如何为部署Azure Function Apps配置Azure Pipeline审批检查

针对你遇到的「无法通过Environment关联K8s/VM资源来配置审批」的问题，无需依赖Environment的资源绑定，直接在Stage级别配置审批规则即可实现需求，以下是具体的拆分配置和代码示例：

一、开发环境流水线（自动触发·无审批） #

保持自动触发逻辑，直接部署至开发环境：

trigger: 
  branches:
    include:
      - develop  # 替换为你的开发分支
  paths:
    include:
      - function-app/**

resources:
  repositories:
    - repository: aomdevops
      type: git
      name: AOM-Core/AOM-Devops

variables:
  - name: postmanEnv
    value: "postman/telco_local.postman_environment.json"

pool:
  vmImage: ubuntu-latest

stages:
  - stage: Deploy_Dev
    displayName: "部署至开发环境"
    jobs:
      - job: DeployExtractInfo_Dev
        displayName: "部署Extract Info（开发）"
        steps:
          - template: templates/funcapp-deployment.yaml
            parameters:
              faName: 'funcapp-dev-xxxxxxxxx'  # 开发环境Function App名称
              resourceGroup: 'rg-dev-xxxxxxxxxxxxxxxx'
              azureSvcConn: 'aom-azure'
              funcAppFolder: 'function-app/xxxxxxxxxxx/'
              funcAppName: 'exInfo'

      - job: DeployErrorHandling_Dev
        displayName: "部署Error Handling（开发）"
        steps:
          - template: templates/funcapp-deployment.yaml
            parameters:
              faName: 'funcapp-dev-xxxxxxxxxxxxxxxxxxxxxx'
              resourceGroup: 'rg-dev-xxxxxxxxxxxxxxxxx'
              azureSvcConn: 'aom-azure'
              funcAppFolder: 'function-app/xxxxxxxxxx/'
              funcAppName: 'errHandling'

二、生产环境流水线（手动触发·需审批） #

禁用自动触发，添加Stage级审批节点，配合Azure DevOps门户的审批人配置实现管控：

trigger: none  # 禁用自动触发，仅支持手动启动

resources:
  repositories:
    - repository: aomdevops
      type: git
      name: AOM-Core/AOM-Devops

variables:
  - name: postmanEnv
    value: "postman/telco_prod.postman_environment.json"  # 替换为生产环境变量文件

pool:
  vmImage: ubuntu-latest

stages:
  - stage: Approval_Prod
    displayName: "生产环境部署审批"
    pool: server
    jobs:
      - deployment: WaitForApproval
        displayName: "等待审批"
        environment: 'Production'  # 仅作为审批标识，无需关联K8s/VM资源
        strategy:
          runOnce:
            deploy:
              steps:
                - script: echo "等待审批人确认..."
                  displayName: "审批等待节点"

  - stage: Deploy_Prod
    displayName: "部署至生产环境"
    dependsOn: Approval_Prod  # 依赖审批阶段，仅审批通过后执行
    jobs:
      - job: DeployExtractInfo_Prod
        displayName: "部署Extract Info（生产）"
        steps:
          - template: templates/funcapp-deployment.yaml
            parameters:
              faName: 'funcapp-prod-xxxxxxxxx'  # 生产环境Function App名称
              resourceGroup: 'rg-prod-xxxxxxxxxxxxxxxx'
              azureSvcConn: 'aom-azure'
              funcAppFolder: 'function-app/xxxxxxxxxxx/'
              funcAppName: 'exInfo'

      - job: DeployErrorHandling_Prod
        displayName: "部署Error Handling（生产）"
        steps:
          - template: templates/funcapp-deployment.yaml
            parameters:
              faName: 'funcapp-prod-xxxxxxxxxxxxxxxxxxxxxx'
              resourceGroup: 'rg-prod-xxxxxxxxxxxxxxxxx'
              azureSvcConn: 'aom-azure'
              funcAppFolder: 'function-app/xxxxxxxxxx/'
              funcAppName: 'errHandling'

三、关键配置说明 #

1. 手动触发控制：通过trigger: none确保生产流水线不会自动触发，只能由人工启动。
2. 审批节点配置：单独设置Approval_Prod阶段，使用deployment类型关联Production环境，此时无需给环境绑定任何K8s/VM资源，仅作为审批规则的载体。
3. 门户配置审批人：进入Azure DevOps项目的「管道→环境」页面，找到Production环境，在「安全」选项卡添加审批人/审批组，开启「部署前审批」规则即可。
4. 共用服务连接：两条流水线可继续使用同一个aom-azure服务连接，只要该连接拥有开发、生产环境Function App的部署权限即可。

内容的提问来源于stack exchange，提问作者P.T