RFC: Microsoft.Web/sites should retain existing app configuration over deployment

[Janne Kujanpää (jikuja)]

I would like to start a discussion if Microsoft.Web/sites should retain existing app config and I'll provide a quick proof-of-concept for implementation ideas.

Why to retain app config

• Developer experience
  • Allow function app developers to tweak configuration on portal without any fears that inrastructure re-deployment will delete all the new settings
  • Allow to re-deploy infrastructure code without redeploying function app code (and config)
• WEBSITE_RUN_FROM_PACKAGE application config
  • required for some use cases: https://learn.microsoft.com/en-us/azure/azure-functions/run-functions-from-deployment-package#enable-functions-to-run-from-a-package
  • especially needed for linux consumption plan: URL with a remove location
    • current template re-deployment will remove this setting => functions does not exist anymore

Why not to retain app config

• Configuration of the resource will be different than template parameters
• Other reason?

The proper solution

Resource provider should have two set of configuration:

• infrastructure-specific settings: APPINSIGHTS_INSTRUMENTATIONKEY, APPLICATIONINSIGHTS_CONNECTION_STRING, AzureWebJobsStorage, AzureWebJobsDashboard and others selected to be maintained by infrastructure team
• application development -specific setting: all the settings used and maintained by application developers

Solution with templating

Proof-of-concept

This is really naive solution to persist app config over deployment using Bicep only:

diff --git a/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/deploy.bicep b/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/deploy.bicep
index 7624cbb..ceb99ff 100644
--- a/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/deploy.bicep
+++ b/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/deploy.bicep
@@ -29,6 +29,9 @@ param appSettingsKeyValuePairs object = {}
 @description('Optional. Enable telemetry via a Globally Unique Identifier (GUID).')
 param enableDefaultTelemetry bool = true
 
+@description('Optional. Existing function app configuration')
+param existingConfig object = {}
+
 // =========== //
 // Variables   //
 // =========== //
@@ -43,7 +46,13 @@ var appInsightsValues = !empty(appInsightId) ? {
   APPLICATIONINSIGHTS_CONNECTION_STRING: appInsight.properties.ConnectionString
 } : {}
 
-var expandedAppSettings = union(appSettingsKeyValuePairs, azureWebJobsValues, appInsightsValues)
+var filteredExistingConfig_ = [for item in items(existingConfig): item.key != 'APPINSIGHTS_INSTRUMENTATIONKEY' && item.key != 'APPLICATIONINSIGHTS_CONNECTION_STRING' && item.key != 'AzureWebJobsStorage' && item.key != 'AzureWebJobsDashboard' ? {
+  '${item.key}': item.value
+} : {}]
+var filteredExistingConfig = reduce(filteredExistingConfig_, {}, (cur, next) => union(cur, next))
+
+// TODO: add parameter to control appSettingsKeyValuePairs or filteredExistingConfig has higher preference
+var expandedAppSettings = union(appSettingsKeyValuePairs, filteredExistingConfig, azureWebJobsValues, appInsightsValues)
 
 // =========== //
 // Existing resources //
diff --git a/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/existing-config.bicep b/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/existing-config.bicep
new file mode 100644
index 0000000..804b0c2
--- /dev/null
+++ b/FunctionAppV2/template/Microsoft.Web/sites/config-appsettings/existing-config.bicep
@@ -0,0 +1,13 @@
+param parent string
+
+resource existingapp 'Microsoft.Web/sites@2022-03-01' existing = {
+  name: parent
+}
+
+resource existingConfig 'Microsoft.Web/sites/config@2022-03-01' existing = {
+  name: 'appsettings'
+  parent: existingapp
+}
+
+output existingConfig object = existingConfig.list()
+
diff --git a/FunctionAppV2/template/Microsoft.Web/sites/deploy.bicep b/FunctionAppV2/template/Microsoft.Web/sites/deploy.bicep
index f53b66c..5c9a617 100644
--- a/FunctionAppV2/template/Microsoft.Web/sites/deploy.bicep
+++ b/FunctionAppV2/template/Microsoft.Web/sites/deploy.bicep
@@ -122,7 +122,7 @@ param diagnosticEventHubName string = ''
   'AppServicePlatformLogs'
   'FunctionAppLogs'
 ])
-param diagnosticLogCategoriesToEnable array = kind == 'functionapp' ? [
+param diagnosticLogCategoriesToEnable array = contains(kind, 'functionapp') ? [
   'FunctionAppLogs'
 ] : [
   'AppServiceHTTPLogs'
@@ -221,6 +221,13 @@ resource app 'Microsoft.Web/sites@2021-03-01' = {
   }
 }
 
