Azure DevOps - 即使发布管道已成功，更改也不会部署在 Azure SQL 数据库的 PROD 上

Question

我正在通过发布管道部署 SQL DacPac 文件来为 Azure SQL 数据库设置 Azure DevOps。我正在推动从 DEV 数据库到 PROD 数据库的更改。

我是 Azure DevOps 的新手，通过 Azure 文档和谷歌完成了所有设置，但在这一点上陷入了困境。

构建管道和发布管道正在成功，但更改未反映在 PROD 数据库中。 请在下面找到发布管道的 YAML：

steps:
- task: SqlAzureDacpacDeployment@1
  displayName: 'Azure SQL DacpacTask'
  inputs:
    azureSubscription: 'azure_subscription'
    ServerName: server_name
    DatabaseName: 'database_name'
    SqlUsername: user_name
    SqlPassword: password
    DeploymentAction: DeployReport
    DacpacFile: '$(System.DefaultWorkingDirectory)/AzureDB_Test/Test/bin/Debug/Test.dacpac'

请在下面找到 Azure SQL DacPacTask 的日志：

2024-01-06T21:27:27.9410537Z ##[section]Starting: Azure SQL DacpacTask
2024-01-06T21:27:27.9722384Z ==============================================================================
2024-01-06T21:27:27.9722835Z Task         : Azure SQL Database deployment
2024-01-06T21:27:27.9723374Z Description  : Deploy an Azure SQL Database using DACPAC or run scripts using SQLCMD
2024-01-06T21:27:27.9723284Z Version      : 1.232.0
2024-01-06T21:27:27.9723394Z Author       : Microsoft Corporation
2024-01-06T21:27:27.9723957Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/sql-azure-dacpac-deployment
2024-01-06T21:27:27.9723395Z ==============================================================================
2024-01-06T21:27:29.7550294Z Added TLS 1.2 in session.
2024-01-06T21:27:44.6571057Z Temporary inline SQL file: C:\Users\VssAdministrator\AppData\Local\Temp\tmpC89E.tmp
2024-01-06T21:27:44.9123856Z Invoke-Sqlcmd -ServerInstance "server_name" -Database "database_name" -Username "user_name"  -Password "password"  -Inputfile "C:\Users\VssAdministrator\AppData\Local\Temp\tmpC89E.tmp"  **-ConnectionTimeout 120**
2024-01-06T21:27:58.3224482Z DACPAC file path: D:\a\r1\a\_nEDS_AzureDB_Test\nEDS_Test\bin\Debug\nEDS_Test.dacpac
2024-01-06T21:27:58.6926284Z ##[command]"D:\a\_tasks\SqlAzureDacpacDeployment_ch87a08b-a478-4e2b-8369-1d37u9ab560f\1.232.0\vswhere.exe" -version [15.0,18.0) -latest -format json
2024-01-06T21:27:59.5484384Z "C:\Program Files\Microsoft SQL Server\160\DAC\bin\SqlPackage.exe" /Action:DeployReport /SourceFile:"D:\a\r1\a\AzureDB_Test\Test\bin\Debug\Test.dacpac" /TargetServerName:"server_name" /TargetDatabaseName:"database_name" /TargetUser:"user_name" /TargetPassword:"password" /OutputPath:"D:\a\r1\a\GeneratedOutputFiles\ACAEDS_Prod_DevOps_DeployReport.xml"  /**TargetTimeout:120**
2024-01-06T21:28:04.0578492Z Generating report for database 'database_name' on server 'server_name'.
2024-01-06T21:28:23.7792056Z Successfully generated report to file D:\a\r1\a\GeneratedOutputFiles\Report.xml.
2024-01-06T21:28:23.7803000Z Changes to connection setting default values were incorporated in a recent release.  More information is available at https://aka.ms/dacfx-connection
2024-01-06T21:28:23.7806733Z Time elapsed 0:00:20.21
2024-01-06T21:28:23.8142166Z Generated file D:\a\r1\a\GeneratedOutputFiles\Report.xml. Uploading file to the logs.
2024-01-06T21:28:23.8160223Z Setting output variable 'SqlDeploymentOutputFile' to 'D:\a\r1\a\GeneratedOutputFiles\.xml'
2024-01-06T21:28:23.8509958Z ##[section]Finishing: Azure SQL DacpacTask

