Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Intermittent failure accessing the Kudu service and Kudu site for a Function App #2244

Closed
yutao-huang opened this issue Jan 23, 2018 · 2 comments

Comments

@yutao-huang
Copy link

commented Jan 23, 2018

OS and Browser
Windows 10 + Chrome

Repro steps

  1. Sign-in to the Azure Portal and open an existing function app that contains some functions
  2. Try to expand "Functions" node under this function app
  3. Sometimes the "Functions" node could not be expanded. I took a look at Chrome's Developer Tools' console window. It said "GET https://function_app_name.scm.azurewebsites.net/api/functions 403 (Forbidden)". But this didn't repro 100%. Sometimes I was able to expand the Functions node and open the existing functions.
  4. Sometimes when I was trying to load the Kudu site from the Platform Features tab, it opened a new tab but I got "You are not authorized or do not have any subscriptions associated with your account."
  5. For a few times even I was able to open the Kudu site and navigate to the debug console, it would suddenly redirect me to the same unauthorized page right in the middle and any further attempt to the Kudu site would fail with the same error.

Any error messages

Mention any other details that might be useful.

  • The failures are really intermittent. Even for the same function app, the above operations would sometimes fail and sometimes succeed.
  • I have "Owner" role of this Azure subscription so I think should have permission for the above operations, right?
  • P.S.: I have also tried using another credential (which has the "Service Administrator" role of the subscription) to sign-in and do all these things but haven't seen any problems so far. Would that matter?

Thanks!

@btardif btardif added this to the Sprint 19 milestone Feb 2, 2018

@btardif

This comment has been minimized.

Copy link
Member

commented Feb 2, 2018

@ahmelsayed Please add the data on the RCA so we can close

@ahmelsayed

This comment has been minimized.

Copy link
Contributor

commented Mar 16, 2018

The functions portal uses the scm endpoint of the apps for various queries about the app that allows the UI to work.

There was a regression in the internal service which is responsible for RBAC (Role Based Access Check to SCM. This regression was introduced while adding an improvement to the service concentrated on movement of roles. Unfortunately, the account associated with the service was affected in a manner that resulted in a change of privileges that affected the ability of the service to communicate with a 3rd party to perform designated tasks.
Once engineers understood the problem, a fix was deployed in order to correct the problem. Once the fix was applied, affected customers were contacted to assure that they were indeed mitigated.
As a result of this incident, we are making improvements in our testing mechanisms to identify code regressions and detection improvements for the affected service.
We apologize for any inconvenience.

@ahmelsayed ahmelsayed closed this Mar 16, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.