Open Mechanolatry opened 4 months ago
Experiencing the same issue with vnetRouteAllEnabled
on windows_function_app as well.
Experiencing the same issue. Any dates for the fix to be available?
Having same issue. Using the required attributes only, on the first run it will deploy the app, but on subsequent run it gives this error. If I try to add the code to set the attribute it gives this error and doesn't deploy at all.
Experiencing the same issue. Any dates for the fix to be available?
@JosiahSiegel , can you help on this issue?
Experiencing the same issue with
vnetRouteAllEnabled
on windows_function_app as well.
@PG-RichT we face this issue with azurerm_windows_web_app
. This was the response from the App Service product group:
If customers are unable to set route all enabled to true, that is because the setting is already true and they are just seeing an issue with our API. There is a potential issue here is that certain portal operations might actually set it to false while they are in this state. Customers can mitigate by setting it to false properly and then back to true. Either through an ARM template, or by ticking another checkbox and saving it.
We're expiriencing this issue with as well with azurerm_linux_web_app_slot
, with azurerm_linux_web_app
it works as intended. Currently working around the issue like this:
lifecycle {
ignore_changes = [
site_config[0].vnet_route_all_enabled
]
}
We are using this as a work around for the time being until a fix is released. Posting here in-case it helps someone.
lifecycle { ignore_changes = [site_config["VnetRouteAllEnabled"], ] }
I expect VnetRouteAllEnabled
can be replaced with any problem parameter like PublicNetworkAccess
I think the issue is whenever we touch site_config... Im having a very similar issue but with creating LA's, not updating... so have just raised #25891
I also just hit the same error trying to add vnet_integration to the logic app standard. That attribute is not within the site_config but did give the site_config conflict error. Working around by ignoring these settings, but have to manually set the network how I want it, which is not a scalable solution.
Can we get a "BUG" label added?
I also just hit the same error trying to add vnet_integration to the logic app standard. That attribute is not within the site_config but did give the site_config conflict error. Working around by ignoring these settings, but have to manually set the network how I want it, which is not a scalable solution.
Can we get a "BUG" label added?
Hmm we managed to do vnet integration in some other code we have, are you sure you don't have any site_config stuff going on? We just had to comment out the whole site_config section to make it work.
I also just hit the same error trying to add vnet_integration to the logic app standard. That attribute is not within the site_config but did give the site_config conflict error. Working around by ignoring these settings, but have to manually set the network how I want it, which is not a scalable solution. Can we get a "BUG" label added?
Hmm we managed to do vnet integration in some other code we have, are you sure you don't have any site_config stuff going on? We just had to comment out the whole site_config section to make it work.
Did you run the code again? Was the resource already deployed when you tried adding the vnet afterwards? It does seem to work fine first deploy, but subsequent runs hit the error in my experience
I am currently using azurerm v3.94.0, and this is also affecting windows function apps:
│ Error: updating Windows App Service (Subscription: "***"
│ Resource Group Name: "***"
│ Site Name: "***"): performing CreateOrUpdate: unexpected status 400 with response: {"Code":"BadRequest","Message":"There was a conflict. SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property.","Target":null,"Details":[{"Message":"There was a conflict. SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property."},{"Code":"BadRequest"},{"ErrorEntity":{"ExtendedCode":"01020","MessageTemplate":"There was a conflict. {0}","Parameters":["SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property."],"Code":"BadRequest","Message":"There was a conflict. SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property."}}],"Innererror":null}
│
│ with module.windows_func_app["001"].azurerm_windows_function_app.windows_function_app,
│ on .terraform/modules/windows_func_app/main.tf line 12, in resource "azurerm_windows_function_app" "windows_function_app":
│ 12: resource "azurerm_windows_function_app" "windows_function_app" {
│
│ updating Windows App Service (Subscription:
│ "***"
│ Resource Group Name: "***"
│ Site Name: "***"): performing CreateOrUpdate:
│ unexpected status 400 with response: {"Code":"BadRequest","Message":"There
│ was a conflict. SiteConfig.PublicNetworkAccess cannot be modified. Please
│ modify the Site.PublicNetworkAccess
│ property.","Target":null,"Details":[{"Message":"There was a conflict.
│ SiteConfig.PublicNetworkAccess cannot be modified. Please modify the
│ Site.PublicNetworkAccess
│ property."},{"Code":"BadRequest"},{"ErrorEntity":{"ExtendedCode":"01020","MessageTemplate":"There
│ was a conflict. {0}","Parameters":["SiteConfig.PublicNetworkAccess cannot
│ be modified. Please modify the Site.PublicNetworkAccess
│ property."],"Code":"BadRequest","Message":"There was a conflict.
│ SiteConfig.PublicNetworkAccess cannot be modified. Please modify the
│ Site.PublicNetworkAccess property."}}],"Innererror":null}
"Historically, we have also had two of the networking settings in site config properties, namely vnetRouteAllEnabled and publicNetworkAccess. Again, because of the limitations to control via policy, we have been introducing these properties as site properties. For a while they have been modifiable in both places, but we will start enforcing that you can only modify the setting using the site property and you may see an error message like this: “SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property”. If you see this error you will need to update your scripts or templates to use the site property equivalent."
There is a change on Microsoft API a few days ago: https://azure.github.io/AppService/2024/04/23/Networking-compliance-improvements.html
Please upvote this Terraform issue as well for visibility: https://github.com/hashicorp/terraform-provider-azurerm/issues/25824
"Historically, we have also had two of the networking settings in site config properties, namely vnetRouteAllEnabled and publicNetworkAccess. Again, because of the limitations to control via policy, we have been introducing these properties as site properties. For a while they have been modifiable in both places, but we will start enforcing that you can only modify the setting using the site property and you may see an error message like this: “SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property”. If you see this error you will need to update your scripts or templates to use the site property equivalent."
There is a change on Microsoft API a few days ago: https://azure.github.io/AppService/2024/04/23/Networking-compliance-improvements.html
Problem is not all resourses have the "site" property. Standard logic app does not have the property for instance. But it still throws the error for that property.
"Historically, we have also had two of the networking settings in site config properties, namely vnetRouteAllEnabled and publicNetworkAccess. Again, because of the limitations to control via policy, we have been introducing these properties as site properties. For a while they have been modifiable in both places, but we will start enforcing that you can only modify the setting using the site property and you may see an error message like this: “SiteConfig.PublicNetworkAccess cannot be modified. Please modify the Site.PublicNetworkAccess property”. If you see this error you will need to update your scripts or templates to use the site property equivalent." There is a change on Microsoft API a few days ago: https://azure.github.io/AppService/2024/04/23/Networking-compliance-improvements.html
Problem is not all resourses have the "site" property. Standard logic app does not have the property for instance. But it still throws the error for that property.
Wrote this here only for awareness and reference. Resource neds to be updated to suport this change.
Can you please assign this issue to me
Is there an existing issue for this?
Community Note
Terraform Version
1.8.2
AzureRM Provider Version
3.101.0
Affected Resource(s)/Data Source(s)
azurerm_logic_app_standard
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Logic_App_Standard resource should apply with any (valid) changes made to the resource block.
Actual Behaviour
After initial Apply creating the resource, any subsequent apply that requires the resource to be updated causes the above error and fails to update the resource.
Steps to Reproduce
Important Factoids
No response
References
The following PR resolves this issue for other resources based on the Microsoft.Web/Sites resources/API
25794 Update various files to not set SiteConfig.PublicNetworkAccess
Issue below (On a different resource) may also be related
25818 May also be related