如何避免新启动时出现Azure.Identity.CredentialUnavailableException异常

将使用托管标识连接Azure服务总线的Web应用部署在Azure Kubernetes环境中，采用DefaultAzureCredential实现本地与云端兼容的认证。首次部署后前几分钟日志中出现大量Azure.Identity.CredentialUnavailableException异常，2-3分钟后连接恢复正常。推测是托管标识与新虚拟机的关联流程未完成，组件重试导致日志异常。尝试过自定义IHealthCheck但无法判断连接状态，也未找到Azure.Messaging.ServiceBus连接控制的相关信息，希望了解如何提前验证连接状态、控制重试策略以避免日志中出现这类异常。

1. 调整DefaultAzureCredential的重试与日志过滤 #

• 配置DefaultAzureCredentialOptions限制初期重试频率，减少异常日志输出：

  var credentialOptions = new DefaultAzureCredentialOptions
  {
      Retry =
      {
          MaxRetries = 2, // 降低初期重试次数
          Delay = TimeSpan.FromSeconds(15), // 拉长重试间隔
          MaxDelay = TimeSpan.FromSeconds(60)
      }
  };
  var credential = new DefaultAzureCredential(credentialOptions);
  

• 在日志框架（如Serilog、NLog）中添加过滤规则，暂时忽略启动初期的CredentialUnavailableException，例如Serilog配置：

  .Filter.ByExcluding(logEvent => 
      logEvent.Exception is Azure.Identity.CredentialUnavailableException 
      && logEvent.Timestamp - DateTime.UtcNow < TimeSpan.FromMinutes(3))
  

2. 改进健康检查逻辑，先验证托管标识就绪状态 #

自定义IHealthCheck时，优先验证托管标识能否获取ServiceBus访问令牌，再检查服务总线连接：

public class ServiceBusIdentityHealthCheck : IHealthCheck
{
    private readonly TokenCredential _credential;

    public ServiceBusIdentityHealthCheck(TokenCredential credential)
    {
        _credential = credential;
    }

    public async Task<HealthCheckResult> CheckHealthAsync(HealthCheckContext context, CancellationToken cancellationToken = default)
    {
        try
        {
            // 尝试获取ServiceBus访问令牌
            var token = await _credential.GetTokenAsync(
                new TokenRequestContext(new[] { "https://servicebus.azure.net/.default" }),
                cancellationToken);

            if (!string.IsNullOrEmpty(token.Token))
            {
                // 令牌有效，执行轻量ServiceBus连接检查
                var client = new ServiceBusClient("<service-bus-namespace>", _credential);
                using var receiver = client.CreateReceiver("<queue-name>");
                var runtimeInfo = await receiver.GetQueueRuntimeInfoAsync(cancellationToken);
                return HealthCheckResult.Healthy("托管标识就绪，ServiceBus连接正常");
            }
            return HealthCheckResult.Unhealthy("未能获取有效访问令牌");
        }
        catch (Exception ex)
        {
            return HealthCheckResult.Degraded("托管标识未就绪或ServiceBus连接失败", ex);
        }
    }
}

• 注册健康检查时设置初始延迟和重试间隔，避免应用刚启动就触发检查：

services.AddHealthChecks()
    .AddCheck<ServiceBusIdentityHealthCheck>("service_bus_identity", 
        failureStatus: HealthStatus.Degraded,
        timeout: TimeSpan.FromSeconds(10),
        tags: new[] { "ready" });

3. 配置ServiceBusClient的重试策略 #

通过ServiceBusClientOptions设置指数退避重试规则，降低标识未就绪时的重试频率：

var clientOptions = new ServiceBusClientOptions
{
    RetryOptions = new ServiceBusRetryOptions
    {
        MaxRetries = 4,
        Delay = TimeSpan.FromSeconds(20),
        Mode = ServiceBusRetryMode.Exponential, // 指数退避减少初期重试
        MaxDelay = TimeSpan.FromMinutes(2)
    }
};
var serviceBusClient = new ServiceBusClient("<service-bus-namespace>", credential, clientOptions);

4. 用初始化容器等待托管标识就绪 #

在AKS Pod中添加初始化容器，循环验证托管标识就绪后，再启动主应用容器：

apiVersion: v1
kind: Pod
metadata:
  name: service-bus-app
spec:
  initContainers:
  - name: wait-for-identity
    image: mcr.microsoft.com/dotnet/runtime:6.0
    command: ["dotnet", "run"]
    args: ["--project", "/app/IdentityChecker.csproj"]
    volumeMounts:
    - name: checker-app
      mountPath: /app
  containers:
  - name: main-app
    image: your-app-image:latest
  volumes:
  - name: checker-app
    configMap:
      name: identity-checker-config

初始化容器核心逻辑：

while (true)
{
    try
    {
        var client = new HttpClient();
        client.DefaultRequestHeaders.Add("Metadata", "true");
        var response = await client.GetAsync("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://servicebus.azure.net");
        if (response.IsSuccessStatusCode)
        {
            Console.WriteLine("托管标识就绪");
            return 0;
        }
    }
    catch (Exception)
    {
        // 忽略异常，继续重试
    }
    await Task.Delay(TimeSpan.FromSeconds(10));
}

内容的提问来源于stack exchange，提问作者Kuba P