AzureDevOps突然パイプラインでのデプロイに失敗

ある日、突然パイプラインでのデプロイに失敗

Azure functions app deploy

View raw log

Starting: Azure functions app deploy
==============================================================================
Task         : Azure Functions Deploy
Description  : Update a function app with .NET, Python, JavaScript, PowerShell, Java based web applications
Version      : 2.247.1
Author       : Microsoft Corporation
Help         : https://aka.ms/azurefunctiontroubleshooting
==============================================================================
Got service connection details for Azure App Service:'＊＊＊'
##[error]Error: Failed to get resource ID for resource type 'Microsoft.Web/Sites' and resource name '＊＊＊'. 
Error: Could not fetch access token for Azure. Status code: invalid_client, status message: Error(s): 7000222 - Timestamp: 2024-11-01 00:11:12Z - Description: AADSTS7000222: The provided client secret keys for app '***' are expired. 
Visit the Azure portal to create new keys for your app: https://aka.ms/NewClientSecret, or consider using certificate credentials for added security: https://aka.ms/certCreds. 
Trace ID: ＊＊＊ Correlation ID: ＊＊＊ Timestamp: 2024-11-01 00:11:12Z - Correlation ID: ＊＊＊ - Trace ID: ＊＊＊
Finishing: Azure functions app deploy

このタスク azureSubscriptionにService connectionsが指定されてる、それが有効期限切れしたか？

- task: AzureFunctionApp@2
  displayName: "Azure functions app deploy"
  inputs:
    azureSubscription: ${{parameters.azureSubscription}}
    appType: "functionAppLinux"
    runtimeStack: "PYTHON|${{parameters.targetPythonVersion}}"
    resourceGroupName: $(resourceGroupName)
    appName: $(functionAppName)
    package: "$(Pipeline.Workspace)/drop/$(Build.BuildId).zip"

やはりService connections のシークレットの有効期限が切れている

Secret has expired. Convert your service connections to workload identity federation for improved security and simplified maintenance. Learn more

シークレットの有効期限が切れました。サービス接続を Workload Identity フェデレーションに変換して、セキュリティを向上させ、メンテナンスを簡素化します。もっと詳しく知る

Convert ボタンを押すと

Converting will delete the secrets associated with this service connection from Azure DevOps in 7 days
In the meantime, you can revert to the original service connection if you encounter any issues. Azure DevOps will not delete secrets from Microsoft Entra. Learn more

変換すると、このサービス接続に関連付けられたシークレットが 7 日以内に Azure DevOps から削除されます
その間、問題が発生した場合は、元のサービス接続に戻すことができます。 Azure DevOps は Microsoft Entra からシークレットを削除しません。もっと詳しく知る

更に Convert ボタンを押すと

しばし待ってるとConversionが終わり

無事成功

Azure functions app deploy

View raw log

Starting: Azure functions app deploy
==============================================================================
Task         : Azure Functions Deploy
Description  : Update a function app with .NET, Python, JavaScript, PowerShell, Java based web applications
Version      : 2.247.1
Author       : Microsoft Corporation
Help         : https://aka.ms/azurefunctiontroubleshooting
==============================================================================
Got service connection details for Azure App Service:'＊＊＊'
NOTE: Function app is VNet integrated.
Updating App Service Application settings. Data: {"FUNCTIONS_WORKER_RUNTIME":"python","WEBSITES_ENABLE_APP_SERVICE_STORAGE":"true","WEBSITE_RUN_FROM_PACKAGE":"1"}
App Service Application settings are already present.
Package deployment using ZIP Deploy initiated.
Deploy logs can be viewed at https://＊＊＊/api/deployments/＊＊＊/log
The web package has been deployed to App Service. Please note that the package mount or extraction errors will be logged in the deployment logs in the location above.
Successfully added release annotation to the Application Insight : ＊＊＊
Successfully updated deployment History at https://＊＊＊/api/deployments/31111730422089690
App Service Application URL: https://＊＊＊
Finishing: Azure functions app deploy