使用Terraform远程构建Azure Python函数应用时代码无法更新的问询

通过Terraform部署了基于Python运行时的Azure Functions App，Azure端整体运行正常，但函数的Python代码报错。更新代码并推送变更后，Azure上的函数未同步更新。已知用Blob存储托管文件时可通过filemd5强制更新.zip包，但当前采用远程构建（启用SCM_DO_BUILD_DURING_DEPLOYMENT和ENABLE_ORYX_BUILD）确保Python包正常安装/访问，因此有两个疑问：

1. 是否可以强制更新函数应用定义中的zip_deploy_file？还是必须执行terraform destroy后重新构建整个应用？
2. 将部署方式从WEBSITE_RUN_FROM_PACKAGE改为远程构建后，当前的null_resource是否已冗余？

附相关Terraform代码：

resource "null_resource" "pip" {
  triggers = {
    requirements_md5 = "${filemd5("../src/requirements.txt")}"
  }
  provisioner "local-exec" {    
    command = "pip install --target='.python_packages/lib/site-packages' -r requirements.txt"
    working_dir = "../src"
  }
}

data "archive_file" "functions" {
  type = "zip"
  source_dir = "../src"
  output_path = "../src/functions.zip"
  depends_on = [null_resource.pip]
} 

resource "azurerm_linux_function_app" "function_app" {
  name                = "func-${var.application_name}-${var.environment_name}-fnapp"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location

  storage_account_name       = azurerm_storage_account.functions.name
  storage_account_access_key = azurerm_storage_account.functions.primary_access_key
  service_plan_id            = azurerm_service_plan.main.id

  site_config {
    application_insights_key               = azurerm_application_insights.main.instrumentation_key
    application_insights_connection_string = azurerm_application_insights.main.connection_string

    application_stack {
      python_version = "3.11"
    }
    cors {
      allowed_origins     = ["https://portal.azure.com"]
      support_credentials = true
    }
  }

  app_settings = {
    "ENABLE_ORYX_BUILD" = true
    "BLOBSTORAGE_CXNSTR" = "${var.blobstorage_cxnstr}"
    "SCM_DO_BUILD_DURING_DEPLOYMENT" = true
    "FUNCTIONS_WORKER_RUNTIME" = "python"
  }

  zip_deploy_file = data.archive_file.functions.output_path
  depends_on = [data.archive_file.functions]

  identity {
    type         = "SystemAssigned, UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.functions.id]
  }
}

1. 强制更新zip_deploy_file无需销毁重建 #

不需要执行terraform destroy，可通过以下两种方式触发Terraform重新部署zip包：

• 添加内容哈希自动触发：修改data "archive_file" "functions"，新增source_content_hash字段，基于src目录下所有文件的哈希值生成触发器。只要代码或依赖文件变更，该哈希值就会变化，Terraform会自动重新生成zip包并触发函数应用更新：

  data "archive_file" "functions" {
    type        = "zip"
    source_dir  = "../src"
    output_path = "../src/functions.zip"
    depends_on  = [null_resource.pip]
    # 递归计算src目录下所有文件的SHA256哈希，触发zip包重建
    source_content_hash = filesha256("../src/**")
  }
  

• 手动强制触发：如果临时需要强制更新，执行命令terraform apply -replace=data.archive_file.functions，强制重新生成zip包，Terraform会自动将新包部署到函数应用。

2. null_resource.pip已冗余，可直接删除 #

当前启用了远程构建（SCM_DO_BUILD_DURING_DEPLOYMENT=true和ENABLE_ORYX_BUILD=true），Azure会在部署时自动读取requirements.txt并在云端安装兼容的依赖包。本地的null_resource.pip执行的pip install步骤完全多余：远程构建时Oryx会忽略本地已安装的依赖，重新根据requirements.txt构建环境，删除该资源不会影响部署效果，还能简化本地构建流程。

内容的提问来源于stack exchange，提问作者Alicia