如何在运行时将Azure DevOps变量库值传入Bicep模板

DevOps 小满

2026-7-8

问题描述

我正在创建用于部署SQL Server和数据库的Bicep模板，已实现从Azure DevOps流水线传入环境名参数，需复用该模板部署4个环境（其中3个环境使用同一订阅ID，生产环境使用不同订阅ID）。我已为每个环境创建变量库并关联至流水线，但运行时发现Bicep模板中的sqladminlogin、sqladminpassword参数未获取到变量库的实际值，而是显示字符串$(SqlAdminLogin)、$(SqlAdminPassword)，导致Azure部署失败。请问如何在运行时将变量库中的值正确传入Bicep模板？

提供的Bicep模板

targetScope = 'resourceGroup'

// input parameters
param Environment string
param sqladminlogin string = '${SqlAdminLogin}'
param sqladminpassword string = '{SqlAdminPassword}'
param SqlServerName string = 'SQL-${Environment}01'
param location string = resourceGroup().location
param Sql_DB_Name string = 'SQL-${Environment}'

resource SqlServerName_resource_tst 'Microsoft.Sql/servers@2022-05-01-preview' = {
  name: toLower(SqlServerName)
  location: location
  tags: {
    Service: 'TESTING'
    Environment: Environment
    'Business Owner': 'TBC'
  }
  kind: 'v12.0'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    administratorLogin: sqladminlogin
    administratorLoginPassword: sqladminpassword
    version: '12.0'
    minimalTlsVersion: '1.2'
    publicNetworkAccess: 'Enabled'
    administrators: {
      administratorType: 'ActiveDirectory'
      principalType: 'Group'
      login: 'NSG-AG-SQL-RW-TST'
      sid: '********'
      tenantId: '**********'
      azureADOnlyAuthentication: false
    }
    restrictOutboundNetworkAccess: 'Disabled'
  }
}

提供的Azure DevOps流水线配置

name: bicep-deployment

trigger:
- main

pool:
  vmImage: 'windows-latest'

parameters:
  - name: Environment
    displayName: Environment
    type: string
    default: 'TST'
    values:
      - DEV
      - TST
      - UAT
      - PRD

  - name: Action
    displayName: Action
    type: string
    default: 'Plan'
    values:
      - Plan
      - Apply

variables:
  - name: Environment
    value: '${{ parameters.Environment }}'

  - name: System.Debug
    value: true

  - name: Action
    value: '${{ parameters.Action }}'

  - name: serviceConnection
    ${{ if eq( parameters['Environment'], 'DEV') }}:
      value: "AG-Dev"
    ${{ if eq( parameters['Environment'], 'TST') }}:
      value: "AG-TST"
    ${{ if eq( parameters['Environment'], 'UAT' ) }}:
      value: "AG-UAT"
    ${{ if eq( parameters['Environment'], 'PRD' ) }}:
      value: "AG-PRD"

  - name: resourceGroupName
    ${{ if eq( parameters['Environment'], 'DEV') }}:
      value: "RG-AG-DEV"
    ${{ if eq( parameters['Environment'], 'TST') }}:
      value: "RG-AG-TST"
    ${{ if eq( parameters['Environment'], 'UAT') }}:
      value: "RG-AG-UAT"
    ${{ if eq( parameters['Environment'], 'PRD') }}:
      value: "RG-AG-PR"

  # Select Variable Library to use for the environment.
  - group: ${{parameters.Environment}}

stages:
  # SQL Stages
  - stage: Preview_SQL
    jobs:
    - job: Preview
      steps:
      - task: AzureCLI@2
        inputs:
          azureSubscription: $(serviceConnection)
          scriptType: 'bash'
          scriptLocation: 'inlineScript'
          inlineScript: |
            az deployment group what-if \
              --resource-group '$(resourceGroupName)' \
              --template-file Bicep/SQL/SQL-tst.bicep \
              --parameters Environment="${{ parameters.Environment }}"

