如何从DevOps管道安全地登录Az

Question

我想从我的Azure DevOps管道执行AZ命令。在我的YAML文件中有：

trigger:
- master

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'

steps:
- task: UsePythonVersion@0
  inputs:
    versionSpec: '3.x'
    architecture: 'x64'

# Updating pip to latest
- script: python -m pip install --upgrade pip
  displayName: 'Upgrade pip'

# Updating to latest Azure CLI version.
- script: pip install --pre azure-cli --extra-index-url https://azurecliprod.blob.core.windows.net/edge
  displayName: 'upgrade azure cli'

- script: az --version
  displayName: 'Show Azure CLI version'

- script: az extension add -n azure-devops
  displayName: 'Install Azure DevOps Extension'

- script: echo ${AZURE_DEVOPS_CLI_PAT} | az devops login
  env:
    AZURE_DEVOPS_CLI_PAT: $(System.AccessToken)
  displayName: 'Login Azure DevOps Extension'

- script: az aks show --name census-k8s  --resource-group Census
  displayName: 'Show AKS'

使用一条警告消息完成回送${AZURE_DEVOPS_CLI_PAT} {AZURE_DEVOPS_CLI_PAT}\\ az登录步骤(显然是成功的)

Failed to store PAT using keyring; falling back to file storage.
You can clear the stored credential by running az devops logout.
Refer https://aka.ms/azure-devops-cli-auth to know more on sign in with PAT.

aks显示步骤失败：

Please run 'az login' to setup account.

我有点迷路了。az devops登录命令应该允许我使用az cli，对吗？如果没有，我应该使用az登录而不是az devops登录吗？如果我应该使用az登录，我如何以安全的方式传递我的凭据？

Answer 1

不，你不需要az devops login。你需要的是Azure CLI任务

- task: AzureCLI@2
  displayName: Azure CLI
  inputs:
    azureSubscription: <Name of the Azure Resource Manager service connection>
    scriptType: ps
    scriptLocation: inlineScript
    inlineScript: |
      az --version
      az account show

但这样你就不用登录了。请叫到你的az aks show --name census-k8s --resource-group Census

Answer 2

要从脚本(powershell或批处理)中使用Azure，必须将$(System.AccessToken)分配给名为AZURE_DEVOPS_EXT_PAT的环境变量。

- pwsh: |
    az pipelines build list
  displayName: 'Show build list'
  env:
    AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

来源：https://learn.microsoft.com/en-us/azure/devops/cli/azure-devops-cli-in-yaml?view=azure-devops

Answer 3

为了补充Krzysztof的回答(以及评论中的旋转问题)：在AzureCLI步骤中，您还可以使用其他工具，然后使用az，这些工具需要使用AzureCLI登录：

- task: AzureCLI@2
  displayName: Publish Function
  inputs:
    azureSubscription: <Name of the Azure Resource Manager service connection>
    scriptType: ps
    scriptLocation: inlineScript
    inlineScript: |
      func azure publish <function-name>