0

We are getting below error on Azure devops pipeline via Self hosted agent release when Azure web app is on Private network. No Error seen when the web app on azure is on Public.

Error: Error: Failed to deploy web package to App Service. Error: tunneling socket could not be established, statusCode=503

Made Azure web app to private and error comes. Moved to public no error seen.

Vishnu Kiran
  • 1
  • 1

2 Answers2

2

Seems that the self-hosted agent cannot connect to the Azure app service. It seems to be a network issue.

The agent needs a way to connect to the App service directly. To ensure the connectivity is ok, we need to make sure the self-hosted agent is not blocked by NSG rules or App Service networking Access Restrictions. Just whitelist the agent machine in your rules.

The task using Kudu REST API to deploy the application. We need to check the following App Service networking Access Restrictions to allow deployment from a specific agent:

  • Make sure the REST site “xxx.scm.azurewebsites.net” have Allow All, i.e. no restriction.
  • Also, the option “Same restrictions as ***.azurewebsites.net” should be unchecked.

If you are using Private Endpoints for Azure Web App, you must create two records in your Azure DNS private zone or your custom DNS server. Kindly check DNS for more details. enter image description here

Besides, when the proxy is set up, Web API calls and SCM hosts are bypassed by the user. The same has to be configured in the Azure pipelines agent explicitly. To bypass specific hosts, follow the steps here and restart the agent. enter image description here

Andy Li-MSFT
  • 28,712
  • 2
  • 33
  • 55
  • Thanks this worked after adding .proxybypass file in agent's root directory C:\Username\Agent\ and adding below entries in file. (Note: Wherever MyWebappname occurs is my webapp name created in Azure) azurewebsites\.net MyWebapp.azurewebsites\.net https://MyWebappname.azurewebsites.net http://MyWebappname.azurewebsites.net MyWebappname.scm.azurewebsites.net – Vishnu Kiran Nov 01 '22 at 04:05
0

1.Allow access to Public removed. 2.Created Pvt endpoints within same Vnet and Subnet of Target VM 3.Created new file .proxybypass in self hosted agent folder C:\Username\Agent 4.Added below entries in .proxybypass to allow and communicate bypassing corporate proxy https://MyWebappname.azurewebsites.net http://MyWebappname.azurewebsites.net

George Lords of Castle
  • 899
  • 2
  • 9
  • 18
Vishnu Kiran
  • 1
  • 1
  • You could [Accept it as an Answer](https://meta.stackexchange.com/questions/5234/how-does-accepting-an-answer-work), This can be beneficial to other community members reading this thread. – Andy Li-MSFT Nov 04 '22 at 01:20
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Nov 04 '22 at 16:13