  # The deployment only runs if Apply action is selected when running the pipeline and if the validate job succeeds.
  - stage: Deploy_SQL
    dependsOn: Preview_SQL
    jobs:
      - deployment: Deploy_SQL
        displayName: Deploy_SQL
        environment: $(Environment)
        condition: and(succeeded(), eq(variables['Action'], 'Apply'))
        strategy:
          runOnce:
            deploy:
              steps:
                - checkout: self
                - task: AzureCLI@2
                  displayName: Bicep deployment
                  inputs:
                    azureSubscription: $(serviceConnection)
                    scriptType: bash
                    scriptLocation: inlineScript
                    inlineScript: |
                      set -e

                      echo '##[Section]Deploy SQL'

                      az deployment group create \
                        --resource-group $(resourceGroupName) \
                        --name "SQL-deployment" \
                        --template-file Bicep/SQL/SQL-tst.bicep \
                        --parameters Environment="${{ parameters.Environment }}"

解决方案

1. 修正Bicep模板的参数配置

Bicep无法直接识别Azure DevOps的变量语法，你之前写的默认值'${SqlAdminLogin}'只是普通字符串，不会被解析。正确做法是移除参数的硬编码默认值，让流水线在部署时传入实际值：

修改后的Bicep模板：

targetScope = 'resourceGroup'

// input parameters
param Environment string
// 移除错误的默认值，由流水线传入实际值
param sqladminlogin string
param sqladminpassword string
param SqlServerName string = 'SQL-${Environment}01'
param location string = resourceGroup().location
param Sql_DB_Name string = 'SQL-${Environment}'

resource SqlServerName_resource_tst 'Microsoft.Sql/servers@2022-05-01-preview' = {
  name: toLower(SqlServerName)
  location: location
  tags: {
    Service: 'TESTING'
    Environment: Environment
    'Business Owner': 'TBC'
  }
  kind: 'v12.0'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    administratorLogin: sqladminlogin
    administratorLoginPassword: sqladminpassword
    version: '12.0'
    minimalTlsVersion: '1.2'
    publicNetworkAccess: 'Enabled'
    administrators: {
      administratorType: 'ActiveDirectory'
      principalType: 'Group'
      login: 'NSG-AG-SQL-RW-TST'
      sid: '********'
      tenantId: '**********'
      azureADOnlyAuthentication: false
    }
    restrictOutboundNetworkAccess: 'Disabled'
  }
}

2. 更新流水线的参数传递逻辑

需要在AzureCLI任务的部署命令中，显式传入sqladminlogin和sqladminpassword参数，引用变量库中的值：

修改Preview_SQL阶段的任务

- task: AzureCLI@2
  inputs:
    azureSubscription: $(serviceConnection)
    scriptType: 'bash'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az deployment group what-if \
        --resource-group '$(resourceGroupName)' \
        --template-file Bicep/SQL/SQL-tst.bicep \
        --parameters Environment="${{ parameters.Environment }}" \
        sqladminlogin="$(SqlAdminLogin)" \
        sqladminpassword="$(SqlAdminPassword)"

修改Deploy_SQL阶段的任务

- task: AzureCLI@2
  displayName: Bicep deployment
  inputs:
    azureSubscription: $(serviceConnection)
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      set -e

      echo '##[Section]Deploy SQL'

      az deployment group create \
        --resource-group $(resourceGroupName) \
        --name "SQL-deployment" \
        --template-file Bicep/SQL/SQL-tst.bicep \
        --parameters Environment="${{ parameters.Environment }}" \
        sqladminlogin="$(SqlAdminLogin)" \
        sqladminpassword="$(SqlAdminPassword)"

3. 验证变量库配置

确保每个环境的变量库（DEV/TST/UAT/PRD）中存在SqlAdminLogin和SqlAdminPassword变量，机密变量无需额外处理，Azure DevOps会自动掩码并传递。

关键说明

Bicep运行在Azure环境中，无法直接读取Azure DevOps的变量，必须通过部署命令的--parameters参数显式传递。
流水线中通过- group: ${{parameters.Environment}}关联的变量库，其变量可直接用$(变量名)在脚本中引用。

内容的提问来源于stack exchange，提问作者Darren

如何在运行时将Azure DevOps变量库值传入Bicep模板

提供的Bicep模板 #

提供的Azure DevOps流水线配置 #

1. 修正Bicep模板的参数配置 #

2. 更新流水线的参数传递逻辑 #

修改Preview_SQL阶段的任务 #

修改Deploy_SQL阶段的任务 #

3. 验证变量库配置 #

关键说明 #