Azure函数(使用Linux计划)未与系统标识一起使用以访问用于zip部署的存储帐户

vaqhlq81  于 2022-12-14  发布在  Linux
关注(0)|答案(2)|浏览(116)

由于“AzureWebJobsStorage的托管身份”已发布,使Function应用程序能够访问存储帐户,因此我想给予一下并在我们的API中实现。但是,这对Azure Function Linux消费计划不起作用。设置如下所示:

  • 函数运行时:~4
  • Python版本:3.9
  • 服务计划:Linux使用
  • 系统标识已激活,并且分配了Blob所有者+ SA参与者以访问SA。
  • 部署方法:
  • 通过任务AzureFunctionApp@1的Azure开发运营管道
  • 我尝试过zip部署和runFromPackage

我的问题与应用程序设置有关。我不太清楚除了AzureWebJobsStorage__accountName:[SA_NAME]之外还应配置哪些应用程序设置。更具体地说,根据MSFT文档,消费linux计划中不支持应用程序设置WEBSITE_RUN_FROM_PACKAGE:1,必须使用WEBSITE_RUN_FROM_PACKAGE:[URL]。通常,如果没有托管标识访问,部署工具将负责调整每个部署的URL,并将其指向存储帐户中的正确包名。AzureWebJobsStorage__accountName不会进行此调整,因为它无论如何都无法访问存储帐户。
如何测试?简单地在Azure中创建一个consumption linux python函数,并添加\调整AzureWebJobsStorage__accountName:[SA_NAME]。然后尝试使用在vscode中创建的基本HTTPTrigger部署该函数。
我不知道python http触发器代码是否必须调整。如果有人能提供更多关于它和应用程序设置的信息,那就太好了。

xzlaal3s

xzlaal3s1#

下面的作品在我这边(Linux消费计划):

trigger:
- none

variables:
  # Azure Resource Manager connection created during pipeline creation
  azureSubscription: 'xxx'
  resourceGroupName: 'xxx'
  # Function app name
  functionAppName: 'xxx'
  # Agent VM image name
  vmImageName: 'ubuntu-latest'

  # Working Directory
  workingDirectory: ''

  storage_str: 'xxx'

stages:
- stage: Build
  displayName: Build stage

  jobs:
  - job: Build
    displayName: Build
    pool:
      vmImage: $(vmImageName)

    steps:
    - task: UsePythonVersion@0
      displayName: 'Use Python 3.9'
      inputs:
        versionSpec: 3.9 # Functions V2 supports Python 3.6 as of today
        architecture: 'x64'

    - bash: |
        pip install --target="./.python_packages/lib/site-packages" -r ./requirements.txt
      workingDirectory: $(workingDirectory)
      displayName: 'Install application dependencies'

    - task: ArchiveFiles@2
      displayName: 'Archive files'
      inputs:
        rootFolderOrFile: "$(System.DefaultWorkingDirectory)"
        includeRootFolder: false
        archiveType: zip
        archiveFile: "$(System.DefaultWorkingDirectory)/$(Build.BuildId).zip"
        replaceExistingArchive: true

    - task: PublishBuildArtifacts@1
      inputs:
        PathtoPublish: '$(System.DefaultWorkingDirectory)/$(Build.BuildId).zip'
        artifactName: 'drop'
        
- stage: Deploy
  displayName: Deploy stage
  dependsOn: Build
  condition: succeeded()

  jobs:
  - deployment: Deploy
    displayName: Deploy
    environment: 'test'
    pool:
      vmImage: 'windows-latest'

    strategy:
      runOnce:
        deploy:
          steps:
          - task: DownloadPipelineArtifact@2
            displayName: 'Download Pipeline Artifact'
            inputs:
              buildType: 'current'
              artifactName: 'drop'
              targetPath: '$(Pipeline.Workspace)/drop/'
          - task: AzureAppServiceSettings@1
            inputs:
              azureSubscription: '$(azureSubscription)'
              appName: '$(functionAppName)'
              resourceGroupName: '$(resourceGroupName)'
              appSettings: |
                [
                  {
                    "name": "AzureWebJobsStorage",
                    "value": "$(storage_str)",
                    "slotSetting": false
                  }
                ]
          - task: AzureFunctionApp@1
            inputs:
              azureSubscription: '$(azureSubscription)'
              appType: 'functionAppLinux'
              appName: '$(functionAppName)'
              package: '$(Pipeline.Workspace)/drop/$(Build.BuildId).zip'
              runtimeStack: 'PYTHON|3.9'
a9wyjsp7

a9wyjsp72#

您可以通过使用用户分配的标识来解决此问题。
请尝试添加此应用设置:

WEBSITE_RUN_FROM_PACKAGE_BLOB_MI_RESOURCE_ID = Managed_Identity_Resource_Id

来源:https://learn.microsoft.com/en-us/azure/azure-functions/run-functions-from-deployment-package#fetch-a-package-from-azure-blob-storage-using-a-managed-identity

相关问题