azure - Azure AppService 几次无法从 Azure 容器注册表中提取 docker 映像

Question

从昨天开始，我遇到了 Azure App Service 的问题。我正在使用 Terraform 部署新环境

resource "azurerm_app_service" "app" {
    name                    = "awake-kingfish"
    location                = azurerm_resource_group.app_group.location
    resource_group_name     = azurerm_resource_group.app_group.name
    app_service_plan_id     = azurerm_app_service_plan.service_plan.id
    https_only              = true
    client_affinity_enabled = false
    tags                    = local.tags
    app_settings            = {
        "DOCKER_REGISTRY_SERVER_USERNAME"         = var.docker_username
        "DOCKER_REGISTRY_SERVER_URL"              = var.docker_url
        "DOCKER_REGISTRY_SERVER_PASSWORD"         = var.docker_password
    }
    site_config {
        always_on           = true
        linux_fx_version    = "DOCKER|${var.docker_image}:${var.tag}"
    }
}

变量docker_username、docker_url、docker_password和来自 CI/CD 管道，并且 100% 正确（同一管道创建该映像并将其推送到 Azure 容器注册表）docker_image。tag当应用服务启动时，它无法下载图像 4 次，但随后它会在没有任何问题或从我这边采取任何行动的情况下将其拉出。这是来自应用服务的 docker 日志：

2020-08-13T15:49:11.472Z INFO  - Pulling image from Docker hub: ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:49:11.682Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://****.azurecr.io/v2/****/manifests/9dd776f05efd0a7ae981446c5e06d45c5c756df9: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

2020-08-13T15:49:11.685Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)
2020-08-13T15:49:11.686Z INFO  - Stopping site awake-kingfish because it failed during startup.
2020-08-13T15:49:13.428Z INFO  - Pulling image from Docker hub: ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:49:13.611Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://****.azurecr.io/v2/****/manifests/9dd776f05efd0a7ae981446c5e06d45c5c756df9: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

2020-08-13T15:49:13.613Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)
2020-08-13T15:49:13.615Z INFO  - Stopping site awake-kingfish because it failed during startup.
2020-08-13T15:49:17.655Z INFO  - Pulling image from Docker hub: ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:49:17.851Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://****.azurecr.io/v2/****/manifests/9dd776f05efd0a7ae981446c5e06d45c5c756df9: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

2020-08-13T15:49:17.853Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)
2020-08-13T15:49:17.854Z INFO  - Stopping site awake-kingfish because it failed during startup.
2020-08-13T15:49:20.549Z INFO  - Pulling image from Docker hub: ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:49:20.736Z ERROR - DockerApiException: Docker API responded with status code=InternalServerError, response={"message":"Get https://****.azurecr.io/v2/****/manifests/9dd776f05efd0a7ae981446c5e06d45c5c756df9: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information."}

2020-08-13T15:49:20.745Z ERROR - Image pull failed: Verify docker image configuration and credentials (if using private repository)
2020-08-13T15:49:20.746Z INFO  - Stopping site awake-kingfish because it failed during startup.
2020-08-13T15:54:54.181Z INFO  - Pulling image: ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:54:55.076Z INFO  - 9dd776f05efd0a7ae981446c5e06d45c5c756df9 Pulling from ****
2020-08-13T15:54:55.084Z INFO  - cbdbe7a5bc2a Pulling fs layer
// ...
2020-08-13T15:55:48.435Z INFO  - 7715080b9d20 Extracting 19MB / 19MB
2020-08-13T15:56:17.866Z INFO  - 7715080b9d20 Pull complete
2020-08-13T15:56:17.970Z INFO  -  Digest: sha256:8a2da38f410b91b821ccf2ff2ccdfba12999ea10dc2aa5a60741f3609251cfc5
2020-08-13T15:56:18.067Z INFO  -  Status: Downloaded newer image for ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9
2020-08-13T15:56:18.093Z INFO  - Pull Image successful, Time taken: 1 Minutes and 23 Seconds
2020-08-13T15:56:18.116Z INFO  - Starting container for site
2020-08-13T15:56:18.116Z INFO  - docker run -d -p 1813:80 --name awake-kingfish_0_39ad6980 -e PORT=80 -e WEBSITES_ENABLE_APP_SERVICE_STORAGE=false -e WEBSITES_PORT=80 -e WEBSITE_SITE_NAME=awake-kingfish -e WEBSITE_AUTH_ENABLED=False -e WEBSITE_ROLE_INSTANCE_ID=0 -e WEBSITE_HOSTNAME=awake-kingfish.azurewebsites.net -e WEBSITE_INSTANCE_ID=c4a671a5f8662a541a877e364dbc007723397b4ed45078d3ae1254f25f96e556 ****.azurecr.io/****:9dd776f05efd0a7ae981446c5e06d45c5c756df9  

2020-08-13T15:56:18.116Z INFO  - Logging is not enabled for this container.
Please use https://aka.ms/linux-diagnostics to enable logging to see container logs here.
2020-08-13T15:56:52.006Z INFO  - Initiating warmup request to container awake-kingfish_0_39ad6980 for site awake-kingfish
2020-08-13T15:56:53.047Z INFO  - Container awake-kingfish_0_39ad6980 for site awake-kingfish initialized successfully and is ready to serve requests.

这是一个大问题，因为它使管道中的 E2E 测试毫无用处，因为它们总是会失败。上个月左右，这个设置运行良好。

标签： azuredocker