Deployment Appears to Erase AppService Zip Deployment

[Mike-E-angelo]

I have a Bicep template that I have been authoring over the past few weeks for a system of AppServices that I have. I use a PowerShell script to deploy the Bicep template and create the infrastructure.

I then have Azure DevOps create a release and deploy the zip files to the AppServices created from the above.

My issue (that I just encountered) is that if I redeploy the Bicep template, it appears to erase the zip file of the Azure DevOps deployment, clearing the Deployment Center deployment.

That is, it appears each Bicep deployment clears all Deployment Center deployments. 💥

Is there a way to prevent this from happening? When I re-deploy a Bicep template I simply want to update the properties/values of the environment, not destroy anything.

Thank you for any assistance you can provide.

[Mike-E-angelo]

Is it expected to clear Deployment Center deployments on each Bicep deployment? 🤔 This seems a bit disruptive...

[kevball2]

Can you share your template?

[Mike-E-angelo]

Thank you for your assistance @kevball2. Here's the main one for your review. If you'd like the referenced templates let me know and I will get them for you, too:

param name string
param location string = resourceGroup().location
param planId string
param qualifier string = 'gateway'
param site object = { connections: {}, host: '', subdomain: '', settings: [] }
param slot object = {}
param client bool = true
param sourceSubscriptionId string
param sourceResourceGroupName string
param thumbprint string = '<ommitted>'

var qualified = '${name}-${qualifier}'
var additional = {
      ApplicationStateConnection: {
        value: 'Server=${name}${environment().suffixes.sqlServerHostname};Authentication=Active Directory Managed Identity;Encrypt=True;Database=<omitted>;Application Name=${qualifier}'
        type: 'SQLAzure'
      }
      ServiceBus__fullyQualifiedNamespace: {
        value: '${name}.servicebus.windows.net'
        type: 'Custom'
      }
    }
var primaryConnections = union(site.connections, additional)

resource subject 'Microsoft.Web/sites@2023-01-01' = {
  name: qualified
  location: location
  tags: { 'hidden-related:${resourceGroup().id}/providers/Microsoft.Web/serverfarms/appServicePlan': 'Resource' }
  kind: 'app'
  identity: { type: 'SystemAssigned' }
  properties: {
    enabled: true
    hostNameSslStates: [
      {
        name: '${qualified}.azurewebsites.net'
        sslState: 'Disabled'
        hostType: 'Standard'
      }
      {
        name: site.host
        sslState: 'SniEnabled'
        thumbprint: thumbprint
        hostType: 'Standard'
      }
      {
        name: '${qualified}.scm.azurewebsites.net'
        sslState: 'Disabled'
        hostType: 'Repository'
      }
    ]
    serverFarmId: planId
    reserved: false
    isXenon: false
    hyperV: false
    vnetRouteAllEnabled: false
    vnetImagePullEnabled: false
    vnetContentShareEnabled: false
    siteConfig: {
      numberOfWorkers: 1
      acrUseManagedIdentityCreds: false
      alwaysOn: true
      http20Enabled: true
      functionAppScaleLimit: 0
      minimumElasticInstanceCount: 1      
    }
    scmSiteAlsoStopped: false
    clientAffinityEnabled: true
    clientCertEnabled: false
    clientCertMode: 'Optional'
    hostNamesDisabled: false
    containerSize: 0
    dailyMemoryTimeQuota: 0
    httpsOnly: false
    redundancyMode: 'None'
    storageAccountRequired: false
    // virtualNetworkSubnetId: '${subnetId}/subnets/default'
    keyVaultReferenceIdentity: 'SystemAssigned'
  }

  resource ftp 'basicPublishingCredentialsPolicies' = {
    name: 'ftp'
    properties: {
      allow: false
    }
  }
  
  resource scm 'basicPublishingCredentialsPolicies' = {
    name: 'scm'
    properties: {
      allow: true
    }
  }  
  resource slotsettings 'config' = {
    name: 'slotConfigNames' 
    properties: {
      appSettingNames: [for i in filter(site.settings, x => x.slotSetting): i.name]
      connectionStringNames: [for i in items(primaryConnections): i.key]
    }
  }  
  resource config 'config' = {
    name: 'connectionstrings'
    properties: primaryConnections
  }

  resource configuration 'config' = {
    name: 'web'
    properties: {
      appSettings: [for i in site.settings: { name: i.name, value: i.value }]
      numberOfWorkers: 1
      defaultDocuments: ['Default.htm','Default.html','Default.asp','index.htm','index.html','iisstart.htm','default.aspx','index.php','hostingstart.html']
      netFrameworkVersion: 'v8.0'
      phpVersion: '5.6'
      requestTracingEnabled: false
      remoteDebuggingEnabled: false
      httpLoggingEnabled: false
      acrUseManagedIdentityCreds: false
      logsDirectorySizeLimit: 35
      detailedErrorLoggingEnabled: false
      publishingUsername: '$${qualified}'
      scmType: 'VSTSRM'
      use32BitWorkerProcess: false
      webSocketsEnabled: client
      alwaysOn: true
      managedPipelineMode: 'Integrated'
      virtualApplications: [
        {
          virtualPath: '/'
          physicalPath: 'site\\wwwroot'
          preloadEnabled: true
        }
      ]
      loadBalancing: 'LeastRequests'
      experiments: {
        rampUpRules: []
      }
      autoHealEnabled: true
      localMySqlEnabled: false
      
