az afd update disassociates custom domains when adding a new one

[lenniehwtw-new]

Describe the bug

I have a pipeline that adds a custom domain to front door and associates them with the default route.

This was working fine but now is behaving strangely.

When the az afd update command executes it disassociates all of the existing custom domains and the ruleset.

Related command

az afd update

Errors

There is no error reported, the command executes with unexpected behaviours

Issue script & Debug output

NOTE This executes via an AzureCLI@2 task in an ADO pipeline

$domainsIds = az afd route
show --endpoint-name $(endpointName)
--route-name ${{parameters.azure.frontDoorRouteName}} --resource-group ${{parameters.azure.frontDoorProfileResourceGroup}}
--profile-name ${{parameters.azure.frontDoorProfileName}} `
--query "customDomains[].id" --debug | ConvertFrom-Json

      Write-Host "Existing DomainIds : " $domainsIds
      $domainsIds += "$(domainId)"
      Write-Host "New DomainIds : " $domainsIds

      $ruleSetIds = az afd `
      route `
      show `
      --endpoint-name $(endpointName) `
      --route-name ${{parameters.azure.frontDoorRouteName}} `
      --resource-group ${{parameters.azure.frontDoorProfileResourceGroup}} `
      --profile-name ${{parameters.azure.frontDoorProfileName}} `
      --query "ruleSets[].id" --debug | ConvertFrom-Json

      Write-Host "RuleSetId: " $ruleSetIds

      az afd `
      route `
      update `
      --resource-group ${{parameters.azure.frontDoorProfileResourceGroup}} `
      --endpoint-name $(endpointName) `
      --profile-name ${{parameters.azure.frontDoorProfileName}} `
      --route-name ${{parameters.azure.frontDoorRouteName}} `
      --patterns-to-match /* `
      --origin-group DefaultBackend `
      --supported-protocols Https `
      --custom-domains $domainsIds `
      --forwarding-protocol MatchRequest `
      --origin-path "${{parameters.azure.originPath}}" `
      --rule-sets $ruleSetIds `
      --https-redirect Enabled `
      --debug

frontdoor-route-update-logs.txt

The result is that
All the existing custom domains logged at line 118 in attached file are disassociated from the route
The ruleset logged at line 203 is disassociated from the route

Expected behavior

I would expect the existing custom domains to be unaffected and the ruleset to remain associated with the route
I would expect the new custom domain to be associated with the route

Environment Summary

azure-cli 2.67.0 *

core 2.67.0 *
telemetry 1.1.0
Dependencies:
msal 1.31.0
azure-mgmt-resource 23.1.1

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\sveAzRCSBLD.azure\cliextensions'
Python (Windows) 3.12.7 (tags/v3.12.7:0b05ead, Oct 1 2024, 03:06:41) [MSC v.1941 64 bit (AMD64)]

Additional context

The last time this pipeline was run was in Nov 2024 - the env looked like this

azure-cli 2.52.0 *

core 2.52.0 *
telemetry 1.1.0

Extensions:
azure-devops 1.0.1

Dependencies:
msal 1.24.0b1
azure-mgmt-resource 23.1.0b2

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\sveAzRCSBLD.azure\cliextensions'

Python (Windows) 3.10.10 (tags/v3.10.10:aad5f6a, Feb 7 2023, 17:05:00) [MSC v.1929 32 bit (Intel)]

[azure-client-tools-bot-prd]

Hi @lenniehwtw-new,

2.67.0 is not the latest Azure CLI(2.74.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @cdnfdsuppgithub, @t-bzhan, @gxue, @TracyYaoYao.

[lenniehwtw-new]

So verified the same behaviour with latest version
PS [PCM-7T4YSG3]> az version
{
"azure-cli": "2.74.0",
"azure-cli-core": "2.74.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"azure-devops": "1.0.0",
"containerapp": "0.3.50",
"log-analytics": "0.2.2",
"ml": "2.36.4"
}
}

I ran a slightly modified version of the script

$endpointName = 'b5x2idoj2hqe2'
$routeName = 'DefaultRoute'
$resourceGroupName = 'WTW-IXS-ISOLATED-RADARFOUNDATION-MANAGEDAPPS-1673512-QA18-MRG'
$profileName = 'fdb5x2idoj2hqe2'
$newDomainId = 'lennie-test'

$domainsIds = az afd route
show --endpoint-name $endpointName
--route-name $routeName --resource-group $resourceGroupName
--profile-name $profileName --query "customDomains[].id"
--debug | ConvertFrom-Json

Write-Host "Existing DomainIds : " $domainsIds
$domainsIds += "$($newDomainId)"
Write-Host "New DomainIds : " $domainsIds

$ruleSetIds = az afd route show --endpoint-name $endpointName
--route-name $routeName --resource-group $resourceGroupName
--profile-name $profileName --query "ruleSets[].id"
--debug | ConvertFrom-Json

Write-Host "RuleSetId: " $ruleSetIds

az afd route update --resource-group $resourceGroupName
--endpoint-name $endpointName --profile-name $profileName
--route-name $routeName --patterns-to-match /*
--origin-group DefaultBackend --supported-protocols Https
--custom-domains $domainsIds --forwarding-protocol MatchRequest
--origin-path "/" --rule-sets $ruleSetIds
--https-redirect Enabled `
--debug

see attached log file

Can see that when it call the PUT endpoint for DefaultRoute the request body only contains the new custom domain and no rulesets

The behaviour is the same - only the new domain is associated with the route and the ruleset is disassocated
test-afd.log

[Ptnan7]

Hi @lenniehwtw-new.
For now, we didn't provide a delete for disassociation between endpoint and custom domains, if you check the afd route delete you can find that it deletes the whole route. So, if you want to disassociate endpoint and custom domain you can only adjust the domainslist, that is why we design the update both for disassociating and associating, so if you just provide a custom domain, it will take your update as a full update and replace your old custom domain list.

[lenniehwtw-new]

That's not what's happening.

I am trying to add an extra domain to the route which already has a number of domains associated with it..

When I use az afd route update I provide a domain list that consists of all the existing domains that are associated with the route plus the one I want to add.
Also I provide the existing rule set that is associated with the route.
But the command disassociates all the existing domains and the ruleset

[lenniehwtw-new]

That's not what's happening.

I am trying to add an extra domain to the route which already has a number of domains associated with it..

When I use az afd route update I provide a domain list that consists of all the existing domains that are associated with the route plus the one I want to add. Also I provide the existing rule set that is associated with the route. But the command disassociates all the existing domains and the ruleset

Can you reopen this please, the update is not working as you say it is....