azure - Azure DevOps Powershell 脚本无法创建 SSL/TLS 安全通道
问题描述
问题:
如果我从DevOps Pipeline 中的“Azure Powershell”任务调用命令Get-AzureDeployment(也称为 Get-AzureService),我得到:“请求被中止:无法创建 SSL/TLS 安全通道。'
介绍:
- 我使用 Azure DevOps 将 Azure 云服务(经典)部署到 Azure
- “Azure Powershell”任务一直在工作,但没有改变任何东西就停止工作
- 我还将证书(由 DevOps 使用)导入到我的电脑(通过 Import-AzurePublishSettingsFile)并尝试运行相同的 powershell 脚本并且everytnig 工作正常,所以我预计 DevOps 会出现问题
DevOps 连接:
- 我在 Azure DevOps 中创建了“服务连接”以连接到 Azure
- 服务连接类型为“Azure 经典”(因为“Azure 资源管理器”不适用于“经典云服务”)
- “Azure 经典服务连接”的身份验证方法是“基于证书”。
- 我将“发布设置文件”生成的证书用于我的 azure 订阅。证书被 azure 放入我的订阅->管理证书(到期日期为 2021 年中)
- 我使用此服务连接将应用程序(经典云服务)部署到 Azure中没有问题(通过 DevOps 任务“Azure 云服务部署”),但只是“Azure Powershell”任务开始失败。
这一切都工作了 3 个月,然后由于任何原因停止工作。奇怪的是,当我在玩 DevOps 以找出问题所在时,任务曾经成功运行,但是当我再次尝试时,我又遇到了错误。
我有两个日志,来自成功的呼叫和失败的呼叫。2506行日志相同,变化在此行之后。
我可以向您发送完整的日志,但我不想在这里放置这么长的日志。
成功尝试:
VERBOSE: 8:31:40 AM - Begin Operation: Get-AzureDeployment
VERBOSE: 8:31:42 AM - Completed Operation: Get-AzureDeployment
... some other info about the deployment in slot
从失败的呼叫记录:
VERBOSE: 9:53:39 AM - Begin Operation: Get-AzureDeployment
##[debug]Caught exception from task script.
##[debug]Error record:
##[debug]Get-AzureDeployment : An error occurred while sending the request.
##[debug]At D:\a\r1\a\_Tools\Powershell\cloud-service_swap-slot.ps1:14 char:15
##[debug]+ ... eployment = Get-AzureDeployment -Slot "Staging" -ServiceName $CloudSe ...
##[debug]+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
##[debug] + CategoryInfo : CloseError: (:) [Get-AzureDeployment], HttpRequestException
##[debug] + FullyQualifiedErrorId : Microsoft.WindowsAzure.Commands.ServiceManagement.HostedServices.GetAzureDeploymentComma nd
##[debug]
##[debug]Script stack trace:
##[debug]at <ScriptBlock>, D:\a\r1\a\_Tools\Powershell\cloud-service_swap-slot.ps1: line 14
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]at <ScriptBlock>, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\3.171.2\AzurePowerShell.ps1: line 145
##[debug]at <ScriptBlock>, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\3.171.2\AzurePowerShell.ps1: line 141
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]at <ScriptBlock>, <No file>: line 22
##[debug]at <ScriptBlock>, <No file>: line 18
##[debug]at <ScriptBlock>, <No file>: line 1
##[debug]Exception:
##[debug]System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
##[debug] at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
##[debug] at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
##[debug] --- End of inner exception stack trace ---
##[debug] at Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
##[debug] at Microsoft.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccess(Task task)
##[debug] at Microsoft.WindowsAzure.Management.Compute.DeploymentOperationsExtensions.GetBySlot(IDeploymentOperations operations, String serviceName, DeploymentSlot deploymentSlot)
##[debug] at Microsoft.WindowsAzure.Commands.Utilities.Common.ServiceManagementBaseCmdlet.ExecuteClientActionNewSM[TResult](Object input, String operationDescription, Func`1 action, Func`3 contextFactory)
##[error]An error occurred while sending the request.
