Skip to content

Azure.ContainerApp.DisableAffinity.md

Latest commit

 

History

History
124 lines (100 loc) · 3.44 KB

Azure.ContainerApp.DisableAffinity.md

File metadata and controls

124 lines (100 loc) · 3.44 KB
Raw
reviewed 2024-09-29
severity Awareness
pillar Performance Efficiency
category PE:05 Scaling and partitioning
resource Container App
resourceType Microsoft.App/containerApps
online version https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.DisableAffinity/

Disable session affinity

SYNOPSIS

Disable session affinity to prevent unbalanced distribution.

DESCRIPTION

Container apps allows you to configure session affinity (sticky sessions). When enabled, this feature route requests from the same client to the same replica. This feature might be useful for stateful applications that require a consistent connection to the same replica.

However, for stateless applications there is drawbacks to using session affinity. As connections are opened and closed, a subset of replicas might become overloaded with requests, while others are dormant. This can lead to: poor performance and resource utilization; less predictable scaling.

RECOMMENDATION

Consider using stateless application design and disabling session affinity to evenly distribute requests across each replica.

EXAMPLES

Configure with Azure template

To deploy Container Apps that pass this rule:

  • Set properties.configuration.ingress.stickySessions.affinity to none or don't specify the property at all.

For example:

{
  "type": "Microsoft.App/containerApps",
  "apiVersion": "2024-03-01",
  "name": "[parameters('appName')]",
  "location": "[parameters('location')]",
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
    "template": {
      "revisionSuffix": "[parameters('revision')]",
      "containers": "[variables('containers')]",
      "scale": {
        "minReplicas": 2
      }
    },
    "configuration": {
      "ingress": {
        "allowInsecure": false,
        "external": false,
        "ipSecurityRestrictions": "[variables('ipSecurityRestrictions')]",
        "stickySessions": {
          "affinity": "none"
        }
      }
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]"
  ]
}

Configure with Bicep

To deploy Container Apps that pass this rule:

  • Set properties.configuration.ingress.stickySessions.affinity to none or don't specify the property at all.

For example:

resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
  name: appName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    environmentId: containerEnv.id
    template: {
      revisionSuffix: revision
      containers: containers
      scale: {
        minReplicas: 2
      }
    }
    configuration: {
      ingress: {
        allowInsecure: false
        external: false
        ipSecurityRestrictions: ipSecurityRestrictions
        stickySessions: {
          affinity: 'none'
        }
      }
    }
  }
}

NOTES

This rule may generate false positive results for stateful applications.

LINKS