新建Azure Function App创建主机密钥失败，求排查方案

报错信息 #

创建新建Azure Function App的主机密钥时失败，返回错误如下：

{
    "status": "Failed",
    "error": {
        "code": "BadRequest",
        "message": "Encountered an error (InternalServerError) from host runtime.",
        "details": [
            {
                "message": "Encountered an error (InternalServerError) from host runtime."
            },
            {
                "code": "BadRequest"
            },
            {}
        ]
    }
}

Azure门户异常 #

注意：对已存在的Function App执行相同创建密钥操作可正常完成。

部署代码 #

主部署文件代码：

module myFunctionModule '../function-bundle.bicep' = {
  name: parentDeploymentName
  params: {
    storageAccountName: storageAccountName
    functionAppName: functionName
    functionAppPlanName: appPlanName
    keyVaultName: keyVaultName
    tags: functionAppTags
    location: location
    parentDeploymentName: parentDeploymentName
  }
}

resource waitDeployment 'Microsoft.Resources/deployments@2021-04-01' = {
  name: 'waitForFunctionApp'
  properties: {
    mode: 'Incremental'
    template: {
      '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#'
      contentVersion: '1.0.0.0'
      resources: []
    }
  }
  dependsOn: [
    myFunctionModule
  ]
}

resource myKey 'Microsoft.Web/sites/host/functionKeys@2022-03-01' = {  
  name: '${functionName}/default/myKey'  
  properties: {  
    name: 'myKey'  
  }
  dependsOn: [
    waitDeployment
  ]  
} 

模块内容 #

function-bundle.bicep #

param tags object
param functionAppName string
param functionAppPlanName string
param storageAccountName string
param keyVaultName string
param location string
param parentDeploymentName string

module functionModule './function.bicep' = {
  name: take('${parentDeploymentName}-functionDeployment', 64)
  params: {
    location: location
    storageAccountName: storageAccountName
    appServicePlanName: functionAppPlanName
    functionAppTags: tags
    functionAppName: functionAppName

  }
}

module addKeyVaultAccessDeploymentModule './add-kv-access.bicep' = {
  name: take('${parentDeploymentName}-functionAddKeyVaultAccessDeployment', 64)
  params: {
    keyVaultName: keyVaultName
    principalId: functionModule.outputs.functionIdentity.principalId
    roleName: 'KeyVaultSecretsUserRole'
    principalType: 'ServicePrincipal'
  }
}

@secure()
output storageAccountKey string = functionModule.outputs.storageAccountKey
@secure()
output storageAccountConnectionString string = functionModule.outputs.storageAccountConnectionString
output functionUrl string = functionModule.outputs.functionUrl

function.bicep #

param location string
param storageAccountName string
param appServicePlanName string
param functionAppTags object
param functionAppName string
param sku object = {
    name: 'B1'
    tier: 'Basic'
    size: 'B1'
    family: 'B'
    capacity: 1
  }


resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: storageAccountName
  location: location
  tags: functionAppTags
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'Storage'
}

resource appServicePlan 'Microsoft.Web/serverfarms@2024-04-01' = {
  name: appServicePlanName
  location: location
  properties: {
    reserved: true
  }
  kind: 'functionapp,linux'
  sku: sku
  tags: functionAppTags
}

resource function 'Microsoft.Web/sites@2024-04-01' = {
  name: functionAppName
  location: location
  tags: functionAppTags
  kind: 'functionapp,linux'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enabled: true
    serverFarmId: appServicePlan.id
    siteConfig: {
      numberOfWorkers: 1
      linuxFxVersion: 'DOTNET-ISOLATED|9.0'
      appSettings: [
      {
          name: 'AzureWebJobsStorage'
          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${storageAccount.listKeys().keys[0].value};EndpointSuffix=core.windows.net'
      }
      {
          name: 'FUNCTIONS_WORKER_RUNTIME'
          value: 'dotnet-isolated'
      }
      {
          name: 'FUNCTIONS_EXTENSION_VERSION'
          value: '~4'
       }
  ]
    }
  }
}

var listKeyResult = storageAccount.listKeys()

output functionIdentity object = function.identity
@secure()
output storageAccountKey string = listKeyResult.keys[0].value
@secure()
output storageAccountConnectionString string = 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${listKeyResult.keys[0].value};EndpointSuffix=core.windows.net'
output functionUrl string = 'https://${function.properties.defaultHostName}/api'
output defaultHostKey string = '' //listKeys(resourceId('Microsoft.Web/sites/host', functionAppName, 'default'), function.apiVersion).functionKeys.default

已尝试的操作 #

• 添加空部署waitDeployment作为依赖，创建密钥仍失败
• 直接依赖myFunctionModule创建密钥，仍失败
• 尝试简化密钥创建代码（如下），依旧失败：

resource myKey 'Microsoft.Web/sites/host/functionKeys@2022-03-01' = {  
  name: '${functionName}/default/myKey'  
  properties: {  
    name: 'myKey'  
  }
  dependsOn: [
    myFunctionModule
  ]  
}  

疑问 #

是否存在依赖模块不如直接依赖资源可靠的情况？

内容的提问来源于stack exchange，提问作者Francis Ducharme