1# Azure Functions on Azure Container Apps (Aspire)
2 
3When .NET Aspire deploys Azure Functions via `azd`, Functions run as containerized workloads on Azure Container Apps. **File-based secret storage is required** when using identity-based storage access.
4 
5> ⚠️ **Critical:** When Azure Functions use identity-based storage (e.g., `AzureWebJobsStorage__blobServiceUri`), you **must** set `AzureWebJobsSecretStorageType=Files`.
6 
7## Proactive Configuration in AppHost
8 
9**Best Practice:** Add this setting in your AppHost BEFORE running `azd up`:
10 
11```csharp
12var functions = builder.AddAzureFunctionsProject<Projects.Functions>("functions")
13    .WithHostStorage(storage)
14    .WithEnvironment("AzureWebJobsSecretStorageType", "Files")  // Required for Container Apps
15    // ... other configuration
16```
17 
18This ensures the environment variable is automatically included in the generated infrastructure.
19 
20## Container Apps Bicep Configuration
21 
22When Aspire generates infrastructure, the Functions container app should include this environment variable. If you need to customize the generated Bicep or create it manually, the configuration looks like this:
23 
24> **Note:** This example shows partial configuration. Assumes `containerAppEnv`, `storageAccount`, and `appInsights` resources are defined elsewhere in your Bicep templates.
25 
26```bicep
27resource functionsContainerApp 'Microsoft.App/containerApps@2024-03-01' = {
28  name: '${resourcePrefix}-${serviceName}-${uniqueHash}'
29  location: location
30  identity: {
31    type: 'SystemAssigned'
32  }
33  properties: {
34    environmentId: containerAppEnv.id
35    configuration: {
36      ingress: {
37        external: true
38        targetPort: 8080
39      }
40    }
41    template: {
42      containers: [
43        {
44          name: 'functions-app'
45          image: containerImage
46          env: [
47            {
48              name: 'AzureWebJobsStorage__blobServiceUri'
49              value: storageAccount.properties.primaryEndpoints.blob
50            }
51            {
52              name: 'AzureWebJobsSecretStorageType'
53              value: 'Files'  // Required for Container Apps with identity-based storage
54            }
55            {
56              name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
57              value: appInsights.properties.ConnectionString
58            }
59            {
60              name: 'FUNCTIONS_EXTENSION_VERSION'
61              value: '~4'
62            }
63            {
64              name: 'FUNCTIONS_WORKER_RUNTIME'
65              value: 'dotnet-isolated'
66            }
67          ]
68        }
69      ]
70    }
71  }
72}
73```
74 
75## Why This Is Required
76 
77- Identity-based storage URIs (e.g., `AzureWebJobsStorage__blobServiceUri`) work for runtime operations
78- However, Functions' internal secret/key management does not support these identity-based URIs
79- File-based secret storage is mandatory for Container Apps deployments with identity-based storage
80 
81## Common Error Without This Setting
82 
83```
84System.InvalidOperationException: Secret initialization from Blob storage failed due to missing both
85an Azure Storage connection string and a SAS connection uri.
86```
87 
88## When to Use This Configuration
89 
90- Deploying Azure Functions to Container Apps via .NET Aspire
91- Using `AddAzureFunctionsProject` with `WithHostStorage` in your AppHost
92- Using identity-based storage access (no connection strings)
93- Setting environment variables like `AzureWebJobsStorage__blobServiceUri`
94