生产数据库发生的问题是否与仅将 Reader 角色分配给我正在处理的资源组上的服务主体有关？ 是否需要具有贡献者角色才能使这些操作成功？我在这里受到限制，无法获得资源组的贡献者角色。

Answer 1

您可以使用

Publish

选项代替

DeployReport

使用 dacpac 文件创建/更新目标数据库。请检查这里的论点以供参考。

*** 无法部署包。错误 SQL72014：框架 Microsoft SqlClient 数据提供程序：消息 15247，级别 16，状态 13，第 5 行 用户无权执行此操作。错误 SQL72045：脚本执行错误。 ..

您正在使用

SQL server authentication

（用户名，密码）部署 dacpac，错误表明用户没有更新数据库的权限。请为该帐户授予更高的权限，您可以在答案中找到权限这里。

此外，默认情况下禁用azure数据库上的公共网络访问。您可以使用

select network

将DevOps代理ip添加到白名单中，以便它可以访问数据库。

我的yaml供您参考：

pool:
  vmImage: Windows-latest


steps:
- task: AzureCLI@2     # get agent ip and add it to DB white list.
  inputs:
    azureSubscription: 'ARMConn3'
    scriptType: 'ps'
    scriptLocation: 'inlineScript'
    inlineScript: |
      $ip =Invoke-RestMethod -uri "http://ifconfig.me/ip"
      az sql server firewall-rule create -g "testRG" -s testserver1 -n myrule --start-ip-address $ip --end-ip-address $ip

- task: SqlAzureDacpacDeployment@1
  displayName: 'Azure SQL DacpacTask'
  inputs:
    azureSubscription: 'ARMConn3'
    AuthenticationType: 'server'
    ServerName: 'testserver1.database.windows.net'
    DatabaseName: 'wadedb1'
    SqlUsername: 'wade'
    SqlPassword: '$(password)'
    deployType: 'DacpacTask'
    DeploymentAction: 'Publish'
    DacpacFile: '**/wadedb1.dacpac'

- task: AzureCLI@2       # delete the agent ip on sql network
  inputs:
    azureSubscription: 'ARMConn3'
    scriptType: 'ps'
    scriptLocation: 'inlineScript'
    inlineScript: |
      $ip =Invoke-RestMethod -uri "http://ifconfig.me/ip"
      az sql server firewall-rule delete -g "testRG" -s testserver1 -n myrule

编辑：

我们可以将 sql 登录名和密码存储在 keyvault 中，并在 Azure SQL DacpacTask 的管道中获取值。

第一步： 在 azure 键值上，创建用户名和密码机密。

Step2：为服务主体授予

Key Vault Secrets User

（来自 ARM 服务连接）

Step3：在 azure SQL Dacpac 任务之前添加

AzureKeyVault@2

任务以获取机密值，并在 azure SQL Dacpac 任务中使用

$(username)

和

$(password)

进行部署。

- task: AzureKeyVault@2
  inputs:
    azureSubscription: 'ARMConn3'
    KeyVaultName: 'wadekeyvalut7'
    SecretsFilter: '*'
    RunAsPreJob: true

- task: SqlAzureDacpacDeployment@1
  displayName: 'Azure SQL DacpacTask'
  inputs:
    azureSubscription: 'ARMConn3'
    AuthenticationType: 'server'
    ServerName: 'testserver1.database.windows.net'
    DatabaseName: 'wadedb1'
    SqlUsername: '$(username)'
    SqlPassword: '$(password)'
    deployType: 'DacpacTask'
    DeploymentAction: 'Publish'
    DacpacFile: '**/wadedb1.dacpac'

另一个选项是在 Azure 门户上使用“servicePrincipal

as AuthenticationType in the Dacpac task, it will use the service principal to deploy instead of the sql user. But it needs to grant

SQL Server admin”作为服务主体。

- task: SqlAzureDacpacDeployment@1
  inputs:
    azureSubscription: 'ARMConn3'
    AuthenticationType: 'servicePrincipal'
    ServerName: 'testserver1.database.windows.net'
    DatabaseName: 'wadedb1'
    deployType: 'DacpacTask'
    DeploymentAction: 'Publish'
    DacpacFile: '**/wadedb1.dacpac'