-->

Apparent delay in Azure KeyVault access

2019-08-01 11:49发布

问题:

We have an Azure-based ASP.NET Web Service that accesses an Azure KeyVault. We are seeing two instances in which a method "hangs" on a first try, and then works a minute or so later.

In both instances, a KeyVault access occurs. In both instances the problem started when we started using the KeyVault in these methods.

We have done very careful logging in the first instance, and cannot see anything else in our code that could cause the hang. The KeyVault access is the primary suspect.

In addition, if we run the app from our local servers (from Visual Studio), the KeyVault access works fine on the "first try". It only produces the "hang" error when it runs in production on Azure, and only on that "first try".

By "hang" I mean that in one instance, which is triggered by an external API, it takes at least 60 seconds (we can tell that because the external API times out.) In the other instance, which is triggered by a page request, several minutes can pass and the page just spins, at which point we assume the DB request or something else has timed out.

When I say "a minute or so later", that's as fast as we have timed the retry.

Is there some kind of issue or function where the KeyVault needs to be "warmed up" before it works on the first try?

Update: I'm looking at the code more carefully, and I see at least a couple of places where we can insert still more logging to get a more exact picture of where the failure occurs. I'm going to do that, and then I'll report back here.

Update: See answer below - major newbie error, has been corrected.

回答1:

According to your description, it seems that it dues to WebApp that does not enable Always on .

By default, web apps are unloaded if they are idle for some period of time. This lets the system conserve resources. In Basic or Standard mode, you can enable Always On to keep the app loaded all the time

If possible, please have a try to enable Always on and try it again.



回答2:

Found the problem, and the solution.

Key Vault access needs to be called from an async task, because there is a multi-second delay.

private async Task<string> GetKeyVaultSecretValue(varSecretParms) {

I don't understand the underlying technology, however, apparently, if the call is from within a standard code sequence, the server doesn't like to wait, and so the thread is abandoned/halts.