如何通过API借助Blob存储Zip包动态部署Azure Function

1. 获取Azure AD访问令牌 #

调用Azure REST API需通过服务主体（Service Principal）获取Bearer令牌，这是批量自动化场景的最优认证方式：

• 请求地址：https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
• 请求方法：POST
• 表单参数：
  • grant_type: client_credentials
  • client_id: 你的服务主体ID
  • client_secret: 你的服务主体密钥
  • scope: https://management.azure.com/.default
• 响应中的access_token即为后续API调用所需的认证令牌

示例curl请求：

curl -X POST https://login.microsoftonline.com/your-tenant-id/oauth2/v2.0/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=your-client-id&client_secret=your-client-secret&scope=https://management.azure.com/.default"

2. 触发Zip包部署 #

核心API用于更新Function App的部署源，直接指向存储容器中的Zip包（需携带有效SAS令牌授权访问）：

• API端点：PUT https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Web/sites/{function-app-name}/extensions/zipdeploy?api-version=2022-03-01
• 请求头：
  • Authorization: Bearer {access-token}
  • Content-Type: application/json
• 请求体：

{
  "properties": {
    "packageUri": "https://{storage-account-name}.blob.core.windows.net/{container-name}/{zip-file-name}?{sas-token}"
  }
}

关键注意事项：

• SAS令牌需包含Read权限，有效期需覆盖部署周期
• 定时器触发函数的配置（如CRON表达式）已包含在Zip包的function.json中，部署后自动生效
• 若Function App启用了身份验证，需确保服务主体拥有对应的部署权限

示例curl请求：

curl -X PUT https://management.azure.com/subscriptions/your-sub-id/resourceGroups/your-rg/providers/Microsoft.Web/sites/your-function-app/extensions/zipdeploy?api-version=2022-03-01 \
  -H "Authorization: Bearer your-access-token" \
  -H "Content-Type: application/json" \
  -d '{
    "properties": {
      "packageUri": "https://your-storage-account.blob.core.windows.net/your-container/function-package.zip?sv=2023-01-03&ss=b&srt=o&sp=r&se=2024-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=your-sas-token"
    }
  }'

3. 验证部署状态 #

部署为异步操作，可通过以下API查询状态：

• API端点：GET https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Web/sites/{function-app-name}/extensions/zipdeploy/latest?api-version=2022-03-01
• 请求头：Authorization: Bearer {access-token}
• 响应中properties.provisioningState为Succeeded即表示部署完成

4. 批量部署实现 #

批量部署只需循环遍历目标Function App列表，替换API中的resource-group-name和function-app-name参数即可。以下是Python伪代码示例：

import requests

# 配置参数
tenant_id = "your-tenant-id"
client_id = "your-client-id"
client_secret = "your-client-secret"
subscription_id = "your-sub-id"
package_uri = "https://your-storage-account.blob.core.windows.net/your-container/function-package.zip?your-sas-token"

# 获取访问令牌
token_url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
token_data = {
    "grant_type": "client_credentials",
    "client_id": client_id,
    "client_secret": client_secret,
    "scope": "https://management.azure.com/.default"
}
token_response = requests.post(token_url, data=token_data)
access_token = token_response.json()["access_token"]

# 目标Function App列表
function_apps = [
    {"rg": "rg-1", "name": "func-app-1"},
    {"rg": "rg-2", "name": "func-app-2"}
]

headers = {
    "Authorization": f"Bearer {access_token}",
    "Content-Type": "application/json"
}
deploy_payload = {"properties": {"packageUri": package_uri}}

# 批量部署
for app in function_apps:
    deploy_url = f"https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{app['rg']}/providers/Microsoft.Web/sites/{app['name']}/extensions/zipdeploy?api-version=2022-03-01"
    response = requests.put(deploy_url, headers=headers, json=deploy_payload)
    print(f"部署 {app['name']} 响应状态: {response.status_code}")
    
    # 查询部署状态
    status_url = f"https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{app['rg']}/providers/Microsoft.Web/sites/{app['name']}/extensions/zipdeploy/latest?api-version=2022-03-01"
    status_response = requests.get(status_url, headers=headers)
    print(f"{app['name']} 部署状态: {status_response.json()['properties']['provisioningState']}")

内容的提问来源于stack exchange，提问作者Kishan Gohel