使用 ServiceBus 和托管身份验证的 Azure 容器应用作业

Question

我正在定义一个 Azure 容器应用作业。该作业将使用来自服务总线主题订阅的消息。该规则将使用用户分配的身份进行身份验证。该服务定义如下：

resource platformIoTTransformJob 'Microsoft.App/jobs@2024-03-01' = {
  name: platformIoTTransformJobName
  location: Location
  properties: {
    environmentId: environment.id
    configuration: {
      registries: [
        {
          server: acr.properties.loginServer
          identity: agentIdentity.id
        }
      ]
      manualTriggerConfig: {
        replicaCompletionCount: 1
        parallelism: 1
      }
      eventTriggerConfig: {
        replicaCompletionCount: 1
        parallelism: 1
        scale: {
          minExecutions: 0
          maxExecutions: 100
          pollingInterval: 30
          rules: [
            {
              name: 'azure-servicebus-topic-rule'
              type: 'azure-servicebus'
              metadata: any(
                {
                  topicName: platformServiceBus.outputs.TopicName
                  subscriptionName: platformServiceBus.outputs.SubscriptionName
                  namespace: platformServiceBus.outputs.ServiceBusNamespaceName
                  messageCount: '5'
                }
              )
#disable-next-line BCP037
              identity: platformIoTIdentity.id
            }
          ]
        }
      }
      replicaRetryLimit: replicaRetryLimit
      replicaTimeout: replicaTimeout
      triggerType: 'Event'
    }
    template: {
      containers: [
        {
          image: platformIoTTransformJobImage
          name: platformIoTTransformJobName
          env: [
            {
              name: 'APPINSIGHTS_INSTRUMENTATIONKEY'
              value: AppInsightsInstrumentationKey
            }
            {
              name: 'UserManagedIdentity__ClientId'
              value: platformIoTIdentity.properties.clientId
            }
          ]
          args: args
          command: command
          resources: {
            cpu: json(cpu)
            memory: memory
          }
        }
      ]
    }
  }
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${platformIoTIdentity.id}': {}
      '${agentIdentity.id}': {}
    }
  }
}

其中

platformServiceBus

是放置所需服务总线资源和权限的模块，

platformIoTIdentity

在主题订阅资源上具有 receiver 角色。

我正在使用

2024-03-01

版本，因为根据docs，它应该从

2024-02-02-preview

开始可用。

我还尝试在规则元数据中指定

identity

属性，但没有成功。

在执行历史中，即使队列中有活动消息，我也找不到任何执行，所以我认为问题与缩放规则有关。 问题出在哪里以及如何解决？ 我尝试检查日志（

ContainerAppSystemLogs_CL

），但找不到与此工作相关的任何内容

Answer 1

正如 MS Document

中所述，容器应用程序作业使用 KEDA 缩放器在事件类型触发器中进行缩放规则

KEDA Service Bus Scaler 使用本KEDA 文档

中提到的三种身份验证方法

1. 连接字符串
2. Pod 身份
3. 工作负载身份

我尝试使用

UserAssignedIdentity

访问服务总线，但没有成功。它与连接字符串一起工作得很好。

目前只有 Key Vault 参考方法适用于托管身份。

下面的二头肌代码对我有用。

注意：- 我正在使用

Username and Password

进行容器注册表。

resource managedEnvironment 'Microsoft.App/managedEnvironments@2024-03-01' existing ={
  name:'managedEnvironment-VivekRG-bff0'
  scope: resourceGroup('Vivek-RG')
}

resource useridentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' existing ={
  name: 'testuseridentity'
  scope: resourceGroup('Vivek-RG')
}

resource keyvault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
  name: 'containerjobkeyvault'
  scope: resourceGroup('Vivek-RG')
 }

resource secret 'Microsoft.KeyVault/vaults/secrets@2024-04-01-preview' existing = {
 name: 'sbconn'
 parent: keyvault
}

resource platformIoTTransformJob 'Microsoft.App/jobs@2024-03-01' = {
  name: 'containerjob25julybicep'  
  location: 'Australia East'  
  properties: {
    environmentId: managedEnvironment.id  
    configuration: {
      registries: [
        {
          server: 'vivek.azurecr.io'  
          username: 'vivek'
          passwordSecretRef: 'password'  
        }
      ]
      secrets:[
        {
          name: 'password'
          value: 'xxxxxxxxx'
        }
        {
          name: 'servicebus'
          keyVaultUrl: secret.properties.secretUri
          identity: useridentity.id
        }
      ]
      manualTriggerConfig: {
        replicaCompletionCount: 1
        parallelism: 1
      }
      eventTriggerConfig: {
        replicaCompletionCount: 1
        parallelism: 1
        scale: {
          minExecutions: 0
          maxExecutions: 5
          pollingInterval: 30
          rules: [
            {
              name: 'azure-servicebus-topic-rule'
              type: 'azure-servicebus'
              metadata: {
                topicName: 'testtopic'  
                subscriptionName: 'testsub' 
                messageCount: '5' 
              }
              auth: [{
                secretRef: 'servicebus'
                triggerParameter: 'connection'
              }]
            }
          ]
        }
      }
      replicaRetryLimit: 0  
      replicaTimeout: 1800  
      triggerType: 'Event'
    }
    template: {
      containers: [
        {
          image: 'vivek.azurecr.io/sbcontainerjobtopic:latest'  
          name: 'containerjob25julybicep'  
          
          args: []
          command: []
          resources: {
            cpu: json('0.5')  
            memory: '1.0Gi'  
          }
        }
      ]
    }
  }
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${useridentity.id}':{}
    }
  }
}

处理消息的Python代码

from azure.identity import ManagedIdentityCredential
from azure.servicebus import ServiceBusClient, ServiceBusMessage

SERVICE_BUS_NAMESPACE = "https://sbjobs.servicebus.windows.net"
TOPIC_NAME = "testtopic"
SUB_NAME = "testsub"
MANAGED_IDENTITY_CLIENT_ID = "xxxxxxxxxxxxxxxxxxxxxxxxxx"

credential = ManagedIdentityCredential(client_id=MANAGED_IDENTITY_CLIENT_ID)




service_bus_client = ServiceBusClient(
    fully_qualified_namespace=SERVICE_BUS_NAMESPACE,
    credential=credential
)

with service_bus_client:
    receiver = service_bus_client.get_subscription_receiver(topic_name=TOPIC_NAME ,subscription_name=SUB_NAME)
    with receiver:
        received_msgs = receiver.receive_messages(max_message_count=10, max_wait_time=5)
        for msg in received_msgs:
            print("Received: " + str(msg))
            receiver.complete_message(msg)

print("Receive messages completed.")

OUTPUT