Pipeline 'azure-functions-deploy' failing because it can't find resource group

[David Gard]

When trying deploy an Azure Function via a pipeline, I'm seeing the following error -

✖ Could not get the resource group associated with function my-function-app.

I used a snippet from readme file of the azure-function-deploy pipeline in my YAML file, so hopefully I'm not missing anything. I'm using version 1.0.1.

Is anyone able to suggest what may be going wrong, or how I can further investigate the issue?

Here is my pipeline YAML file -

image: microsoft/dotnet:sdk

pipelines:
  custom:
    deploy:
      - step:
          name: Build WitchHunt
          caches:
            - dotnetcore
          script:
            - dotnet restore
            - dotnet build $PROJECT_NAME
            - apt-get update
            - apt-get install zip -y
            - zipfile="myapp.zip"
            - dir="packages"
            - mkdir $dir
            - zip -r $zipfile $dir
      - step:
          name: Deploy Function App to Azure
          script:
            - pipe: microsoft/azure-functions-deploy:1.0.1
              variables:
                AZURE_APP_ID: $AZURE_APP_ID
                AZURE_PASSWORD: $AZURE_PASSWORD
                AZURE_TENANT_ID: $AZURE_TENANT_ID
                FUNCTION_APP_NAME: $FUNCTION_APP_NAME
                ZIP_FILE: packages/myapp.zip
                DEBUG: "false"

[luis-bautista]

In desired subscription you can add service principal as contributor and all works!

[Rob van der Velden]

Alternatively, you could use Microsofts Azure-Cli docker container and script the steps yourself.

azureDeployment: &azureDeployment
  image: mcr.microsoft.com/azure-cli
  script:
    - az login --service-principal --username $MY_CLIENT_ID --password $MY_CLIENT_SECRET --tenant $MY_TENANT_ID
    - if [ ! -z "$MY_SUBSCRIPTION_ID" ]; then az account set --subscription $MY_SUBSCRIPTION_ID; fi
    - az functionapp deployment source config-zip  -g "my-resource-group-name" -n "my-azure-function" --src "publish.zip"

[David Gard]

I believe I know the answer here, and it looks as though it's because of an inadequacy with how the azure-functions-deploy pipe works.

The 'AZURE_APP_ID' that I was using was for a Service Principal that could see resources in more than one Subscription. Looking at the output, I could see the following -

++ az login --service-principal --username $AZURE_APP_ID --password $AZURE_PASSWORD --tenant $AZURE_TENANT
++ az resource list -n $FUNCTION_APP_NAME --resource-type Microsoft.Web/Sites --query '[0].resourceGroup'

This means that the first Subscription was selected, and so my Function App was not found, leading to the error about the Resource Group not being found.

What I believe the pipe should do is log in to Azure, set the desired Subscription, and then look for the Resource Group to which the Function App belongs -

az login --service-principal --username $AZURE_APP_ID --password $AZURE_PASSWORD --tenant $AZURE_TENANT
az account set --subscription $AZURE_SUBSCRIPTION
az resource list -n $FUNCTION_APP_NAME --resource-type Microsoft.Web/Sites --query '[0].resourceGroup'

In this case, I had to create a new Service Principal and ensure that it could only see resources in one Subscription.