When I run release pipeline for Azure App service with private endpoint, Below error happens Error: Failed to fetch Kudu App Settings. Error: Ip Forbidden (CODE: 403)
Any suggestion?
2
votes
3 Answers
1
votes
I think you need to deploy some self-hosted agents.
From Here For the Kudu console, or Kudu REST API (deployment with Azure DevOps self-hosted agents for example), you must create two records in your Azure DNS private zone or your custom DNS server.
Which they are automatically created if using privatelink.azurewebsites.net. But that now means they are local and the appservice is closed off from the internet for the internet, which blocks Microsoft's agents. So there is no line of site which means you need an agent that is hosted to hit it line of site again.
More about self-hosted agents can be found here that talks about line of site etc.
1
votes
The reason for this is because as you add a private endpoint to your web app, all Internet traffic to this app is cut off. Since the Azure DevOps Default build/release agents have a public IP, they can't access the web app anymore.
To resolve your issue, in Azure create a VM or a VM Scale Set either in the same VNet as your private endpoint of the web app. Then add this scale set as a new agent pool. Finally make sure that in the release pipeline settings, the release is using this new agent pool.
0
votes
There is one more way You can use to your App Service to make it work properly with devops pipelines: Access Restrictions. You may:
- go to the "networking" pane of your App Service
- click on Access Restrictions
- Add a new Allow Rule: if your agent is a Microsoft-Hosted use the service Tag Azure Cloud. Otherwise if is a self-hosted, you can add the service tag Virtual Network and use the vnet where the VM with your agent is hosted
Please note that a new default rule will be added as well with Deny All traffic. But I though, in your scenario were a private endpoint is already configured, you don't mind.
