Azure Automation State Configuration 概述Azure Automation State Configuration overview

Azure Automation State Configuration 是一项 Azure 配置管理服务,可用于为任何云或本地数据中心的节点编写、管理和编译 PowerShell Desired State Configuration (DSC) 配置Azure Automation State Configuration is an Azure configuration management service that allows you to write, manage, and compile PowerShell Desired State Configuration (DSC) configurations for nodes in any cloud or on-premises datacenter. 该服务还导入 DSC 资源,并将配置分配给目标节点,所有操作均在云中进行。The service also imports DSC Resources, and assigns configurations to target nodes, all in the cloud. 可以通过在“配置管理”下选择“State configuration (DSC)”来访问 Azure 门户中的 Azure Automation State Configuration。You can access Azure Automation State Configuration in the Azure portal by selecting State configuration (DSC) under Configuration Management.

可以使用 Azure Automation State Configuration 管理各种计算机:You can use Azure Automation State Configuration to manage a variety of machines:

  • Azure 虚拟机Azure virtual machines
  • Azure 虚拟机(经典)Azure virtual machines (classic)
  • 位于本地或 Azure 以外的云中的物理/虚拟 Windows 计算机Physical/virtual Windows machines on-premises, or in a cloud other than Azure
  • 位于本地、Azure 或 Azure 以外的云中的物理/虚拟 Linux 计算机Physical/virtual Linux machines on-premises, in Azure, or in a cloud other than Azure

如果你未准备好从云管理计算机配置,可以使用 Azure Automation State Configuration 作为仅限报告的终结点。If you aren't ready to manage machine configuration from the cloud, you can use Azure Automation State Configuration as a report-only endpoint. 使用此功能可以通过 DSC 设置(推送)配置,以及在 Azure 自动化中查看报告详细信息。This feature allows you to set (push) configurations through DSC and view reporting details in Azure Automation.

Note

如果安装的 Azure VM Desired State Configuration 扩展版本高于 2.70,则无需支付额外的费用即可使用 Azure Automation State Configuration 来管理 Azure VM。Managing Azure VMs with Azure Automation State Configuration is included at no extra charge if the installed Azure VM Desired State Configuration extension version is greater than 2.70. 有关详细信息,请参阅自动化定价页For more information, see Automation pricing page.

为何使用 Azure Automation State ConfigurationWhy use Azure Automation State Configuration

与在 Azure 之外使用 DSC 相比,Azure Automation State Configuration 具有多项优势。Azure Automation State Configuration provides several advantages over the use of DSC outside of Azure. 使用此服务可从中心的安全位置跨数千台计算机快速轻松进行缩放。This service enables scalability across thousands of machines quickly and easily from a central, secure location. 可以轻松启用计算机、为其分配声明性配置并查看显示每台计算机是否符合指定的所需状态的报告。You can easily enable machines, assign them declarative configurations, and view reports showing each machine's compliance with the desired state you specify.

适用于 DSC 的 Azure Automation State Configuration 服务类似于 PowerShell 脚本中的 Azure 自动化 Runbook。The Azure Automation State Configuration service is to DSC what Azure Automation runbooks are to PowerShell scripting. 换句话说,Azure 自动化以帮助你管理 PowerShell 脚本的相同方式帮助你管理 DSC 配置。In other words, in the same way that Azure Automation helps you manage PowerShell scripts, it also helps you manage DSC configurations.

内置拉取服务器Built-in pull server

Azure Automation State Configuration 提供了类似于 Windows 功能 DSC 服务的 DSC 拉取服务器。Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service. 目标节点可自动接收配置、符合所需状态以及报告其符合性。Target nodes can automatically receive configurations, conform to the desired state, and report on their compliance. Azure 自动化中的内置拉取服务器消除了设置和维护你自己的拉取服务器的需要。The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure 自动化的目标可以是云中或本地的虚拟机,或物理 Windows 或 Linux 计算机。Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

管理所有 DSC 项目Management of all your DSC artifacts

Azure Automation State Configuration 向 PowerShell Desired State Configuration 提供的管理层与它为 PowerShell 脚本提供的相同。Azure Automation State Configuration brings the same management layer to PowerShell Desired State Configuration as it offers for PowerShell scripting. 可以通过 Azure 门户或 PowerShell 管理所有的 DSC 配置、资源和目标节点。From the Azure portal or from PowerShell, you can manage all your DSC configurations, resources, and target nodes.

“Azure 自动化”页的屏幕截图

将报表数据导入到 Azure Monitor 日志中Import of reporting data into Azure Monitor logs

使用 Azure Automation State Configuration 进行管理的节点将详细的报表状态数据发送到内置拉取服务器。Nodes that are managed with Azure Automation State Configuration send detailed reporting status data to the built-in pull server. 可以将 Azure Automation State Configuration 配置为将此数据发送到 Log Analytics 工作区。You can configure Azure Automation State Configuration to send this data to your Log Analytics workspace. 请参阅将 Azure Automation State Configuration 报表数据转发到 Azure Monitor 日志See Forward Azure Automation State Configuration reporting data to Azure Monitor logs.

使用 Azure Automation State Configuration 的先决条件Prerequisites for using Azure Automation State Configuration

使用 Azure Automation State Configuration 时,请考虑本部分中的要求。Consider the requirements in this section when using Azure Automation State Configuration.