      scmIpSecurityRestrictionsUseMain: false
      http20Enabled: true
      minTlsVersion: '1.2'
      scmMinTlsVersion: '1.2'
      ftpsState: 'Disabled'
      preWarmedInstanceCount: 0
      elasticWebAppScaleLimit: 0
      functionsRuntimeScaleMonitoringEnabled: false
      minimumElasticInstanceCount: 1
      azureStorageAccounts: {}
    }
  }
}

module bindings 'bind/site.bicep' = {
  name: 'assign-bindings-${site.host}'
  params:{
    location: location
    name: qualified
    host: site.host
    planId: planId
    sourceSubscriptionId: sourceSubscriptionId
    sourceResourceGroupName: sourceResourceGroupName
    subdomain: site.subdomain
    verification: subject.properties.customDomainVerificationId
  }   
}

module secondarySlot 'slot.bicep'= if (!empty(slot)) {
  name: 'create-slot-${qualified}'
  params: {
    name: name
    location: location
    slotName: slot.name
    connections: union(slot.connections, additional)
    planId: planId
    settings: slot.settings
    sourceSubscriptionId: sourceSubscriptionId
    sourceResourceGroupName : sourceResourceGroupName
    client: client
    host: slot.host
    subdomain: slot.subdomain
    qualifier: qualifier
    verification: subject.properties.customDomainVerificationId
    thumbprint : thumbprint    
  }
  dependsOn: [bindings]
}

output verification string = subject.properties.customDomainVerificationId

[Mike-E-angelo]

Hi @kevball2 by asking for my template that seems to imply that the expected behavior is that Deployment Center deployments remain intact, is that correct?

[Mike-E-angelo]

Any thoughts on workarounds @kevball2? You're the only person who assisted me with this and this is surprising considering that a great deal of deployments (majority?) feature a web application of some sort. I would think a lot more people should be complaining about this. :)

[Mike-E-angelo]

As this seems like a bug, I have created an issue here to track: https://github.com/Azure/bicep/issues/13282

[jarz]

I don't use the Deployment Center functionality in my web apps, so I don't have any solid answers. However, it seems likely that the resource provider is removing things based on missing settings in the Bicep template.

I can think of two potential solutions: including the full configuration or marking it as an existing resource.

Full configuration would look something like this:

resource subject 'Microsoft.Web/sites@2023-01-01' = {
  name: qualified
  ...

  resource deploymentCenter 'config' = {
    name: 'metadata'
    properties: {
      CURRENT_STACK: 'dotnet'
      RepoUrl: 'https://org@dev.azure.com/org/project/_git/repo'
      subscription: subscription().subscriptionId
      VsoTfsImpersonate: 'something@live.com'
      CloneUri: 'https://org@dev.azure.com/org/project/_git/repo'
      branch: 'main'
    }
  }
}

Reference the existing settings:

resource subject 'Microsoft.Web/sites@2023-01-01' = {
  name: qualified
  ...

  resource deploymentCenter 'config' existing = {
    name: 'metadata'
  }
}

[Mike-E-angelo]

Thank you for your suggestions @jarz! They are greatly appreciated. I did try the existing settings route and that didn't seem to work, unfortunately. Does that existing tag actually command Bicep to import existing settings? As I understand it, I thought it was used only to reference an existing resource. 🤔

As for the full configuration, I am eyeballing it, but I unfortunately, do not know what to put for VsoTfsImpersonate. I did a search online and I wasn't able to find anything for this setting.

For more context here, I went through and re-exported my existing AppService as an ARM template and decompiled it to Bicep (this is what I did originally) to see if there is anything I missed.

There are dozens of these entries for both my production and staging slots. I deleted all of them as it was my understanding that they would actually create records in a new AppService (I think that's correct, still). However, they do have information about the repo, and now I am beginning to second-guess my understanding:

resource sites_starbeam_one_server_gateway_name_2024_01_18T21_23_15_1472510 'Microsoft.Web/sites/snapshots@2015-08-01' = {
  parent: sites_starbeam_one_server_gateway_name_resource
  name: '2024-01-18T21_23_15_1472510'
}

resource sites_starbeam_one_server_gateway_name_24291706212942996 'Microsoft.Web/sites/deployments@2023-01-01' = {
  parent: sites_starbeam_one_server_gateway_name_resource
  name: '24291706212942996'
  location: 'Central US'
  properties: {
    status: 4
    author: 'Mike-E-angelo'
    deployer: 'VSTS'
    message: '{"type":"SlotSwap","commitId":"...","buildId":"1730","releaseId":"2429","buildNumber":"20240125.1","releaseName":"Release-11","repoProvider":"TfsGit","repoName":"starbeam.one","collectionUrl":"https://dev.azure.com/.../","teamProject":"...","sourceSlot":"staging","targetSlot":"production"}'
    start_time: '2024-01-25T20:02:39.7223959Z'
    end_time: '2024-01-25T20:02:39.7223959Z'
    active: false
  }
}

I am thinking of using the existing route on Microsoft.Web/sites/deployments but it needs a name of an existing deployment. I am wondering if there is a way here to say "use all existing deployments" here. Any pointers here you can provide would be greatly appreciated. 👍

[Mike-E-angelo]

Woohoo! I figured it out! Wow it was a tricky one. The problem was that the WEBSITE_RUN_FROM_PACKAGE environmental variable was not set! I was thinking that DevOps would be responsible for setting this, and it does. However, when the Bicep deployment executes and this property is not part of the configured settings (and I do not merge them with existing) it gets erased.

I feel like a knucklehead now that I understand this but I am glad this is solved. Onto the next fire.

[kevball2]

Sorry for the late response. but glad you were able to sort this!