Azure devops deploy to function app with access restrictions

Question

I am trying to deploy a function app via an Azure DevOps pipeline, however I am receiving the following error:

##[error]Failed to deploy web package to App Service.
##[error]To debug further please check Kudu stack trace URL : $URL_REMOVED
##[error]Error: Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)

From some googling a suggested solution seems to be to whitelist agent IP before the deployment, and then remove it after. I have added this to my pipeline, and I can see the agent IP get added to access restrictions, however the deployment still fails.

Here is my pipeline file:

# Node.js Function App to Linux on Azure
# Build a Node.js function app and deploy it to Azure as a Linux function app.
# Add steps that analyze code, save build artifacts, deploy, and more:
# https://learn.microsoft.com/azure/devops/pipelines/languages/javascript

trigger:
- main

variables:

  # Azure Resource Manager connection created during pipeline creation
  azureSubscription: 'xxx'

  # Function app name
  functionAppName: 'xxx'

  # Environment name
  environmentName: 'xxx'

  # Agent VM image name
  vmImageName: 'ubuntu-latest'

stages:
- stage: Build
  displayName: Build stage
  jobs:
  - job: Build
    displayName: Build
    pool:
      vmImage: $(vmImageName)

    steps:
    - task: NodeTool@0
      inputs:
        versionSpec: '10.x'
      displayName: 'Install Node.js'

    - script: |
        if [ -f extensions.csproj ]
        then
            dotnet build extensions.csproj --runtime ubuntu.16.04-x64 --output ./bin
        fi
      displayName: 'Build extensions'

    - script: |
        npm install
        npm run build --if-present
        npm run test --if-present
      displayName: 'Prepare binaries'

    - task: ArchiveFiles@2
      displayName: 'Archive files'
      inputs:
        rootFolderOrFile: '$(System.DefaultWorkingDirectory)'
        includeRootFolder: false
        archiveType: zip
        archiveFile: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip
        replaceExistingArchive: true

    - upload: $(Build.ArtifactStagingDirectory)/$(Build.BuildId).zip
      artifact: drop

- stage: Deploy
  displayName: Deploy stage
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: Deploy
    displayName: Deploy
    environment: $(environmentName)
    pool:
      vmImage: $(vmImageName)
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureCLI@2
            inputs:
              azureSubscription: '$(azureSubscription)'
              scriptType: 'bash'
              scriptLocation: 'inlineScript'
              inlineScript: |
                 agentIP=$(curl -s https://api.ipify.org/)
                 az functionapp config access-restriction add -g xxx -n xxx --action Allow --ip-address $agentIP --priority 200
          - task: AzureFunctionApp@1
            displayName: 'Azure Functions App Deploy: xxx'
            inputs:
              azureSubscription: '$(azureSubscription)'
              appType: functionAppLinux
              appName: $(functionAppName)
              package: '$(Pipeline.Workspace)/drop/$(Build.BuildId).zip'

Is anyone able to advise where I am going wrong?

HLT · Accepted Answer · 2022-06-16 22:21:38Z

5

I found the solution to this. Function Apps have two IP Restriction sections, one for the App and one for the SCM site. The SCM site is the one that requires the IP to be whitelisted in order for the deployment to work:

az functionapp config access-restriction add --scm-site true -g xxx -n xxx --action Allow --ip-address $agentIP --priority 200

answered Jun 16, 2022 at 22:21

HLT

6072 gold badges8 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

David Espinel · Accepted Answer · 2022-06-15 14:51:06Z

2

I've had a simmilar issue while adding the agent IP to the network restrictions of an storage account (using Powershell but you'll understand the idea), we added a 60s sleep to be sure that the setting are taken into account by Azure.

$sa_name = "sapricer$env_prefix"
if ($null -ne (Get-AzStorageAccount -ResourceGroupName $sa_rg -AccountName $sa_name -ErrorAction Ignore)) {
    Write-Output "Storage account '$sa_name' exists"
    if ($enable) {
        Write-Output "Add ip rule for $current_ip on $sa_name..."
        Add-AzStorageAccountNetworkRule -ResourceGroupName $sa_rg -AccountName $sa_name -IPAddressOrRange $current_ip
    }
    else {        
        Write-Output "Remove ip rule for $current_ip on $sa_name..."
        Remove-AzStorageAccountNetworkRule -ResourceGroupName $sa_rg -AccountName $sa_name -IPAddressOrRange $current_ip
    }
}

Start-Sleep -Seconds 60

answered Jun 15, 2022 at 14:51

David Espinel

211 bronze badge

1 Comment

HLT Over a year ago

Thanks David, I tried adding a 5 minute sleep but it still fails on the same error.

SaiSakethGuduru · Accepted Answer · 2022-06-15 09:28:41Z

-1

You can deploy Azure function app to azure devops pipeline using azure function app task from Azure devops pipeline tasks Here is the sample snippet for deploying azure function app

variables:
  azureSubscription: Contoso
  # To ignore SSL error, uncomment the below variable
  # VSTS_ARM_REST_IGNORE_SSL_ERRORS: true

steps:
- task: AzureFunctionApp@1
  displayName: Azure Function App Deploy
  inputs:
    azureSubscription: $(azureSubscription)
    appName: samplefunctionapp
    package: $(System.DefaultWorkingDirectory)/**/*.zip

Here is the Microsoft Document for deploying azure function app.

answered Jun 15, 2022 at 9:28

SaiSakethGuduru

2,4651 gold badge8 silver badges17 bronze badges

Collectives™ on Stack Overflow

Azure devops deploy to function app with access restrictions

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related