如何将Terraform输出的公网IP传递给Azure DevOps流水线变量？

使用Azure DevOps流水线通过Terraform部署虚拟机（VM）后，无法将output.tf中捕获的公网IP传递到后续WinRM连接步骤，导致public_ip变量为空，触发New-PSSession参数验证错误。

报错信息 #

New-PSSession : Cannot validate argument on parameter 'ComputerName'. The argument is null or empty. Provide an 
argument that is not null or empty, and then try the command again.
At D:\a\_temp\azureclitaskscript1726051757039_inlinescript.ps1:6 char:40
+ $session = New-PSSession -ComputerName $publicip -Credential $credent ...
+                                        ~~~~~~~~~
    + CategoryInfo          : InvalidData: (:) [New-PSSession], ParentContainsErrorRecordException
    + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.PowerShell.Commands.NewPSSessionCommand
 
##[error]Script failed with exit code: 1

错误原因 #

• 跨阶段引用输出变量时语法错误：缺少任务名称前缀，导致无法正确获取前阶段的输出变量
• Terraform输出可能未正确定义，或PowerShell脚本未成功解析输出内容

解决方案 #

1. 修正跨阶段变量引用语法 #

在bacpacoperations阶段的downloadbacpac作业中，变量引用需包含任务名称，格式为：
$[ stageDependencies.<阶段名>.<作业名>.<任务名>.outputs['<变量名>'] ]

2. 确保Terraform输出定义正确 #

检查output.tf中public_ip的定义，确保指向正确的资源属性：

output "public_ip" {
  type        = string
  description = "Public IP address of the deployed VM"
  value       = azurerm_public_ip.vm_public_ip.ip_address # 替换为你的公网IP资源名称
}

3. 优化PowerShell捕获脚本 #

添加错误处理，确保Terraform输出解析成功，避免空值传递：

$tfOutput = terraform output -json | ConvertFrom-Json -ErrorAction Stop
if (-not $tfOutput.public_ip.value) {
  throw "Failed to retrieve valid public IP from Terraform output"
}
$publicIp = $tfOutput.public_ip.value
Write-Host "##vso[task.setvariable variable=publicIp;isOutput=true]$publicIp"
Write-Host "Captured Public IP: $publicIp"

4. 添加变量验证步骤 #

在bacpacoperations阶段开头添加变量打印步骤，确认public_ip是否正确获取：

- task: PowerShell@2
  displayName: 'Verify Public IP Variable'
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "Received Public IP: $(public_ip)"

修改后的完整流水线YAML #

trigger:
  none

pool:
  vmImage: 'windows-latest'

variables:
  bkrg: 'CloudOPs_OPS_RG'
  bkstorage: 'xxxxxxxxxx'
  bkcontainer: 'terraformmtp'
  bkkey: 'terraform.tfstate'
  adminUsername: 'xxxxxxxxxxxx'
  adminPassword: 'xxxxxxxxxxxxx' 

parameters:
  - name: bacpacSasToken
    displayName: 'Bacpac SAS Token'
    type: string

stages:
- stage: 'tfvalidate'
  jobs:
    - job: 'validate'
      continueOnError: false
      steps:
        - task: TerraformInstaller@0
          displayName: 'Install Terraform'
          inputs:
            terraformVersion: 'latest'

        - task: TerraformTaskV3@3
          displayName: 'Terraform init'
          inputs:
            provider: 'azurerm'
            command: 'init'
            backendServiceArm: 'xxxxxxxxxxxxxxxx'
            backendAzureRmResourceGroupName: '$(bkrg)'
            backendAzureRmStorageAccountName: '$(bkstorage)'
            backendAzureRmContainerName: '$(bkcontainer)'
            backendAzureRmKey: '$(bkkey)'

        - task: TerraformTaskV3@3
          displayName: 'Terraform validate'
          inputs:
            provider: 'azurerm'
            command: 'validate'

- stage: 'tfdeploy'
  condition: succeeded('tfvalidate')
  dependsOn: 'tfvalidate'
  jobs:
    - job: 'apply'
      steps:
        - task: TerraformInstaller@0
          displayName: 'Install Terraform'
          inputs:
            terraformVersion: 'latest'

        - task: TerraformTaskV3@3
          displayName: 'Terraform init'
          inputs:
            provider: 'azurerm'
            command: 'init'
            backendServiceArm: 'xxxxxxxxxxxxxxxx'
            backendAzureRmResourceGroupName: '$(bkrg)'
            backendAzureRmStorageAccountName: '$(bkstorage)'
            backendAzureRmContainerName: '$(bkcontainer)'
            backendAzureRmKey: '$(bkkey)'

        - task: TerraformTaskV3@3
          displayName: 'Terraform plan'
          inputs:
            provider: 'azurerm'
            command: 'plan'
            environmentServiceNameAzureRM: 'xxxxxxxxxxxxxxxx'

        - task: TerraformTaskV3@3
          displayName: 'Terraform apply'
          inputs:
            provider: 'azurerm'
            command: 'apply'
            environmentServiceNameAzureRM: 'xxxxxxxxxxxxxxxx'

        - task: PowerShell@2
          name: 'CapturePublicIp' # 添加任务名称，用于跨阶段引用
          displayName: 'Capture public IP and push to pipeline variable'
          inputs:
            targetType: 'inline'
            script: |
              $tfOutput = terraform output -json | ConvertFrom-Json -ErrorAction Stop
              if (-not $tfOutput.public_ip.value) {
                throw "Failed to retrieve valid public IP from Terraform output"
              }
              $publicIp = $tfOutput.public_ip.value
              Write-Host "##vso[task.setvariable variable=publicIp;isOutput=true]$publicIp"
              Write-Host "Captured Public IP: $publicIp"

- stage: 'bacpacoperations'
  condition: succeeded('tfdeploy')
  dependsOn: 'tfdeploy'
  jobs:
    - job: 'downloadbacpac'
      variables:
        # 修正变量引用，添加任务名称CapturePublicIp
        public_ip: $[ stageDependencies.tfdeploy.apply.outputs['CapturePublicIp.publicIp'] ]
      steps:
        - task: PowerShell@2
          displayName: 'Verify Public IP Variable'
          inputs:
            targetType: 'inline'
            script: |
              Write-Host "Received Public IP: $(public_ip)"

        - task: AzureCLI@2
          displayName: 'Azure CLI'
          inputs:
            azureSubscription: 'xxxxxxxxxxxxxxxx'
            scriptType: 'ps' 
            scriptLocation: 'inlineScript'
            inlineScript: |
              $publicip = "$(public_ip)"
              $username = "$(adminUsername)"
              $password = "$(adminPassword)"
              $securePassword = ConvertTo-SecureString $password -AsPlainText -Force
              $credential = New-Object System.Management.Automation.PSCredential ($username, $securePassword)
              $session = New-PSSession -ComputerName $publicip -Credential $credential -UseSSL -Port 5986
              Invoke-Command -Session $session -ScriptBlock { 
                cd $using:env:SYSTEM_DEFAULTWORKINGDIRECTORY
                ./downloadbacpac.ps1 -bacpacSasToken "$using:bacpacSasToken" -localPath "f:\\"
              }
              Remove-PSSession -Session $session

注意：修改后的代码中，CapturePublicIp是PowerShell任务的名称，必须和变量引用中的名称一致；同时在WinRM脚本块中使用$using:前缀引用流水线变量，避免作用域问题。

内容的提问来源于stack exchange，提问作者Brayhan Castro