Skip to content

Recognize identity-based AzureWebJobsStorage settings - #408

Open
Gabriel Bider (silkfire) wants to merge 1 commit into
Azure:masterfrom
silkfire:fix/identity-based-host-storage
Open

Gabriel Bider (silkfire) wants to merge 1 commit into
Azure:masterfrom
silkfire:fix/identity-based-host-storage

Conversation

@silkfire

Copy link
Copy Markdown

Fixes #407.

Problem

The host storage check only looked for AzureWebJobsStorage and AzureWebJobsStorage__accountName. Apps using the URI-based identity configuration (AzureWebJobsStorage__blobServiceUri, __queueServiceUri, __tableServiceUri, ...) got a false-positive warning:

Neither AzureWebJobsStorage nor AzureWebJobsStorage__accountName exist in app settings...

On Flex Consumption the settings are never read (deployment goes through Kudu api/publish), so there the warning is purely cosmetic. On the run-from-package path, however, the publisher built https://undefined.blob.core.windows.net when only the URI-based settings were present.

Changes

  • New HostStorage helper (src/utils/host_storage.ts):
    • isConfigured() treats AzureWebJobsStorage or any non-empty AzureWebJobsStorage__* setting as configured host storage.
    • getBlobServiceUri() prefers AzureWebJobsStorage__blobServiceUri, falling back to the endpoint derived from AzureWebJobsStorage__accountName.
  • resourceValidator.ts uses isConfigured() in both the RBAC (ARM) and SCM (Kudu) paths, and passes AzureWebJobsStorage__blobServiceUri through IAppSettings. The warning text now mentions the identity-based settings.
  • websiteRunFromPackageDeploy.ts uses getBlobServiceUri() and throws a clear AzureResourceError when no blob endpoint can be determined, instead of building an undefined endpoint.
  • Unit tests for the helper in tests/utils/host_storage.spec.ts.

Testing

  • tsc --project tsconfig.prod.json --noEmit passes.
  • npm test: 96 passing, including the new helper tests.
  • Not verified end to end against a real non-Flex app using __blobServiceUri; there are no existing tests for resourceValidator or the publisher.

The host storage warning only checked AzureWebJobsStorage and
AzureWebJobsStorage__accountName, so apps using the URI-based identity
configuration (__blobServiceUri, __queueServiceUri, etc.) got a false
positive warning.

Treat any AzureWebJobsStorage__* setting as configured host storage, and
let the run-from-package publisher use AzureWebJobsStorage__blobServiceUri
for blob access, failing with a clear error instead of building an
'undefined' endpoint when no blob endpoint can be determined.
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False-positive AzureWebJobsStorage warning with URI-based managed identity configuration

1 participant