使用 Azure Devops Pipeline 将数据复制到没有公共网络访问权限的存储帐户

Question

I'm trying to backup a Azure DevOps repo using the following guide: https://charbelnemnom.com/how-to-backup-azure-devops-git-repositories/

My YAML-File is as follows:

# Starter pipeline
# Start with a minimal pipeline that you can customize to build and deploy your code.
# Add steps that build, run tests, deploy, and more:
# https://aka.ms/yaml

trigger:
  branches:
   include:
     - '*'
stages: 
- stage: _default
  jobs:
  - job: Job
    pool:
      vmImage: windows-latest
    steps:
    - task: CmdLine@2
      inputs:
        script: git clone --mirror https://PATTokenXXXX@dev.azure.com/btc-cloud/test/_git/testrepo
    - task: ArchiveFiles@2
      inputs:
       rootFolderorFile: $(System.DefaultWorkingDirectory)/testrepo.git
       includeRootFolder: true
       archiveType: zip
       archiveFile: $(Build.ArtifactStagingDirectory)/Backup.zip
    - task: AzureFileCopy@3
      displayName: AzureBlob File Copy
      inputs:
        SourcePath: $(Build.ArtifactStagingDirectory)/Backup.zip
        azureSubscription: test backup of devops repo
        Destination: AzureBlob
        storage: 'storageaccountname'
        ContainerName: 'devopsbackup'
        BlobPrefix: 'az-devops-repo-backup'

The Pipeline is working fine as long as the Public Network Access is on Enabled from all networks . But when I disable public network access, the Pipeline doesn't work anymore. Is there a way to implement the pipeline to use a private Network, maybe through a private endpoint? But since I don't see a way how to add the DevOps pipeline to a private network, I'm kind of lost how to make the pipeline work when the storage account has public network access disabled. Does someone maybe know how to do it or know an alternative way to backup Azure DevOps projects?

Thanks and best regards!

Answer 1

You need to run agent on machine that has access to your private network. Usually this can be achieved by using self-hosted agents (installed on VM, VMSS or on container instance) with access to your private network.

If you use Azure DevOps you may add new pool from organization settings.

Default Azure agents use public access and won't be able to access storage account with access limited only to private network.

More details you may find here