Azure ReservedIPAddress & Cloud Service without an endpoint

问题

I have a cloud service that opens a socket externally and requires a whitelisted IP address. Nothing will externally initiate a connection with my service.

When I attempt to publish it with an associated ReservedIP address I get the following error: Validation Errors: Error validating the .cscfg file against the .csdef file. Severity:Error, message:ReservedIP 'xxxx' was not mapped to an endpoint. The service definition must contain atleast one endpoint that maps to the ReservedIP..

.cscfg

<?xml version="1.0" encoding="utf-8"?>
<ServiceConfiguration serviceName="Gateway" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration" osFamily="5" osVersion="*" schemaVersion="2015-04.2.6">
  <Role name="WorkerRole1">
    <Instances count="1" />
    <ConfigurationSettings>
      <Setting name="Microsoft.WindowsAzure.Plugins.Diagnostics.ConnectionString" value="yyyyy" />
      <Setting name="APPINSIGHTS_INSTRUMENTATIONKEY" value="xxx" />
      <Setting name="ASPNETCORE_ENVIRONMENT" value="dev" />
    </ConfigurationSettings>
  </Role>
  <NetworkConfiguration>
    <AddressAssignments>
      <ReservedIPs>
       <ReservedIP name="xxxxx"/>
      </ReservedIPs>
    </AddressAssignments>
  </NetworkConfiguration>
</ServiceConfiguration>

Is there a way to deploy this without specifying an endpoint? (I'm using VS2017RC to deploy)
If not, what would the xml look like for a dummy 'endpoint' and what risks do I run doing that?
Is there a better way I should be approaching this?

回答1:

Looks like ReservedIP is only supported with services containing an external endpoint. What you can do is add an external endpoint but firewall it off with the NSG (Network Security Group).

On help defining an endpoint see

https://docs.microsoft.com/en-us/azure/cloud-services/cloud-services-enable-communication-role-instances

Also, if you use a port that is actually not bound to in the machine, it should not be a vulnerability; but adding a deny rule in NSG would cover for any change in future as well.

[Aside] If your service does not have any incoming connections, you should consider using a worker role instead of a web role. Long running threads can get terminated in web role instances.

回答2:

I ran into the same issue and the working solution for me was to take the "Input endpoint" from here and place it in .csdef file within the WorkerRole tag.

<Endpoints>
  <InputEndpoint name="StandardWeb" protocol="http" port="80" localPort="80" />
</Endpoints>

来源：https://stackoverflow.com/questions/41194682/azure-reservedipaddress-cloud-service-without-an-endpoint

标签

azure

azure-cloud-services