App Service Linux: VNET integration causes application and docker to not respond at all

1
votes

I know the VNET integration is still in Preview, however i hope someone can still help me out with our current issue. I have on my developer tenant an app service linux with VNET integrated to access a Storage account (v2) behind VNET. The web service application is python based and makes use of gunicorn/flask for http requests and azure.storage.blob package for interfacing with the storage account.

This all works well on that tenant however we now try to get the same solution working on a different tenant and this causes problems. We use the VNET integration feature which is in preview, endpoints are also configured (Microsoft.Storage and Microsoft.Web), however when we start the App service after integration we do not get any response, also no docker logging is available, logging stream doesn't react. In the developer tenant we got an immediate response back.

Also it doesnt matter how long you wait for the VNET integration (as can be seen as notification). When you try to disconnect the VNET integration also an error occurs :

"VNet could not be removed from web app: The gateway did not receive a response from 'Microsoft.Web' within the specified time period."

Interestingly enough after that the VNET integration is not visible anymore, and when we start the app service again everything works again. We also tried using an empty virtual network with only the app service integration enabled which gives the same problems. Both the software and configurations are exactly similar, also we use West-Europe for all the resources.

Does anyone have any idea where we could look further to pinpoint this issue? Or is it because it is still in preview and depending on location it could or could not work....

Regards, Jos Eilers

1
linuxazureserviceintegrationvnet

1 Answers

1
votes

As far as I know, for app service integration with VNet, you only need to enable service endpoint Microsoft.Storage instead of both Microsoft.Storage and Microsoft.Web. The VNet Integration UI will delegate the subnet to Microsoft.Web automatically.

For regional VNet Integration troubleshooting, you could check the followings:

  • is your destination a non-RFC1918 address and you do not have WEBSITE_VNET_ROUTE_ALL set to 1
  • is there an NSG blocking egress from your integration subnet
  • do you have enough permissions to set delegation on the integration subnet? During regional VNet Integration configuration, your integration subnet will be delegated to Microsoft.Web. The VNet Integration UI will delegate the subnet to Microsoft.Web automatically. If your account does not have sufficient networking permissions to set delegation, you will need someone who can set attributes on your integration subnet to delegate the subnet. To manually delegate the integration subnet, go to the Azure Virtual Network subnet UI and set delegation for Microsoft.Web.

Moreover, if you use Web App for Containers, you need to modify your Docker image in order to use VNet Integration. In your docker image, use the PORT environment variable as the main web server’s listening port, instead of using a hardcoded port number. The PORT environment variable is automatically set by the App Service platform at the container startup time. Read this example1 and example2.

In addition, there is an ARM template to deploy app service VNet integration and storage service endpoint for your reference. Sometimes, the deployment order is a problem.