A Guide to Finding Purpose in Life

Fixing “AppSetting is not allowed” Errors in Azure App Service Deployments with Pulumi

When deploying applications to Azure App Service using infrastructure as code tools like Pulumi, you might encounter a frustrating error that looks something like this:

Code="BadRequest" Message="AppSetting with name 'MyConfig:ApiUrl' is not allowed."

This error occurs because Azure App Service for Linux doesn’t allow colons (:) in application setting names, even though hierarchical configuration with colons is common in .NET Core applications. Let’s dive into why this happens and how to fix it.

The Problem: Configuration Naming Conventions

In .NET Core applications, configuration hierarchies are typically represented using colons. For example:

{
  "MyService": {
    "ApiConfig": {
      "BaseUrl": "https://api.example.com",
      "ClientId": "abc123"
    }
  }
}

In code, you would access these values using the colon notation: MyService:ApiConfig:BaseUrl.

However, Azure App Service for Linux has different requirements for application setting names, rejecting colons in favor of double underscores (__) (while for Windows you can keep the colon).

The Solution: Double Underscores

To resolve this issue in your Pulumi deployments, you need to:

1. Keep your configuration files structured as they are (with colons)
2. Convert colons to double underscores when setting up Azure App Service settings

Here’s how to do it:

Your Pulumi Configuration (YAML)

MyApp:ServiceConfig:
  BaseUrl: https://api.example.com
  ClientId: abc123
  ClientSecret: ""
  ApiScope: myapi

Your Pulumi Code (C#)

// Read the hierarchical configuration
var serviceConfig = config.RequireObject<JsonElement>("ServiceConfig");

// Set up app settings with double underscores instead of colons
new InputList<NameValuePairArgs>
{
    new NameValuePairArgs
    {
        Name = "ServiceConfig__BaseUrl", // this is the name of the config item in Azure
        Value = serviceConfig.GetProperty("BaseUrl").GetString()
    },
    new NameValuePairArgs
    {
        Name = "ServiceConfig__ClientId",
        Value = serviceConfig.GetProperty("ClientId").GetString()
    },
    new NameValuePairArgs
    {
        Name = "ServiceConfig__ClientSecret",
        Value = serviceConfig.GetProperty("ClientSecret").GetString()
    },
    new NameValuePairArgs
    {
        Name = "ServiceConfig__ApiScope",
        Value = serviceConfig.GetProperty("ApiScope").GetString()
    }
};

Why This Works

This approach works because:

1. ASP.NET Core’s configuration system treats colons and double underscores as equivalent when loading configuration.
2. Azure App Service accepts the double underscore format.
3. Your application code can continue to use the colon notation (e.g., configuration["ServiceConfig:BaseUrl"]), while Azure gets the settings in the format it expects.

The Underlying Magic

When your application runs in Azure App Service for Linux, environment variables with double underscores are automatically mapped to the hierarchical configuration system in .NET Core. This mapping is built into the configuration providers in ASP.NET Core.

Common Gotchas

• Remember this conversion is only needed for Azure App Service settings, not for your local development environments
• Make sure your configuration keys in Pulumi match exactly what you’re trying to access in code
• When troubleshooting, check the Azure Portal to confirm your settings are being applied correctly

By following this simple pattern, you can avoid the “AppSetting is not allowed” errors and successfully deploy your applications to Azure App Service using Pulumi.

Happy coding!