azure - 从 yaml 管道中的变量组参数化 azureSubscription

Question

我正在将 Yaml 用于 Azure DevOps 管道。我为此使用了分层样式。

我有一个顶级 yaml:feature.yaml其结构如下:

trigger:
...
pool:
  vmImage: ...
  
variables:
  group: ...

stages:
  - template: deploy.yaml
    parameters:
      subName: $(subscription) #This should be taken from Variable group

我的deploy.yaml为:

stages:
    - stage: deploy
      jobs:
        - job: deploy
          steps:
          - task: AzureKeyVault@1
            inputs:
              azureSubscription: $(paramaters.subName) #This should be resolved from parameter passed form feature.yaml
              KeyVaultName: ...
              SecretsFilter: '*'
              RunAsPreJob: true

但是，每当我从 Azure DevOps 运行此程序时，都会收到此错误:

There was a resource authorization issue: "The pipeline is not valid. Job deploy: Step AzureKeyVault input ConnectedServiceName references service connection $(paramaters.subName) which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz."

管道似乎无法从变量组解析 azureSubscription 名称的值。

有什么建议吗？

Answer 1

我发现，当 YAML 最初被解析时，它期望变量组在范围内。我需要将变量组移动到 YAML 文件的顶部，然后它找到了 azure 订阅变量。不是我所期待的。