来源Release Notes for Disconnected Operations for Azure Local⚠️本文档随官方更新而变。部署前必查最新版。1. 2604 版本已知问题1.1 Worker Cluster 在 Deploy Arc Infrastructure Components 失败罕见症状air-gapped 环境下 workload 集群部署失败错误New-ArcHciApplianceConfigs failed with error MOC Role StorageContainerContributor is unavailable修复在第一台 Azure Local 节点上 elevated PowerShellNew-MocRole -Name StorageContainerContributor -actionProviders StorageContainer -actionOperations all之后用相同方式portal / ARM恢复部署。2. 2602 / 2603 版本已知问题2.1 从 2602 升级到 2604 在 air-gapped 下失败症状Update package arca.update.package.2603.1.25553.zip did not pass validation. - ManifestSignatureInvalid: File signature on Manifest.xml is invalid or it is not signed. The package may be tampered with or corrupted.根因2602 内置的代码签名证书不认 2603/2604 的更新包签名。修复步骤下载 aka.ms/aldo-fix1/2602-update zip拷到 seed node修改并运行$targetFolder C:\ALDO\2602 $targetFile Join-Path $targetFolder 2602-update.zip (New-Item -ItemType Directory $targetFolder -force) | Out-null Expand-Archive $targetFile -destinationPath $targetFolder Import-Module $applianceConfigBasePath\OperationsModule\Azure.Local.DisconnectedOperations.psd1 -Force $managementEndpoint 192.168.200.10 $password ConvertTo-SecureString RETRACTED -AsPlainText -Force $context Set-DisconnectedOperationsClientContext -ManagementEndpointClientCertificatePath ${env:localappdata}\AzureLocalOpModuleDev\certs\ManagementEndpoint\ManagementEndpointClientAuth.pfx -ManagementEndpointClientCertificatePassword $password -ManagementEndpointIpAddress $managementEndpoint $recoveryKeys (Get-ApplianceBitlockerRecoveryKeys).recoverykeyset $($targetFolder)\ImportCodeSignCertsOffline.ps1 -CertsFolder $targetFolder -BitLockerRecoveryKeys $recoveryKeys等 10 分钟同样 context 里跑Get-ApplianceUpdateHistory报错可能仍含Failed但ManifestSignatureInvalid不再出现 修好继续升级$updateTargetVersion Wait-AppliancePreUpdate -TargetVersion $updateTargetVersion Start-ApplianceUpdate -TargetVersion $updateTargetVersion -Wait总耗时约3 小时2.2 Bootstrap 因证书无效失败症状ALDO services failed to come up after 00:45:00 minutes, failing Arc registration.根因CRLCertificate Revocation List空或配置错误。修复先验证 CA 配正确证书含 CRL endpoint 且节点可达。替代修复无法重配 CA 时每台 Azure Local 节点跑Write-Host Updating Windows MAE Config for the Bootsrap service $basePath C:\windows\system32\bootstrap Write-Host Looking for config file under $basePath $contentDir Get-ChildItem -Path $basePath -Filter content_* -Directory -ErrorAction SilentlyContinue | Sort-Object Name -Descending | Select-Object -First 1 if (-not $contentDir) { Write-Warning Could not find content_* directory under $basePath return } Write-Host Found content directory: $($contentDir.FullName) $ConfigPath Join-Path $contentDir.FullName Microsoft.Azure.Edge.Bootstrap.ManagementService\windows.mae.config.json if (-not (Test-Path $ConfigPath)) { Write-Warning Config file $ConfigPath not found return } Write-Host Config file found at $ConfigPath $configContent Get-Content -Path $ConfigPath -Raw | ConvertFrom-Json $configContent.ManagementSettings.CheckCertificateRevocationList $false Write-Host Updated existing CheckCertificateRevocationList property to false Stop-Service -Name BootstrapManagementService -Force -ErrorAction Stop Write-Host BootstrapManagementService stopped successfully $configContent | ConvertTo-Json -Depth 10 | Set-Content -Path $ConfigPath -Force Write-Host Successfully saved modified config Write-Host Starting BootstrapManagementService... Start-Service -Name BootstrapManagementService Write-Host Waiting 60 seconds for service to fully initialize... Start-Sleep -Seconds 60 Write-Host Successfully started BootstrapManagementService⚠️ 跳过 CRL 检查降低安全强度——只用于紧急修复之后必须恢复 CRL 校验。2.3 Portal 问题Policy症状Azure Policy portal 界面有已知问题。修复用Azure CLI 或 Azure PowerShell替代。SSH keys症状portal 创建 Linux VM / AKS 集群时无法生成 SSH key。修复用 CLI 生成 SSH key创建 VM/集群时传入。2.4 后续集群部署失败 — HGS 证书不可用症状管理集群成功部署后新增 workload 集群失败。根因workload 节点缺 HGS 证书。修复从管理集群第一节点复制两份 .pfx 到所有 workload 节点C:\Users\Administrator\AppData\Roaming\AzureLocal\AzsVmHostGuardian-IRVM01-encryption.pfx C:\Users\Administrator\AppData\Roaming\AzureLocal\AzsVmHostGuardian-IRVM01-signing.pfx2.5 Control plane 部署卡住超时罕见症状8 小时仍未 100% 收敛。修复重新部署断开操作 appliance若 2-3 次 clean redeploy 都失败 → 收集日志 开 support ticket。2.6 证书生成卡住症状通过 RDP 会话跑证书生成会挂。修复不要用 RDP直接在 console / PowerShell Remoting / VNC 操作。3. 官方没明说的事项文档没说这些 issue 是否会在 2605 修复——版本对应关系按官方 release notes 查StorageContainerContributor role 失败是罕见——但 air-gapped 环境下出现概率上升HGS 证书复制是纯手动步骤——易遗漏建议写成 checklistclean redeploy 没说具体 cleanup 步骤——应参照官方 Cleanup Script如果存在文档没说已知 issue 总数或哪些是 blocker——以官方为准