Terraform INIT 失败并出现 azure 在 ACI 上开发自托管代理

Question

I have 2 terraform pipelines in azure devops:

1- provisions vnet and azure container instance and registers it as an agent pool node. 2- uses the self hosted agent pool which uses the aci from the first pipeline to provision other stuff.

The second pipeline fails when it reached init with the following message

##[error]Terraform command 'init' failed with exit code '1'.:  Failed to get existing workspaces: containers.Client#ListBlobs: Failure sending request: StatusCode=0 -- Original Error: Get "https://xxx.blob.core.windows.net/terraform?comp=list&prefix=xxx-infra-dev.tfstateenv%253A&restype=container": dial tcp xx.xxx.xx.x:443: connect: connection timed out

This is how I provision the agent with ACI:

terraform {
  required_version = "~> 0.13"
  backend "azurerm" {}
}
provider "azurerm" {
  version                    = "~> 2.8.0"
  skip_provider_registration = true
  features {}
}


module "aci-devops-agent" {
  source                   = "Azure/aci-devops-agent/azurerm"
  resource_group_name      = var.resource_group_name
  location                 = var.location
  enable_vnet_integration  = true
  create_resource_group    = false
  vnet_resource_group_name = var.resource_group_name
  vnet_name                = local.virtual_network_name
  subnet_name              = data.azurerm_subnet.subnet["mgmt"].name

  linux_agents_configuration = {
    agent_name_prefix = "aci-${var.environment}-${var.app_name}"
    agent_pool_name   = var.agent_pool_name
    count             = 1,
    docker_image      = "jcorioland/aci-devops-agent"
    docker_tag        = "0.2-linux"
    cpu               = 1
    memory            = 4
  }

  azure_devops_org_name              = "xxx"
  azure_devops_personal_access_token = var.pat

}

and the agent is successfully detected

where is the problem? I have a feeling it's from the ACI and maybe something related to the token but all looks green?

appreciate your help !

Answer 1

It looks like an issue with the network settings of the ACI created in your first pipeline.

You can check the network settings of the ACI, and make sure you can connect to the internet from the ACI.

Please check the examples in this blog to provision self-hosted agents on ACI.

See the this similar issue .

Answer 2

solution: was to re-create the PAT token in ADO.

Troubleshooting steps: checked /azp/agent/_diag/Agent_xxx-utc.log and i saw 401 error message:

[2020-12-13 07:47:36Z INFO RSAFileKeyManager] Loading RSA key parameters from file /azp/agent/.credentials_rsaparams
[2020-12-13 07:47:36Z INFO VisualStudioServices] AAD Correlation ID for this token request: Unknown
[2020-12-13 08:09:17Z INFO MessageListener] No message retrieved from session 'xxx' within last 30 minutes.
[2020-12-13 08:39:17Z INFO MessageListener] No message retrieved from session 'xxx' within last 30 minutes.
[2020-12-13 08:42:37Z WARN VisualStudioServices] Authentication failed with status code 401.

and then recreated the PAT and it worked fine.

Notes:

• The terraform error message was misleading since it was dial tcp xx.xxx.xx.x:443: connect: connection timed out
• the new PAT token was created exactly like the old token, I have no idea why the new one worked and the old one didn't.