMY
6. terraform apply
7. Check the plan on the standard output: the only change highlighted is the value of the DUMMY app settings like in the example above
8. As soon as the apply is completed you will find out version 1.0 runs in production while version 2.0 is in stating unexpectedly.

Important Factoids

References

Since I am stucking with this issue blocking me to any further changes in my function apps running in production I've tried to fix the provider.
Here my PR

• Fix functions app website_contenteshare unwanted changes

Basically I don't see the reason to set inside the provider the value for WEBSITE_CONTENTSHARE.
I prefer to set it within my terraform configuration file:

production

app_settings = {

  WEBSITE_CONTENTSHARE = "fn4-test-content"
}

staging

app_settings = {

  WEBSITE_CONTENTSHARE = "staging-content"
}

Then I don't want to change them with following apply. Provided that I am also putting the lifecycle block in the definition of the function

resource "azurerm_function_app"  "fn4_test" {
    name = "fn4-test"
    ....
    ....
    lifecycle {
        ignore_changes = [
          app_settings["WEBSITE_CONTENTSHARE"],
        ]
    }
}
....
resource "azurerm_function_app_slot"  "fn4_test_slot" {
name = "staging"
...
  lifecycle {
    ignore_changes = [
      app_settings["WEBSITE_CONTENTSHARE"],
    ]
  }
}

Also refer to these issues:

• Function App does Not Modify/manage WEBSITE_CONTENTAZUREFILECONNECTIONSTRING & WEBSITE_CONTENTSHARE with App plan or storage account switch #9766
• Function app slot (azurerm_function_app_slot) is created with bad value for WEBSITE_CONTENTSHARE app setting #7888
• Linux consumption plan apps created using terraform return 500 because of WEBSITE_CONTENT* settings #8130
• azurerm_function_app WEBSITE_CONTENTSHARE app_settings always shown as changed #9536

[github-actions]

This functionality has been released in v2.77.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.