Why does telemetry show multiple 401 errors when calling /admin/host/drain

Brian Kuhn 0 Microsoft Employee

I have deployed an Azure dotnet 8 isolated function app to a Linux Flex Consumption plan. Function application runs correctly, but when I examine the application insights telemetry, I am seeing a large number of errors; all of them for the POST /admin/host/drain operation.

User's image

Example transaction:
User's image

The Admin API documentation indicates that hitting the URLs require the functions' master key to be passed in the header as x-functions-key. I am not making these calls, I believe they are being performed by the flex consumption plan scaler.

How do I configure my function application such that the admin api calls are authenticated successfully?

Brian Kuhn 0 Microsoft Employee

I located the implementation of /admin/host/drain, which is in the HostController, where the authorization is defined by [Authorize(Policy = PolicyNames.AdminAuthLevelOrInternal)]

The actual policy implementation is:

options.AddPolicy(PolicyNames.AdminAuthLevelOrInternal, p =>
            {
                p.AddScriptAuthenticationSchemes();
                p.RequireAssertion(async c =>
                {
                    if (c.Resource is AuthorizationFilterContext filterContext)
                    {
                        if (!CheckPlatformInternal(filterContext.HttpContext, allowAppServiceInternal: true))
                        {
                            return false;
                        }
                        if (filterContext.HttpContext.Request.IsAppServiceInternalRequest())
                        {
                            return true;
                        }
                        var authorizationService = filterContext.HttpContext.RequestServices.GetRequiredService<IAuthorizationService>();
                        AuthorizationResult result = await authorizationService.AuthorizeAsync(c.User, PolicyNames.AdminAuthLevel);
                        return result.Succeeded;
                    }
                    return false;
                });
            });

What is puzzling to me is that I see successful calls in my telemetry to GET /admin/host/status which has the same policy applied to it.

The only difference I can see is the host of the Url, when successful it is my function app DNS name, when it is failing it is a specific IP address and port.

Brian Kuhn 0 Reputation points Microsoft Employee

2024-09-18T14:17:40.3833333+00:00

I found the implementation of the Admin Drain API at https://github.com/Azure/azure-functions-host/blob/release/4.x/src/WebJobs.Script.WebHost/Controllers/HostController.cs#L191.

What is puzzling to me is that I see successful calls to GET /admin/host/status but all of the calls to POST /admin/host/drain fail, but they both have the same authorization policy.

The only difference is that according to telemetry, the get of host status uses my function DNS name, but the drain call is using a specific IP address and port.

Would that be causing the authorization policy checks to fail?

Share via

Why does telemetry show multiple 401 errors when calling /admin/host/drain

Your answer