私有网络环境下无法下载Azure DevOps Pipeline工件求助

数据老陈

2026-7-22

问题

我们创建了一个Azure私有Kubernetes集群，拦截了所有入站和出站流量，已开放dev.azure.com、08wvsblobprodsu6weus73.vsblob.vsassets.io等相关URL的网络访问。执行以下命令：

azure-pod:/# az pipelines runs artifact download --artifact-name drop --path "/Downloads" --run-id 36312 --project "xxx" --organization "https://dev.azure.com/xxx" --debug

该命令可完成工件工具下载、az登录，但在获取工件的manifest ID后失败，且无法从调试日志中得知被拦截的URL。需要知晓此时az cli请求的URL，以便为私有集群开放访问权限。

错误信息如下：

cli.azext_devops.dev.common.services: received PAT from environment variable
cli.azext_devops.dev.common.services: Creating connection with personal access token.
cli.azext_devops.dev.common.external_tool: Running external command: /root/.azure/azuredevops/cli/tools/artifacttool/ArtifactTool_alpine-x64_0.2.267/artifacttool pipelineartifact download --service https://dev.azure.com/neste --patvar AZURE_DEVOPS_EXT_ARTIFACTTOOL_PATVAR --project Azure Cloud Foundation --pipeline-id 36312 --artifact-name drop --path /Users/jordan/Downloads
cli.azext_devops.dev.common.artifacttool: Getting artifact 'drop' from pipeline '36312' from project 'Azure Cloud Foundation' in organization 'https://dev.azure.com/neste'.
cli.azext_devops.dev.common.artifacttool: The manifest ID for artifact 'drop' is '50A3D1FD9711ACC74B393E5CF30735BF5D2763473309DA9611D86E47DE96F54801'.
cli.azext_devops.dev.common.artifacttool: Encountered an unexpected error.
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---&gt; System.IO.IOException: Authentication failed because the remote party has closed the transport stream.
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslStream.ThrowIfExceptional()
   at System.Net.Security.SslStream.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.&lt;&gt;c.&lt;AuthenticateAsClientAsync&gt;b__65_1(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync(HttpRequestMessage message, HttpCompletionOption completionOption, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync[T](HttpRequestMessage message, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Location.Client.LocationHttpClient.GetConnectionDataAsync(ConnectOptions connectOptions, Int64 lastChangeId, CancellationToken cancellationToken, Object userState)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.GetConnectionDataAsync(ConnectOptions connectOptions, Int32 lastChangeId, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.VssServerDataProvider.ConnectAsync(ConnectOptions connectOptions, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.LocationService.CreateDataProviderAsync(String location, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.LocationService.ResolveLocationDataAsync(Guid locationAreaIdentifier, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.Location.LocationService.GetLocationDataAsync(Guid locationAreaIdentifier, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssConnection.GetClientInstanceAsync(Type managedType, Guid serviceIdentifier, CancellationToken cancellationToken, VssHttpRequestSettings settings, DelegatingHandler[] handlers)
   at Microsoft.VisualStudio.Services.WebApi.VssConnection.GetClientServiceImplAsync(Type requestedType, Guid serviceIdentifier, Func`4 getInstanceAsync, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.WebApi.VssConnection.GetClientAsync[T](CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Content.Common.AsyncHttpRetryHelper`1.InvokeAsync(CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Content.Common.ExceptionExtensions.ReThrow(Exception ex)
   at Microsoft.VisualStudio.Services.Content.Common.AsyncHttpRetryHelper`1.InvokeAsync(CancellationToken cancellationToken)
   at ArtifactTool.DedupManifestArtifactClientProvider.GetDedupManifestArtifactClientAsync(String serviceUrl, String patVar, ILogger commandBaseLogger, IAppTraceSource tracer, String cacheDirectory, Boolean cacheWriteAllowed, CancellationToken cancellationToken) in D:\\a\\1\\s\\src\\ArtifactTool\\Providers\\DedupManifestArtifactClient\\DedupManifestArtifactClientProvider.cs:line 56
   at ArtifactTool.Commands.PipelineArtifactDownloadCommand.ExecuteAsync() in D:\\a\\1\\s\\src\\ArtifactTool\\Commands\\PipelineArtifacts\\PipelineArtifactDownloadCommand.cs:line 46
   at ArtifactTool.Commands.CommandBase.OnExecuteAsync() in D:\\a\\1\\s\\src\\ArtifactTool\\Commands\\CommandBase.cs:line 105
   at McMaster.Extensions.CommandLineUtils.Conventions.ExecuteMethodConvention.InvokeAsync(MethodInfo method, Object instance, Object[] arguments) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\Conventions\\ExecuteMethodConvention.cs:line 77
   at McMaster.Extensions.CommandLineUtils.Conventions.ExecuteMethodConvention.OnExecute(ConventionContext context) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\Conventions\\ExecuteMethodConvention.cs:line 62
   at McMaster.Extensions.CommandLineUtils.Conventions.ExecuteMethodConvention.&lt;&gt;c__DisplayClass0_0.&lt;&lt;Apply&gt;b__0&gt;d.MoveNext() in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\Conventions\\ExecuteMethodConvention.cs:line 25
--- End of stack trace from previous location where exception was thrown ---
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.&lt;&gt;c__DisplayClass126_0.&lt;OnExecute&gt;b__0() in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.cs:line 505
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.Execute(String[] args) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.cs:line 611
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.Execute[TApp](CommandLineContext context) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.Execute.cs:line 57
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.ExecuteAsync[TApp](CommandLineContext context) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.Execute.cs:line 145
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.ExecuteAsync[TApp](IConsole console, String[] args) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.Execute.cs:line 130
   at McMaster.Extensions.CommandLineUtils.CommandLineApplication.ExecuteAsync[TApp](String[] args) in C:\\projects\\commandlineutils\\src\\CommandLineUtils\\CommandLineApplication.Execute.cs:line 112

解决方案

获取manifest ID后，az cli实际调用ArtifactTool工具下载工件，此时需要开放以下几类URL：

Azure Artifacts存储端点：格式通常为 *.artifactcache.azureedge.net，或组织对应的专属存储账户域名（如 xxx.blob.core.windows.net，xxx为组织前缀）
Azure DevOps区域服务URL：需开放身份验证及子服务端点，如 vssps.dev.azure.com、vsaex.dev.azure.com
扩展工件服务端点：建议用通配符开放所有 *.vsassets.io 子域名，避免遗漏

若需精准定位被拦截的URL，可采用两种方法：

Pod内抓包分析：执行tcpdump抓取HTTPS流量，导出后用Wireshark查看目标地址

tcpdump -i any port 443 -w artifact-traffic.pcap

启用ArtifactTool详细日志：设置环境变量后再执行命令，日志会包含完整请求URL

export ARTIFACTTOOL_TRACE=1
az pipelines runs artifact download --artifact-name drop --path "/Downloads" --run-id 36312 --project "xxx" --organization "https://dev.azure.com/xxx" --debug

内容的提问来源于stack exchange，提问作者user13220731