Debugging Azure Function App deployment failure in Azure DevOps pipeline: ZIP Deploy error with VNet-integrated app

Question

I'm encountering an error when deploying an Azure Function App (Python) through Azure DevOps pipelines. The app is VNet-integrated, and the deployment fails with a ZIP Deploy error. Here are the details:

Error message:

Got service connection details for Azure App Service:'func-****-dev' 

NOTE: Function app is VNet integrated. Updating App Service Application settings. 

Data: {"WEBSITES_ENABLE_APP_SERVICE_STORAGE":"true","WEBSITE_RUN_FROM_PACKAGE":"0"} App Service Application settings are already present. Package deployment using ZIP Deploy initiated. Fetching changes. Cleaning up temp folders from previous zip deployments and extracting pushed zip file /tmp/zipdeploy/******.zip (0.05 MB) to /tmp/zipdeploy/extracted 

##[error]Failed to deploy web package to App Service. ##[warning]Can't find loc string for key: KuduStackTraceURL ##[error]KuduStackTraceURL https://*****-dev__staging:***@func-****-dev-staging.scm.azurewebsites.net/api/vfs/LogFiles/kudu/trace ##[error]Error: Package deployment using ZIP Deploy failed. Refer logs for more details. Successfully added release annotation to the Application Insight : appi-*****-dev Successfully updated deployment History at https://*****-dev-staging.scm.azurewebsites.net/api/deployments/***** App Service Application URL: https://******-dev-staging.azurewebsites.net

We've identified that the issue was related to the requirements.txt file. Rolling back to an older version of the file (which included extra, unused packages) resolved the problem. However, we'd like to understand:

1. Why does this error occur, and how can we properly debug it in the future?
2. Is it possible to SSH into the SCM console for a VNet-integrated Function App? If so, what specific logs or areas should we investigate to troubleshoot similar issues?
3. Are there any best practices for managing requirements.txt for Azure Function Apps, especially when the app works locally but fails during deployment?
4. How can we reconcile the difference between local execution (which works fine) and deployment behavior?

Any insights or troubleshooting steps would be greatly appreciated. Thank you!

Answer 1

Hello Melvin !

Thank you for posting on Microsoft Learn Q&A.

When you ZIP deploy a python function to a Linux plan and let the platform build your app , Kudu tries to pip install -r requirements.txt during deployment. If your function app is VNet integrated outbound to PyPI can be blocked then the build fails.

https://learn.microsoft.com/en-us/azure/app-service/configure-vnet-integration-routing

If your requirements.txt includes packages that don’t have compatible wheels for the functions image, Oryx needs to compile themand deployments fail.

https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-python

I recommend that you build everything in the pipeline, ship a ready to run artifact, and keep runtime with the dependencies deterministic.

So pin python to the exact minor version your function app runs and build in that same version or container.

Then in CI, zip your code with .python_packages and deploy that ZIP

python -m pip install -r requirements.txt -t .python_packages/lib/site-packages

and on the app, set SCM_DO_BUILD_DURING_DEPLOYMENT=false

https://learn.microsoft.com/en-us/answers/questions/757750/azure-function-apps-oryx-build-continues-to-run-ev