我希望在本地服务结构(GA版本)群集中托管的无状态Web API服务的https端点。完成此操作后,我想在Azure中部署群集。

我按照服务结构文档中“ Secure a Service Fabric cluster”文章中的步骤进行操作,并创建了一个自签名证书并将其上传到我的密钥库中。我还使用步骤2.5中的Import-PfxCertificate命令将证书导入到机器的“受信任的人”商店。

AddCertToKeyVault:

Invoke-AddCertToKeyVault -SubscriptionId <Id> -ResourceGroupName 'ResourceGroupName' -Location 'West Europe' -VaultName 'VaultName' -CertificateName 'TestCert' -Password '****' -CreateSelfSignedCertificate -DnsName 'www.<clustername>.westeurope.cloudapp.azure.com' -OutputPath 'C:\MyCertificates'


现在,我调整了ServiceManifest.xmlApplicationManifest.xml(类似于RunAs: Run a Service Fabric application with different security permissions)和我的OwinCommunicationListener.cs

ServiceManifest.xml(MasterDataServiceWebApi):

<?xml version="1.0" encoding="utf-8"?>
<ServiceManifest Name="MasterDataServiceWebApiPkg"
                 Version="1.0.0"
                 xmlns="http://schemas.microsoft.com/2011/01/fabric"
                 xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <ServiceTypes>
    <StatelessServiceType ServiceTypeName="MasterDataServiceWebApiType" />
  </ServiceTypes>

  <CodePackage Name="Code" Version="1.0.0">
    <EntryPoint>
      <ExeHost>
        <Program>MasterDataServiceWebApi.exe</Program>
      </ExeHost>
    </EntryPoint>
  </CodePackage>

  <ConfigPackage Name="Config" Version="1.0.0" />

  <Resources>
    <Endpoints>
      <Endpoint Name="ServiceEndpoint" Type="Input" Protocol="https" Port="5030" CertificateRef="TestCert"/>
    </Endpoints>
  </Resources>
</ServiceManifest>


ApplicationManifest:

<?xml version="1.0" encoding="utf-8"?>
<ApplicationManifest xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ApplicationTypeName="exCHANGETestCluster2Type" ApplicationTypeVersion="1.0.0" xmlns="http://schemas.microsoft.com/2011/01/fabric">
   <Parameters>
      <Parameter Name="MasterDataServiceWebApi_InstanceCount" DefaultValue="-1" />
   </Parameters>
   <ServiceManifestImport>
      <ServiceManifestRef ServiceManifestName="MasterDataServiceWebApiPkg" ServiceManifestVersion="1.0.0" />
      <ConfigOverrides />
      <Policies>
         <EndpointBindingPolicy EndpointRef="ServiceEndpoint" CertificateRef="TestCert" />
      </Policies>
   </ServiceManifestImport>
   <DefaultServices>
      <Service Name="MasterDataServiceWebApi">
         <StatelessService ServiceTypeName="MasterDataServiceWebApiType" InstanceCount="[MasterDataServiceWebApi_InstanceCount]">
            <SingletonPartition />
         </StatelessService>
      </Service>
   </DefaultServices>
   <Certificates>
      <EndpointCertificate X509FindValue="<Thumbprint>" Name="TestCert" />
   </Certificates>
</ApplicationManifest>


OwinCommunicationListener.cs:

[...]
public Task<string> OpenAsync(CancellationToken cancellationToken)
    {
      var serviceEndpoint = this.serviceContext.CodePackageActivationContext.GetEndpoint(this.endpointName);
      int port = serviceEndpoint.Port; //NEW!

      if (this.serviceContext is StatefulServiceContext)
      {
        [...]
      }
      else if (this.serviceContext is StatelessServiceContext)
      {
        var protocol = serviceEndpoint.Protocol;

        this.listeningAddress = string.Format(
            CultureInfo.InvariantCulture,
            //"http://+:{0}/{1}",
            "{0}://+:{1}/{2}", //NEW!
            protocol,
            port,
            string.IsNullOrWhiteSpace(this.appRoot)
                ? string.Empty
                : this.appRoot.TrimEnd('/') + '/');
      }
      else
      {
        throw new InvalidOperationException();
      }
[...]


现在,当我将无状态服务部署到本地群集时,我的服务结构浏览器会报告一些非常“令人讨厌”的错误,而我无法访问我的服务:

Kind        Health State  Description
=============================================================================
Services    Error         Unhealthy services: 100% (1/1), ServiceType='MasterDataServiceWebApiType', MaxPercentUnhealthyServices=0%.
Service     Error         Unhealthy service: ServiceName='fabric:/sfCluster/MasterDataServiceWebApi', AggregatedHealthState='Error'.
Partitions  Error         Unhealthy partitions: 100% (1/1), MaxPercentUnhealthyPartitionsPerService=0%.
Partition   Error         Unhealthy partition: PartitionId='e5635b85-3c23-426b-bd12-13ae56796f23', AggregatedHealthState='Error'.
Event       Error         Error event: SourceId='System.FM', Property='State'. Partition is below target replica or instance count.


Visual Studio没有为我提供任何进一步的错误详细信息。相反。 stacktrace打印:fabric:/sfCluster/MasterDataServiceWebApi is ready.

我错过了什么?我配置错误吗?

顺便说一句:之后,我使用自签名证书在Azure中创建了一个新群集,但是当我尝试访问该群集的Service Fabric Explorer时,我没有UI和空白站点。

最佳答案

我了解到,Service Fabric使用本地计算机存储进行证书验证。 (https://github.com/Azure-Samples/service-fabric-dotnet-web-reference-app/issues/3

因此,我不得不通过以下稍微修改的powershell-script将证书导入到本地计算机存储中:

Import-PfxCertificate -Exportable -CertStoreLocation cert:\localMachine\my -FilePath C:\MyCertificates\TestCert.pfx -Password (Read-Host -AsSecureString -Prompt "Enter Certificate Password")


在此之前,我将证书导入到Cert:\CurrentUser\TrustedPeopleCert:\CurrentUser\My中。但是本地Service Fabric群集不在那里查找。

顺便说一句:
当我尝试访问由Azure托管的Service Fabric群集的Service Fabric Explorer时,我仍然得到一个空白站点,该站点已使用相同的证书密钥进行了保护。我将为这个问题提出另一个问题。编辑:使用Internet Explorer而不是Firefox解决了我的空白站点问题。

关于c# - 具有HTTPS端点的无状态Web API服务会引发运行状况错误,我们在Stack Overflow上找到一个类似的问题:https://stackoverflow.com/questions/36916856/

10-15 02:38