Ruby on Rails Active Storage能否通过托管身份连接Azure？报错求助

配置过程 #

最初我通过密钥方式完成了Rails侧Azure存储的Active Storage配置，配置内容如下：

azure:
  service: AzureStorage
  storage_account_name: <%= ENV['AZURE_STORAGE_ACCOUNT_NAME'] %>
  storage_access_key: <%= ENV['AZURE_STORAGE_ACCESS_KEY'] %>
  container: <%= ENV['AZURE_STORAGE_CONTAINER'] %>

之后尝试通过托管身份连接Azure存储，修改后的Active Storage配置为：

azure:
  service: AzureStorage
  storage_account_name: <%= VaultService.get_secret("AZURE-STORAGE::AZURE-STORAGE-ACCOUNT-NAME") %>
  signer: <%= Storage::Azure::Client.get_token_signer %> 
  container: <%= VaultService.get_secret('AZURE-ATTACHMENTS-BUCKET-NAME') %>

为获取配置中的signer值，编写了如下Ruby方法：

def self.get_token_signer
  # 获取访问令牌
  access_token = AzureAd::ManagedIdentityTokenProvider.new('https://storage.azure.com/', client_id: ENV['AKS_MANAGED_IDENTITY_ID']).get_authentication_header.split(' ').last
  # 创建TokenCredential实例
  token_credential = ::Azure::Storage::Common::Core::TokenCredential.new access_token
  token_signer = ::Azure::Storage::Common::Core::Auth::TokenSigner.new token_credential
  token_signer
end

其中AzureAd::ManagedIdentityTokenProvider参考了Azure Ruby SDK中的MSI令牌提供器实现。

报错信息 #

运行时出现连接拒绝错误：

##[error]#38 6.433 Errno::ECONNREFUSED: Connection refused - connect(2) for "169.254.169.254" port 80
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `initialize'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `open'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1271:in `block in connect'
##[error]#38 6.433 /usr/local/bundle/gems/timeout-0.3.2/lib/timeout.rb:189:in `block in timeout'
##[error]#38 6.433 /usr/local/bundle/gems/timeout-0.3.2/lib/timeout.rb:196:in `timeout'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1269:in `connect'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-instrumentation-net_http-0.19.4/lib/opentelemetry/instrumentation/net/http/patches/instrumentation.rb:59:in `block in connect'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace/tracer.rb:29:in `block in in_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace.rb:82:in `block in with_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/context.rb:87:in `with_value'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-api-1.0.1/lib/opentelemetry/trace/tracer.rb:29:in `in_span'
##[error]#38 6.433 /usr/local/bundle/gems/opentelemetry-instrumentation-net_http-0.19.4/lib/opentelemetry/instrumentation/net/http/patches/instrumentation.rb:58:in `connect'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1248:in `do_start'
##[error]#38 6.433 /usr/lib/ruby/3.2.0/net/http.rb:1237:in `start'

问题 #

1. 是否可以通过上述方式（自定义signer+托管身份）连接Active Storage与Azure存储？
2. 如何解决当前的连接拒绝报错？

内容的提问来源于stack exchange，提问作者Vansh