AzureFunctionApp does not work with storage account key vault reference and linux consumption plan

[cveld]

Required Information

Entering this information will route you directly to the right team and expedite traction.

Question, Bug, or Feature?
Type: Bug

Enter Task Name: AzureFunctionApp

list here (V# not needed):
https://github.com/microsoft/azure-pipelines-tasks/tree/master/Tasks/AzureFunctionAppV1
https://github.com/microsoft/azure-pipelines-tasks/tree/master/Tasks/AzureFunctionAppV2
Interestingly, v2 does not seem to be published to the market place?

Environment

• Azure Pipelines

  • If using Azure Pipelines, provide the account name, team project name, build definition name/build number: I can disclose this information through private channels

Issue Description

When deploying a function app to a linux consumption plan hosted function app service with a key vault reference in the property AzureWebJobsStorage, the task will fail with the error message: Unable to find the storage account associated with the function app.
Value I am using: @Microsoft.KeyVault(VaultName=myvault;SecretName=mystorageaccount-ConnectionString)

Interestingly deploying through Visual Studio 2022 (17.2) works fine.
func cli fails; version 4.0.4590 with the error Error creating a Blob container reference. Please make sure your connection string in "AzureWebJobsStorage" is valid. For this it appears there is already an issue opened: Azure/azure-functions-core-tools#2564

Task logs

I can disclose this through private channels

[bennycoomans]

I have the same issue. For now, I resorted to setting the connection string directly for the AzureWebJobsStorage key, instead of using a key vault reference. However, this feels less secure, so it would be great if this could be fixed.

@nadesu , this issue has been auto-assigned to you, would you play a role in addressing this issue and if so, do you have any idea if this will be fixed somewhere in the (near or distant) future?

[FinVamp1]

Hi, I will test this soon and come back to this work item and update you.

[databrickstrainer]

Any update on this issue? It seems like it's still a problem...

[FinVamp1]

Hi, still thinking about how best to implement this. Would you be happy to add the Service Principal directly and manually to the Key Vault to enable this functionality?

[cveld]

Which service principal?

• ideally we should be leveraging managed identity. The function app MI should have the appropriate azure rbac permissions onto the storage account
• when using connectionstring stored in a key vault secret as a fallback, the function app MI should have appropriate rbac permissions on the key vault secret. Like the other settings work.

In both cases this should be done upfront before running the azure pipelines task.

[github-actions]

This issue is stale because it has been open for 180 days with no activity. Remove the stale label or comment on the issue otherwise this will be closed in 5 days