Azure function key invalid after swapping slots

Question

Our Azure FunctionApp (V3) has two slots: the default one and the "warm-up" slot. We deploy to "warm-up" and then swap the slots with this Azure DevOps task:

- task: AzureAppServiceManage@0
    displayName: Swap slots
    inputs:
        azureSubscription: XXX
        Action: 'Swap Slots'
        WebAppName: XXX
        ResourceGroupName: XXX
        SourceSlot: warm-up

One of our functions has AuthorizationLevel.Function. During the deployment and slot swap I use the following code to get this function's current default Function Key:

(Invoke-AzResourceAction `
 -Action listKeys `
 -ResourceType 'Microsoft.Web/sites/functions/' `
 -ResourceGroupName XXX `
 -ResourceName "XXX/MY-FUNC-NAME" `
 -Force).default

This is what I observe during the deployment process:

• Deployment to "warm-up" slot: the key is correct.
• Warming-up slots: the key is correct.
• Swapping App Service 'XXX' slots (started): the key is correct.
• Swapping App Service 'XXX' slots (running): the key is incorrect for 5-10 seconds.
• Swapping App Service 'XXX' slots (finishing): the key is correct.
• Swapped App Service 'XXX' slots: the key is correct.
• <next ~30 seconds>: the key is correct.
• <after ~30 seconds>: the key is incorrect again, now forever.

When the key is "incorrect", it's actually the key of the "warm-up" slot, not of the default "production" slot. When I try to use this key to execute my function, it gives me 401 Unauthorized.

The Portal shows the same incorrect keys but only until I press the "Refresh" button which also somehow fixes the keys returned by the powershell command above. Looks like there are some race conditions or synchronization problems in the slot swapping logic.

Answer 1

Here is the workaround suggested by Azure Support: add WEBSITE_FUNCTIONS_ARMCACHE_ENABLED=0 to application settings and the problem should disappear.

Answer 2

Hello @Roman Nikitin , I did not hear from you. Did you check this : https://stackoverflow.com/questions/50246239/how-to-create-a-azure-function-function-key-when-your-functions-are-set-to-read

If you are still encountering the issue I would request you to open a support ticket with Microsoft Support if you have a subscription which allows you to do so. Otherwise ,you can send an email with subject line “Attn:Jaya” to AzCommunity[at]Microsoft[dot]com referencing this thread along with the subscription id.