azurerm_linux_web_app docker settings silently deleted on update

[UntiIted]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.6.0

AzureRM Provider Version

3.75.0

Affected Resource(s)/Data Source(s)

azurerm_linux_web_app

Terraform Configuration Files

terraform {
  required_version = ">=1.3.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

data "azurerm_container_registry" "this" {
  name                = "example"
  resource_group_name = "example"
}


data "azurerm_service_plan" "this" {
  name                = "example"
  resource_group_name = "example"

}

resource "azurerm_linux_web_app" "this" {
  name                = "docker-test-service"
  resource_group_name = data.azurerm_service_plan.this.resource_group_name
  location            = data.azurerm_service_plan.this.location
  service_plan_id     = data.azurerm_service_plan.this.id

  https_only                = true
  client_affinity_enabled   = false

  site_config {
    always_on         = "true"
    ftps_state        = "Disabled"
    use_32_bit_worker = true

    application_stack {
      docker_image_name        = "hello-world:latest"
      docker_registry_url      = "https://${data.azurerm_container_registry.this.login_server}"
      docker_registry_username = data.azurerm_container_registry.this.admin_username
      docker_registry_password = data.azurerm_container_registry.this.admin_password
    }
  }

  app_settings = {
    ExampleVar = "ExampleValue"
  }

  lifecycle {
    ignore_changes = [ 
      site_config[0].application_stack[0].docker_image_name,
      app_settings
    ]
  }
}

Debug Output/Panic Output

1st plan:

Terraform will perform the following actions:

  # azurerm_linux_web_app.this will be created
  + resource "azurerm_linux_web_app" "this" {
      + app_settings                      = {
          + "ExampleVar" = "ExampleValue"
        }
      + client_affinity_enabled           = false
      + client_certificate_enabled        = false
      + client_certificate_mode           = "Required"
      + custom_domain_verification_id     = (sensitive value)
      + default_hostname                  = (known after apply)
      + enabled                           = true
      + hosting_environment_id            = (known after apply)
      + https_only                        = true
      + id                                = (known after apply)
      + key_vault_reference_identity_id   = (known after apply)
      + kind                              = (known after apply)
      + location                          = "westeurope"
      + name                              = "docker-test-service"
      + outbound_ip_address_list          = (known after apply)
      + outbound_ip_addresses             = (known after apply)
      + possible_outbound_ip_address_list = (known after apply)
      + possible_outbound_ip_addresses    = (known after apply)
      + public_network_access_enabled     = true
      + resource_group_name               = "***"
      + service_plan_id                   = "/subscriptions/***/resourceGroups/***/providers/Microsoft.Web/serverfarms/***"
      + site_credential                   = (sensitive value)
      + zip_deploy_file                   = (known after apply)

      + site_config {
          + always_on                               = true
          + container_registry_use_managed_identity = false
          + default_documents                       = (known after apply)
          + detailed_error_logging_enabled          = (known after apply)
          + ftps_state                              = "Disabled"
          + health_check_eviction_time_in_min       = (known after apply)
          + http2_enabled                           = false
          + linux_fx_version                        = (known after apply)
          + load_balancing_mode                     = "LeastRequests"
          + local_mysql_enabled                     = false
          + managed_pipeline_mode                   = "Integrated"
          + minimum_tls_version                     = "1.2"
          + remote_debugging_enabled                = false
          + remote_debugging_version                = (known after apply)
          + scm_minimum_tls_version                 = "1.2"
          + scm_type                                = (known after apply)
          + scm_use_main_ip_restriction             = false
          + use_32_bit_worker                       = false
          + vnet_route_all_enabled                  = false
          + websockets_enabled                      = false
          + worker_count                            = (known after apply)

          + application_stack {
              + docker_image_name        = "hello-world:latest"
              + docker_registry_password = (sensitive value)
              + docker_registry_url      = "https://***.azurecr.io"
              + docker_registry_username = "***"
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

2nd plan:

Terraform will perform the following actions:

  # azurerm_linux_web_app.this will be updated in-place
  ~ resource "azurerm_linux_web_app" "this" {
        id                                = "/subscriptions/***/resourceGroups/***/providers/Microsoft.Web/sites/docker-test-service"
        name                              = "docker-test-service"
        tags                              = {}
        # (19 unchanged attributes hidden)

      ~ site_config {
          ~ use_32_bit_worker                       = false -> true
            # (21 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behaviour

Docker app settings (DOCKER_REGISTRY_SERVER_PASSWORD DOCKER_REGISTRY_SERVER_URL DOCKER_REGISTRY_SERVER_USERNAME) are unchanged.

Actual Behaviour

Docker app settings are silently deleted.

Steps to Reproduce

1. Terraform apply - create an app service with docker application_stack settings set
2. Assert the app service has the docker settings
3. Change any irrelevant setting so terraform detects infrastructure changes on the app service
4. Terraform apply - terraform will report that it will only change the irrelevant settings
5. Assert the app service docker settings have been deleted

Important Factoids

No response

References

No response

[UntiIted]

Slots and windows web apps are likely affected as well.
Issue happens regardless of what is set in ignore_changes

[xiaxyi]

Thanks @UntiIted for raising this issue, I noticed the property use_32_bit_worker was changed during the second apply, I happen to met another similar issue relates to java app stack, so would you mind letting me know if the docker setting will be removed if you set the use_32_bit_worker explicitly to false?

[UntiIted]

use_32_bit_worker was changed intentionally so the plan detects that it must make some changes to the web app. This setting doesn't matter specifically, and it doesn't matter what you change, the only requirement is that the web app is modified.

[cleverer]

I think this might be a duplicate of #23632?

[UntiIted]

I think this might be a duplicate of #23632?

Not exactly the same behaviour I observed likely because in our deployment the application stack is ignored, but it could have the same root cause.

The workaround we're using is specifying docker settings in app settings explicitly (and not ignoring the app settings), but it's not ideal and still detects changes (although it doesn't delete the settings).

And this doesn't really matter but I don't know if calling the issue a duplicate is correct when it's older.

[cleverer]

Not exactly the same behaviour I observed likely because in our deployment the application stack is ignored, but it could have the same root cause.

As far as I can tell: not exactly the same symptoms, but same root cause.

The workaround we're using is specifying docker settings in app settings explicitly (and not ignoring the app settings), but it's not ideal and still detects changes (although it doesn't delete the settings).

We do the same but only when we actually change some settings. But it is obviously error prone, and we frequently forget it which is very annoying.

And this doesn't really matter but I don't know if calling the issue a duplicate is correct when it's older.

Oh totally agree… I'v been tracking that issue for quite some time now (in #22379 and #22003 (comment)) and only noticed #23632 first so my bad for calling the wrong one the duplicate 😅
But the other ticket has some nice investigation regardless.

(Edit: oh and I see, you were part of that discussion already too, hi again 👋 )

[Jeinhaus]

app_settings and sticky_settings are also affected. This is very annoying, when using the azurerm_app_service_connection which e.g. adds AZURE_POSTGRESQL_HOST and other settings, that will be removed in subsequent runs (which also breaks the service_connection (values there appear empty)).
I don't know of any workaround, so I'm kind of stuck here.

[detaybey]

Same thing here, when I apply changes DOCKER_REGISTRY_SERVER_PASSWORD, DOCKER_REGISTRY_SERVER_URL and DOCKER_REGISTRY_SERVER_USERNAME is being added, and when I execute plan, I see these changes as an addition again! Looks like it does not persist the states!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.