azure arm 模板将 azure key Vault 扩展部署到 VM

Question

我正在尝试使用 azure Arm 模板将 key 保管库扩展部署到虚拟机。基于此链接。 https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-windows .

我在尝试配置扩展时收到此错误模板部署返回以下错误:08:57:27 - 8:57:26 AM - 资源 Microsoft.Compute/virtualMachines/extensions 'dcsvm1/test' 失败，并显示消息 '{08:57:27 - “状态”:“失败”，08:57:27 - “错误”:{08:57:27 - “代码”:“资源部署失败”，08:57:27 - "message": "资源操作已完成，终端配置状态为“失败”。",08:57:27 - “详细信息”:[08:57:27 - {08:57:27 - “代码”:“VMExtensionProvisioningError”，08:57:27 - “message”:“虚拟机在处理扩展“test”时报告失败。错误消息:“无法解析配置设置:“不是数组””\r\n\r\n更多信息有关故障排除的信息，请访问 https://aka.ms/vmextensionwindowstroubleshoot”08:57:27 - }08:57:27 - ]

>     here is the arm template json
>     type": "Microsoft.Compute/virtualMachines/extensions",
>           "name": "dcsvm1/test",
>           "apiVersion": "2019-07-01",
>           "location": "[parameters('location')]",
>           "dependsOn": [
>             "[resourceId('Microsoft.Compute/VirtualMachines', parameters('virtualmachinename'))]"
>           ],
>           "properties": {
>             "publisher": "Microsoft.Azure.KeyVault",
>             "type": "KeyVaultForWindows",
>             "typeHandlerVersion": "1.0",
>             "settings": {
>               "secretsManagementSettings": {
>                 "pollingIntervalIns": "3600",
>                 "certificateStoreName": "MY",
>                 "linkOnRenewal": "false",
>                 "certificateStoreLocation": "LocalMachine",
>                 //"requireInitialSync": "true",
>                 //"observedCertificates": "https://testkvdsc.vault.azure.net:443/certificates/wildcard/9817edfba5124579b75649f51902ef99",
>                 "observedCertificates": "https://testkvdsc.vault.azure.net:443/secrets/wildcard"
>               }         
>             }
>           }
>         },

我已经能够在使用 powershell 创建虚拟机后添加扩展，但更愿意通过 arm 模板安装它。

Answer 1

如果您想通过arm模板在Azure VM上安装Azure Key Vault扩展，​​模板应如下所示。请将 observedCertificates 更新为数组，将 linkOnRenewal 更新为 bool 值。

"resources": [ {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "name": "[concat(parameters('VMName'), '/KeyVaultForWindows')]",
            "apiVersion": "2019-07-01",
            "location": "[parameters('location')]",
            
            "properties": {
                "publisher": "Microsoft.Azure.KeyVault",
                "type": "KeyVaultForWindows",
                "typeHandlerVersion": "1.0",
                "autoUpgradeMinorVersion": true,
                "settings": {
                    "secretsManagementSettings": {
                        "pollingIntervalInS": "3600",
                        "certificateStoreName": "MY",
                        "linkOnRenewal": false,
                        "certificateStoreLocation": "LocalMachine",
                        "observedCertificates": ["",""]
                    }
                }
            }
        }

关于如何安装扩展的详细信息，请引用以下步骤。同时，您可以引用official document

1. 为虚拟机启用 MSI

2. key 保管库访问策略必须设置 key get 和 list 权限，以便 VM/VMSS 托管身份检索证书的 key 部分。

3. 安装扩展

我的模板如下

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vaultName": {
            "type": "string",
            "defaultValue": ""
        },
        "VMName": {
            "type": "string",
            "defaultValue": ""
        },
        "tenantId": {
            "type": "string",
            "defaultValue": "[subscription().tenantId]"
        },
        "location": {
            "type": "string",
            "defaultValue": ""
        }
    },
    "resources": [{
            "name": "[parameters('VMName')]",
            "type": "Microsoft.Compute/virtualMachines",
            "apiVersion": "2020-06-01",
            "location": "[parameters('location')]",
            "identity": {
                "type": "SystemAssigned",
            },
        }, {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2020-06-01",
            "name": "nestedTemplate1",
            "resourceGroup": "<key vault resource group>",
            "dependsOn": [
                "[resourceId('Microsoft.Compute/virtualMachines/', parameters('VMName'))]"
            ],
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "resources": [{
                            "type": "Microsoft.KeyVault/vaults/accessPolicies",
                            "name": "[concat(parameters('vaultName'), '/add')]",

                            "apiVersion": "2019-09-01",
                            "properties": {
                                "accessPolicies": [{
                                        "tenantId": "[parameters('tenantId')]",
                                        "objectId": "[reference(resourceId('Microsoft.Compute/virtualMachines/', parameters('VMName')), '2020-06-01', 'full').identity.principalId]",
                                        "permissions": {
                                            "keys": ["all"],
                                            "secrets": ["all"],
                                            "certificates": ["all"],
                                            "storage": ["all"]
                                        }
                                    }
                                ]
                            }
                        },
                    ]
                }
            }
        }, {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "name": "[concat(parameters('VMName'), '/KeyVaultForWindows')]",
            "apiVersion": "2019-07-01",
            "location": "[parameters('location')]",
            "dependsOn": [
                "nestedTemplate1"
            ],
            "properties": {
                "publisher": "Microsoft.Azure.KeyVault",
                "type": "KeyVaultForWindows",
                "typeHandlerVersion": "1.0",
                "autoUpgradeMinorVersion": true,
                "settings": {
                    "secretsManagementSettings": {
                        "pollingIntervalInS": "3600",
                        "certificateStoreName": "MY",
                        "linkOnRenewal": false,
                        "certificateStoreLocation": "LocalMachine",
                        "observedCertificates": [""]
                    }
                }
            }
        }

    ],
    "outputs": {}
}