+module existingConfig 'config-appsettings/existing-config.bicep' = {
+  name: '${uniqueString(deployment().name, location)}-Existing-Site-Config'
+  params: {
+    parent: app.name
+  }
+}
+
 module app_appsettings 'config-appsettings/deploy.bicep' = if (!empty(appSettingsKeyValuePairs)) {
   name: '${uniqueString(deployment().name, location)}-Site-Config-AppSettings'
   params: {
@@ -231,6 +238,7 @@ module app_appsettings 'config-appsettings/deploy.bicep' = if (!empty(appSetting
     setAzureWebJobsDashboard: setAzureWebJobsDashboard
     appSettingsKeyValuePairs: appSettingsKeyValuePairs
     enableDefaultTelemetry: enableReferencedModulesTelemetry
+    existingConfig: existingConfig.outputs.existingConfig.properties
   }
 }
 

Proof-of-concept explanation

1. On deploy.bicep fetch existing configuration with config-appsettings/existing-config.bicep module
2. Pass existing configuration to config-appsettings/deploy.bicep
3. Use existing configurtion on config-appsettings/deploy.bicep:
4. Filter out settings created by config-appsettings/deploy.bicep

var filteredExistingConfig_ = [for item in items(existingConfig): item.key != 'APPINSIGHTS_INSTRUMENTATIONKEY' && item.key != 'APPLICATIONINSIGHTS_CONNECTION_STRING' && item.key != 'AzureWebJobsStorage' && item.key != 'AzureWebJobsDashboard' ? {
  '${item.key}': item.value
} : {}]
var filteredExistingConfig = reduce(filteredExistingConfig_, {}, (cur, next) => union(cur, next))

5. Merge user-supplied, existing and templated generated configs:

var expandedAppSettings = union(appSettingsKeyValuePairs, filteredExistingConfig, azureWebJobsValues, appInsightsValues)

Open questions

• Is this needed?
• Alternative solutions? (I already have a CI/CD extension that handles WEBSITE_RUN_FROM_PACKAGE but I don't like that)
• What kind of controls should be provided for this feature:
  • On/Off
  • Retain only WEBSITE_RUN_FROM_PACKAGE
  • Retain user-supplied list of configuration values
  • Rewrite/remove user-supplied list of configuration values
  • User-supplied control to selection priority of filteredExistingConfig and appSettingsKeyValuePairs
• Slots
• Anything else

[Mikko Kärkkäinen (mikkark)]

This is very much needed. I have been wondering about this for ages. I have not come up with any workaround so whenever I deploy my infrastructure I deploy my Function App code straight after.... not convenient at all.

[Janne Kujanpää (jikuja)]

I deploy my infrastructure I deploy my Function App code straight after.... not convenient at all.

I did that also and a few times I did not wait long enough between deployments => functions were not found by the runtime after code deployment.

[Erika Gressi (eriqua)]

Hi Janne Kujanpää (@jikuja), Mikko Kärkkäinen (@mikkark),
Thanks for raising this.
We've moved this discussion to the backlog as a feature request in order for the team to triage it.
Going forward, the progress will be tracked by issue #2578