Switch flex consumption deployment to SAS blob upload with pre-packaged python dependencies to avoid Kudu 404s

iac/functions.tf

@@ -69,6 +69,48 @@ data "archive_file" "function_app" {
   excludes    = [".git", ".gitea", "iac", "helm-chart", ".terraform*", ".vscode"]
 }
 
+resource "azurerm_storage_blob" "appcode" {
+  name                   = "app-${random_string.name.result}.zip"
+  storage_account_name   = azurerm_storage_account.example.name
+  storage_container_name = azurerm_storage_container.example.name
+  type                   = "Block"
+  source                 = data.archive_file.function_app.output_path
+}
+
+data "azurerm_storage_account_sas" "sas" {
+  connection_string = azurerm_storage_account.example.primary_connection_string
+  https_only        = true
+
+  resource_types {
+    service   = false
+    container = false
+    object    = true
+  }
+
+  services {
+    blob  = true
+    queue = false
+    table = false
+    file  = false
+  }
+
+  start  = "2023-01-01T00:00:00Z"
+  expiry = "2029-01-01T00:00:00Z"
+
+  permissions {
+    read    = true
+    write   = false
+    delete  = false
+    list    = false
+    add     = false
+    create  = false
+    update  = false
+    process = false
+    tag     = false
+    filter  = false
+  }
+}
+
 # Create a function app
 resource "azurerm_function_app_flex_consumption" "example" {
   name                = coalesce(var.fa_name, random_string.name.result)
@@ -85,8 +127,6 @@ resource "azurerm_function_app_flex_consumption" "example" {
   maximum_instance_count      = 50
   instance_memory_in_mb       = 2048
 
-  zip_deploy_file             = data.archive_file.function_app.output_path
-
   site_config {
     application_insights_connection_string = azurerm_application_insights.example.connection_string
   }
@@ -96,7 +136,6 @@ resource "azurerm_function_app_flex_consumption" "example" {
     "OLLAMA_MODEL" = "gemma4:e4b"
     "JOKE_PROMPT" = "tell me a dad joke about programming"
     "PORT" = "80"
-    "SCM_DO_BUILD_DURING_DEPLOYMENT" = "true"
-    "ENABLE_ORYX_BUILD" = "true"
+    "WEBSITE_RUN_FROM_PACKAGE" = "${azurerm_storage_account.example.primary_blob_endpoint}${azurerm_storage_container.example.name}/${azurerm_storage_blob.appcode.name}${data.azurerm_storage_account_sas.sas.sas}"
   }
 }