Azure Function部署时无法导入cryptography的x509模块求助

部署场景 #

• 采用WEBSITE_RUN_FROM_PACKAGE = <STORAGE_BLOB_URL>方式，将Python运行时、Linux操作系统的Azure Function部署到专用子网，以消除公网流量。
• 函数代码中的依赖导入：

import logging
import os
import azure.functions as func
from azure.identity import DefaultAzureCredential, CredentialUnavailableError
from azure.keyvault.secrets import SecretClient
from azure.core.exceptions import ResourceNotFoundError, ClientAuthenticationError

本地准备流程 #

1. 在虚拟环境中安装requirements.txt依赖：

azure-functions
azure-identity
azure-keyvault-secrets
pymssql

2. 本地执行func start验证，函数运行正常无报错。
3. 用pip freeze命令锁定依赖版本并更新requirements.txt，随后执行以下命令将依赖安装到指定目录：

pip install --target="./.python_packages/lib/site-packages" --upgrade -r requirements.txt

4. 将包含代码和依赖的zip包上传至Blob存储，在配置了Microsoft.Storage端点的专用子网中创建Function App。

错误现象 #

函数监控输出显示依赖解析失败，核心错误信息：

Result: Failure Exception: ImportError: cannot import name 'x509' from 'cryptography.hazmat.bindings._rust' (unknown location)

完整错误栈：

Result: Failure Exception: ImportError: cannot import name 'x509' from 'cryptography.hazmat.bindings._rust' (unknown location). Please check the requirements.txt file for the missing module. For more info, please refer the troubleshooting guide: https://aka.ms/functions-modulenotfound Stack: File "/azure-functions-host/workers/python/3.10/LINUX/X64/azure_functions_worker/dispatcher.py", line 387, in _handle__function_load_request func = loader.load_function( File "/azure-functions-host/workers/python/3.10/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 48, in call raise extend_exception_message(e, message) File "/azure-functions-host/workers/python/3.10/LINUX/X64/azure_functions_worker/utils/wrappers.py", line 44, in call return func(*args, **kwargs) File "/azure-functions-host/workers/python/3.10/LINUX/X64/azure_functions_worker/loader.py", line 194, in load_function mod = importlib.import_module(fullmodname) File "/usr/local/lib/python3.10/importlib/__init__.py", line 126, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "<frozen importlib._bootstrap>", line 1050, in _gcd_import File "<frozen importlib._bootstrap>", line 1027, in _find_and_load File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 688, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 883, in exec_module File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed File "/home/site/wwwroot/function_folder/__init__.py", line 4, in <module> from azure.identity import DefaultAzureCredential, CredentialUnavailableError File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/__init__.py", line 10, in <module> from ._credentials import ( File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_credentials/__init__.py", line 5, in <module> from .authorization_code import AuthorizationCodeCredential File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_credentials/authorization_code.py", line 9, in <module> from .._internal.aad_client import AadClient File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_internal/__init__.py", line 5, in <module> from .aad_client import AadClient File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_internal/aad_client.py", line 11, in <module> from .aad_client_base import AadClientBase File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_internal/aad_client_base.py", line 20, in <module> from .aadclient_certificate import AadClientCertificate File "/home/site/wwwroot/.python_packages/lib/site-packages/azure/identity/_internal/aadclient_certificate.py", line 7, in <module> from cryptography import x509 File "/home/site/wwwroot/.python_packages/lib/site-packages/cryptography/x509/__init__.py", line 7, in <module> from cryptography.x509 import certificate_transparency File "/home/site/wwwroot/.python_packages/lib/site-packages/cryptography/x509/certificate_transparency.py", line 11, in <module> from cryptography.hazmat.bindings._rust import x509 as rust_x509

已配置的应用设置 #

SCM_DO_BUILD_DURING_DEPLOYMENT = true
ENABLE_ORYX_BUILD = true
FUNCTIONS_WORKER_RUNTIME = true

• 使用Basic服务计划（因需VNet集成，未采用消费计划）
• 尝试通过Kudu SSH登录到wwwroot目录重新安装依赖，错误依旧

疑问 #

这是azure-identity与cryptography的特定依赖冲突问题，还是部署到Azure Function App专用子网需要采用官方文档未提及的特殊方法？

内容的提问来源于stack exchange，提问作者RAH