如何从DevOps管道安全登录Az CLI

Question

我想从我的Azure DevOps管道执行AZ-cli命令。在我的YAML文件中，我有这样的：

trigger:
- master
pool:
vmImage: 'ubuntu-latest'
variables:
buildConfiguration: 'Release'
steps:
- task: UsePythonVersion@0
inputs:
versionSpec: '3.x'
architecture: 'x64'
# Updating pip to latest
- script: python -m pip install --upgrade pip
displayName: 'Upgrade pip'
# Updating to latest Azure CLI version.
- script: pip install --pre azure-cli --extra-index-url https://azurecliprod.blob.core.windows.net/edge
displayName: 'upgrade azure cli'
- script: az --version
displayName: 'Show Azure CLI version'
- script: az extension add -n azure-devops
displayName: 'Install Azure DevOps Extension'
- script: echo ${AZURE_DEVOPS_CLI_PAT} | az devops login
env:
AZURE_DEVOPS_CLI_PAT: $(System.AccessToken)
displayName: 'Login Azure DevOps Extension'
- script: az aks show --name census-k8s  --resource-group Census
displayName: 'Show AKS'

echo$｛AZURE_DEVOPS_CLI_PAT｝|az-DEVOPS登录步骤已完成(显然已成功(，并显示警告消息

Failed to store PAT using keyring; falling back to file storage.
You can clear the stored credential by running az devops logout.
Refer https://aka.ms/azure-devops-cli-auth to know more on sign in with PAT.

az-aks show步骤失败：

Please run 'az login' to setup account.

我有点迷路了。az-devops login命令应该使我能够使用az-cli，对吗？如果不是，我是否应该使用az登录而不是az devops登录z登录，我如何以安全的方式传递凭据？

Answer 1

不，您不需要az devops login。您需要的是Azure CLI任务：

- task: AzureCLI@2
displayName: Azure CLI
inputs:
azureSubscription: <Name of the Azure Resource Manager service connection>
scriptType: ps
scriptLocation: inlineScript
inlineScript: |
az --version
az account show

但这样你就不必进行任何登录。请把你的az aks show --name census-k8s --resource-group Census叫到那里

Answer 2

添加到Krzysztof的答案中(以及评论中的jeromeg问题(：在Azure CLI步骤中，您还可以使用其他工具az，这些工具需要使用AzureCLI:登录

- task: AzureCLI@2
displayName: Publish Function
inputs:
azureSubscription: <Name of the Azure Resource Manager service connection>
scriptType: ps
scriptLocation: inlineScript
inlineScript: |
func azure publish <function-name>

Answer 3

若要从脚本(powershell或批处理(使用Azure CLI，必须将$(System.AccessToken)分配给名为AZURE_DEVOPS_EXT_PAT的环境变量。

- pwsh: |
az pipelines build list
displayName: 'Show build list'
env:
AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

来源：https://learn.microsoft.com/en-us/azure/devops/cli/azure-devops-cli-in-yaml?view=azure-devops

Answer 4

如果您的scriptLocation是scriptPath，请使用以下示例

- task: AzureCLI@2
displayName: 'update function appsettings'
inputs:
azureSubscription: 'MY-AzureSubscriptionName'
scriptType: ps
scriptLocation: 'scriptPath'
scriptPath: '$(System.DefaultWorkingDirectory)/Scripts/updateSettings.ps1'
arguments:
-ResourceGroupName 'MY-ResourceGroupName' `
-FunctionAppName 'MY-FunctionAppName'

updateSettings.p1

param (
[string]$ResourceGroupName,
[string]$FunctionAppName)
)
.
. script body here
.