操作系统要求Operating system requirements

运行 Windows 的节点支持以下版本:For nodes running Windows, the following versions are supported:

  • Windows Server 2019Windows Server 2019
  • Windows Server 2016Windows Server 2016
  • Windows Server 2012R2Windows Server 2012R2
  • Windows Server 2012Windows Server 2012
  • Windows Server 2008 R2 SP1Windows Server 2008 R2 SP1
  • Windows 10Windows 10
  • Windows 8.1Windows 8.1
  • Windows 7Windows 7

Note

Microsoft Hyper-V Server 独立产品 SKU 未包含 DSC 的实现。The Microsoft Hyper-V Server standalone product SKU does not contain an implementation of DSC. 因此,无法通过 PowerShell DSC 或 Azure Automation State Configuration 对它进行管理。Thus it can't be managed by PowerShell DSC or Azure Automation State Configuration.

对于运行 Linux 的节点,DSC Linux 扩展支持在支持的 Linux 发行版下列出的所有 Linux 发行版。For nodes running Linux, the DSC Linux extension supports all the Linux distributions listed under Supported Linux Distributions.

DSC 要求DSC requirements

将会针对在 Azure 中运行的所有 Windows 节点安装 WMF 5.1(在计算机已启用的情况下)。For all Windows nodes running in Azure, WMF 5.1 is installed when machines are enabled. 对于运行 Windows Server 2012 和 Windows 7 的节点,会启用 WinRMFor nodes running Windows Server 2012 and Windows 7, WinRM is enabled.

将会针对在 Azure 中运行的所有 Linux 节点安装 PowerShell DSC for Linux(在计算机已启用的情况下)。For all Linux nodes running in Azure, PowerShell DSC for Linux is installed when machines are enabled.

专用网络的配置Configuration of private networks

如果节点位于专用网络中,则需要以下端口和 URL。If your nodes are located in a private network, the following port and URLs are required. 这些资源为托管节点提供网络连接,并允许 DSC 与 Azure 自动化进行通信。These resources provide network connectivity for the managed node and allow DSC to communicate with Azure Automation.

  • 端口:出站 Internet 访问只需 TCP 443Port: Only TCP 443 required for outbound internet access
  • 全局 URL:* .azure-automation.cnGlobal URL: *.azure-automation.cn
  • 代理服务:https://<workspaceId>.agentsvc.azure-autoAgent service: https://<workspaceId>.agentsvc.azure-automation.cn

如果要使用在节点之间通信的 DSC 资源(例如 WaitFor* 资源),则还需允许节点间流量。If you are using DSC resources that communicate between nodes, such as the WaitFor* resources, you also need to allow traffic between nodes. 请参阅每个 DSC 资源的文档,以了解这些网络要求。See the documentation for each DSC resource to understand these network requirements.

代理支持Proxy support

Windows 版本 1809 及更高版本中提供了适用于 DSC 代理的代理支持。Proxy support for the DSC agent is available in Windows version 1809 and later. 启用此选项的方法是:在用来注册节点的 metaconfiguration 脚本中设置 ProxyURLProxyCredential 的值。This option is enabled by setting the values for ProxyURL and ProxyCredential in the metaconfiguration script used to register nodes.

Note

Azure Automation State Configuration 不为旧版 Windows 提供 DSC 代理支持。Azure Automation State Configuration does not provide DSC proxy support for previous versions of Windows.

对于 Linux 节点,DSC 代理程序支持代理,并使用 http_proxy 变量来确定 URL。For Linux nodes, the DSC agent supports proxy and uses the http_proxy variable to determine the URL.

Azure Automation State Configuration 网络范围和命名空间Azure Automation State Configuration network ranges and namespace

建议在定义异常时使用列出的地址。It's recommended to use the addresses listed when defining exceptions. 对于 IP 地址,可以下载 Azure 数据中心 IP 范围For IP addresses you can download the Azure Datacenter IP Ranges. 此文件每周更新,包含当前部署的范围以及即将对 IP 范围进行的更新。This file is updated weekly, and has the currently deployed ranges and any upcoming changes to the IP ranges.

Note

Azure 数据中心 IP 地址 XML 文件列出了 Azure 数据中心使用的 IP 地址范围。The Azure Datacenter IP address XML file lists the IP address ranges that are used in the Azure datacenters. 文件中包含计算、SQL 和存储范围。The file includes compute, SQL, and storage ranges.

每周都将发布更新的文件。An updated file is posted weekly. 该文件反映当前已部署的范围和任何即将对 IP 范围进行的更改。The file reflects the currently deployed ranges and any upcoming changes to the IP ranges. 数据中心至少在一周后才会使用文件中显示的新范围。New ranges that appear in the file aren't used in the datacenters for at least one week. 建议每周下载新的 XML 文件。It's a good idea to download the new XML file every week. 然后,更新网站以正确标识 Azure 中运行的服务。Then update your site to correctly identify services running in Azure.

Azure ExpressRoute 用户应注意,此文件过去经常在每个月的第一周更新 Azure 空间的边界网关协议 (BGP) 播发。Azure ExpressRoute users should note that this file is used to update the Border Gateway Protocol (BGP) advertisement of Azure space in the first week of each month.

后续步骤Next steps