##[debug]Processed: ##vso[task.logissue type=error]An error occurred while sending the request.
##[debug]Processed: ##vso[task.complete result=Failed]
在这两个日志中,我还可以找到将 Azure 帐户添加到 Powershell 的内容:
##[debug]Added certificate to the certificate store.
##[command]Set-AzureSubscription -SubscriptionName PXX -SubscriptionId XXXXXX01-09f5-4703-bcc9-6ff914XXXXXX -Certificate ******** -Environment AzureCloud
##[command]Select-AzureSubscription -SubscriptionId XXXXXX01-09f5-4703-bcc9-6ff914XXXXXX
##[debug]Leaving Initialize-Azure.
## Initializing Azure Complete
(我用 X 替换了一些字符串)
YAML 中有 Powershell 任务:
steps:
- task: AzurePowerShell@3
displayName: 'Swap slots'
inputs:
azureConnectionType: ConnectedServiceName
azureClassicSubscription: 'PXX subscription'
ScriptPath: '$(System.DefaultWorkingDirectory)/_Tools/Powershell/cloud-service_swap-slot.ps1'
ScriptArguments: '-CloudServiceName $(CloudServiceName)'
FailOnStandardError: true
azurePowerShellVersion: LatestVersion
用于交换插槽的 Powershell 脚本可在本地 pc(具有相同的证书)上运行,但在 DevOps 中失败:
[CmdletBinding(PositionalBinding=$True)]
Param(
[Parameter(Mandatory = $true)]
[String]$CloudServiceName # required
)
# Check if Windows Azure Powershell is avaiable
if ((Get-Module -ListAvailable Azure) -eq $null)
{
throw "Windows Azure Powershell not found! Please install from http://www.windowsazure.com/en-us/downloads/#cmd-line-tools"
}
# VIP Swap
$Deployment = Get-AzureDeployment -Slot "Staging" -ServiceName $CloudServiceName #It's failing here
if ($Deployment -ne $null -AND $Deployment.DeploymentId -ne $null)
{
Write-Output ("Current Status of staging in {0}" -f $CloudServiceName);
Write-Host ($Deployment | Select-Object -Property * -ExcludeProperty Configuration,RolesConfiguration | Format-List | Out-String);
$MoveStatus = Move-AzureDeployment -ServiceName $CloudServiceName
Write-Output ("Vip swap of {0} status: {1}" -f $CloudServiceName, $MoveStatus.OperationStatus)
}else
{
Write-Output ("There is no deployment in staging slot of {0} to swap." -f $CloudServiceName)
}
有没有人和我一样的经历?问题可能出在哪里?
# 更新
我尝试在脚本开头添加此安全协议设置,但出现相同的错误。
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
解决方案
这似乎是 Microsoft 构建代理的问题,但将以下代码添加到每个 Azure Powershell 任务的开头似乎已经为我们解决了这个问题,直到他们弄清楚。
$pcert = (Get-Variable Endpoint -ValueOnly).Auth.Parameters.certificate
$bytes = [convert]::FromBase64String($pcert)
[IO.File]::WriteAllBytes("C:\cert.pfx",$bytes)
$null = Import-PfxCertificate -FilePath C:\cert.pfx -CertStoreLocation cert:\CurrentUser\My
推荐阅读
- c# - 如何从使用 EPPlus 和 C# 制作的图表中删除单个 DataLabel
- r - R - 计算最大连续日期数
- docker - docker buildargs 通过 JSON?
- concurrency - 在没有 IO 的光纤之间循环
- java - java - 如何通过cowdown计时器限制操作(例如登录)
- sql - SQL min/max date from a history table by status grouping
- python - 需要帮助有条件地矢量化列表
- javafx - 一个按钮(按下时)在其位置创建一个组合框并将自身向下移动到下面的行
- r - 从字符串字符中删除“”(空值)
- perl - 如何获取目录的最后修改日期?