运行已配置的 Azure VM 上的自定义 Powershell 脚本

Question

我使用以下 C# 片段配置了 VM

var ssrsVm = new WindowsVirtualMachine("vmssrs001", new WindowsVirtualMachineArgs
{
    Name = "vmssrs001",
    ResourceGroupName = resourceGroup.Name,
    NetworkInterfaceIds = { nic.Id },
    Size = "Standard_B1ms",
    AdminUsername = ssrsLogin,
    AdminPassword = ssrsPassword,
    SourceImageReference = new WindowsVirtualMachineSourceImageReferenceArgs
    {
        Publisher = "microsoftpowerbi",
        Offer = "ssrs-2016",
        Sku = "dev-rs-only",
        Version = "latest"
    },
    OsDisk = new WindowsVirtualMachineOsDiskArgs
    {
        Name = "vmssrs001disk",
        Caching = "ReadWrite",
        DiskSizeGb = 200,
        StorageAccountType = "Standard_LRS",
    }
});

配置 VM 后，我想运行在其上使用自定义 Powershell 脚本来添加防火墙规则。现在想知道如何将此作为 Pulumi 应用程序的一部分。使用 Azure 看起来我可以用 RunPowerShellScript 做到这一点，但在 Pulumi 文档中找不到任何相关信息，也许有更好的方法来处理我的情况？

更新

感谢 Ash 的评论，我找到了 VirtualMachineRunCommandByVirtualMachine，这似乎应该符合我的要求，但不幸的是，代码片段 returns 错误

var virtualMachineRunCommandByVirtualMachine = new VirtualMachineRunCommandByVirtualMachine("vmssrs001-script",
    new VirtualMachineRunCommandByVirtualMachineArgs
    {
        ResourceGroupName = resourceGroup.Name,
        VmName = ssrsVm.Name,
        RunAsUser = ssrsLogin,
        RunAsPassword = ssrsPassword,
        RunCommandName = "enable firewall rule for ssrs",
        Source = new VirtualMachineRunCommandScriptSourceArgs
        {
            Script =
                @"Firewall AllowHttpForSSRS
            {
                Name                  = 'AllowHTTPForSSRS'
                DisplayName           = 'AllowHTTPForSSRS'
                Group                 = 'PT Rule Group'
                Ensure                = 'Present'
                Enabled               = 'True'
                Profile               = 'Public'
                Direction             = 'Inbound'
                LocalPort             = ('80')
                Protocol              = 'TCP'
                Description           = 'Firewall Rule for SSRS HTTP'
            }"
        }
    });

错误 The property 'runCommands' is not valid because the 'Microsoft .Compute/RunCommandPreview' feature is not enabled for this subscription."

看起来其他人也在为同样的事情而苦苦挣扎here。

Answer 1

您可以使用 Compute Extension 通过 Pulumi 针对虚拟机执行脚本。

This article details some of the options 如果您刚刚通过 PowerShell 完成了该过程。

Answer 2

作为对 Ash 答案的补充，这里是我如何将它与 Pulumi 集成

首先，我为我的项目脚本创建了一个 blob 容器

var deploymentContainer = new BlobContainer("deploymentscripts", new BlobContainerArgs
{
    ContainerName = "deploymentscripts",
    ResourceGroupName = resourceGroup.Name,
    AccountName = storageAccount.Name,
});

接下来，我上传我所有的 Powershell 脚本来创建 blob

使用此代码段

foreach (var file in Directory.EnumerateFiles(Path.Combine(Environment.CurrentDirectory, "Scripts")))
{
    var fileName = Path.GetFileName(file);
    var blob = new Blob(fileName, new BlobArgs
    {
        ResourceGroupName = resourceGroup.Name,
        AccountName = storageAccount.Name,
        ContainerName = deploymentContainer.Name,
        Source = new FileAsset(file),
    });
    
    deploymentFiles[fileName] = SignedBlobReadUrl(blob, deploymentContainer, storageAccount, resourceGroup);
}

SignedBlobReadUrl 从 Pulumi repo 抓取。

private static Output<string> SignedBlobReadUrl(Blob blob, BlobContainer container, StorageAccount account, ResourceGroup resourceGroup)
{
    return Output.Tuple<string, string, string, string>(
        blob.Name, container.Name, account.Name, resourceGroup.Name).Apply(t =>
    {
        (string blobName, string containerName, string accountName, string resourceGroupName) = t;

        var blobSAS = ListStorageAccountServiceSAS.InvokeAsync(new ListStorageAccountServiceSASArgs
        {
            AccountName = accountName,
            Protocols = HttpProtocol.Https,
            SharedAccessStartTime = "2021-01-01",
            SharedAccessExpiryTime = "2030-01-01",
            Resource = SignedResource.C,
            ResourceGroupName = resourceGroupName,
            Permissions = Permissions.R,
            CanonicalizedResource = "/blob/" + accountName + "/" + containerName,
            CacheControl = "max-age=5",
        });
        return Output.Format($"https://{accountName}.blob.core.windows.net/{containerName}/{blobName}?{blobSAS.Result.ServiceSasToken}");
    });
}

最后，我创建 Extension 到运行我的脚本

代码

var extension = new Extension("ssrsvmscript", new Pulumi.Azure.Compute.ExtensionArgs
{
    Name = "ssrsvmscript",
    VirtualMachineId = ssrsVm.Id,
    Publisher = "Microsoft.Compute",
    Type = "CustomScriptExtension",
    TypeHandlerVersion = "1.10",
    Settings = deploymentFiles["ssrsvm.ps1"].Apply(script => @" {
    ""commandToExecute"": ""powershell -ExecutionPolicy Unrestricted -File ssrsvm.ps1"",
    ""fileUris"": [" + "\"" + script + "\"" + "]}")
});

希望这会节省一些时间来解决这个问题。

运行已配置的 Azure VM 上的自定义 Powershell 脚本

Run custom Powershell script on provisioned Azure VM

powershell

pulumi

azure-vm

运行 已配置的 Azure VM 上的自定义 Powershell 脚本

Run custom Powershell script on provisioned Azure VM

powershell

pulumi

azure-vm

运行已配置的 Azure VM 上的自定义 Powershell 脚本