Azure Automation State Configuration 概述Azure Automation State Configuration overview

Azure Automation State Configuration 是一种 Azure 配置管理服务,允许为任何云或本地数据中心内的节点编写、管理和编译 PowerShell 所需状态配置 (DSC) 配置Azure Automation State Configuration is an Azure configuration management service that allows you to write, manage, and compile PowerShell Desired State Configuration (DSC) configurations for nodes in any cloud or on-premises datacenter. 该服务还导入 DSC 资源,并将配置分配给目标节点,一切操作均在云中完成。The service also imports DSC Resources, and assigns configurations to target nodes, all in the cloud. 可以通过选择“配置管理”下的“状态配置 (DSC)”在 Azure 门户中访问 Azure Automation State Configuration 。You can access Azure Automation State Configuration in the Azure portal by selecting State configuration (DSC) under Configuration Management.

可以使用 Azure Automation State Configuration 管理各种不同的计算机:You can use Azure Automation State Configuration to manage a variety of machines:

  • Azure 虚拟机Azure virtual machines
  • Azure 虚拟机(经典)Azure virtual machines (classic)
  • 位于本地或 Azure 以外的云中的物理/虚拟 Windows 计算机Physical/virtual Windows machines on-premises, or in a cloud other than Azure
  • 位于本地、Azure 或 Azure 以外的云中的物理/虚拟 Linux 计算机Physical/virtual Linux machines on-premises, in Azure, or in a cloud other than Azure

如果未准备好从云中管理计算机配置,也可使用 Azure Automation State Configuration 作为仅限报告的终结点。If you aren't ready to manage machine configuration from the cloud, you can use Azure Automation State Configuration as a report-only endpoint. 此功能允许你通过 DSC 设置(推送)配置,并在 Azure 自动化中查看报表详细信息。This feature allows you to set (push) configurations through DSC and view reporting details in Azure Automation.

备注

如果已安装的 Azure VM Desired State Configuration 扩展版本大于 2.70,则其中包含了可通过 Azure Automation State Configuration 来管理 Azure VM 的功能,且不收取额外费用。Managing Azure VMs with Azure Automation State Configuration is included at no extra charge if the installed Azure VM Desired State Configuration extension version is greater than 2.70. 有关详细信息,请参阅 Automation 定价页For more information, see Automation pricing page.

为何使用 Azure Automation State ConfigurationWhy use Azure Automation State Configuration

与在 Azure 之外使用 DSC 相比,Azure Automation State Configuration 具有多项优势。Azure Automation State Configuration provides several advantages over the use of DSC outside of Azure. 该服务可让你从中心的安全位置快速轻松地扩展到数千台计算机。This service enables scalability across thousands of machines quickly and easily from a central, secure location. 可以轻松启用计算机、为其分配声明性配置并查看显示每台计算机是否符合指定的所需状态的报告。You can easily enable machines, assign them declarative configurations, and view reports showing each machine's compliance with the desired state you specify.

Azure Automation State Configuration 服务对于 DSC 而言如同 Azure 自动化 Runbook 对于 PowerShell 脚本而言。The Azure Automation State Configuration service is to DSC what Azure Automation runbooks are to PowerShell scripting. 换句话说,Azure 自动化以帮助你管理 PowerShell 脚本的相同方式帮助你管理 DSC 配置。In other words, in the same way that Azure Automation helps you manage PowerShell scripts, it also helps you manage DSC configurations.

内置拉取服务器Built-in pull server

Azure Automation State Configuration 提供类似于 Windows 功能 DSC 服务的 DSC 拉取服务器。Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service. 目标节点可自动接收配置、符合所需状态,以及报告其合规性。Target nodes can automatically receive configurations, conform to the desired state, and report on their compliance. Azure 自动化中的内置拉取服务器消除了设置和维护你自己的拉取服务器的需要。The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure 自动化的目标可以是云中或本地的虚拟机,或物理 Windows 或 Linux 计算机。Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

管理所有 DSC 项目Management of all your DSC artifacts

Azure Automation State Configuration 向 PowerShell Desired State Configuration 提供的管理层与它为 PowerShell 脚本提供的相同。Azure Automation State Configuration brings the same management layer to PowerShell Desired State Configuration as it offers for PowerShell scripting. 从 Azure 门户,或从 PowerShell,你可以管理所有的 DSC 配置、资源和目标节点。From the Azure portal or from PowerShell, you can manage all your DSC configurations, resources, and target nodes.

“Azure 自动化”页的屏幕截图

将报表数据导入 Azure Monitor 日志Import of reporting data into Azure Monitor logs

使用 Azure Automation State Configuration 进行管理的节点将详细的报表状态数据发送到内置拉取服务器。Nodes that are managed with Azure Automation State Configuration send detailed reporting status data to the built-in pull server. 可以将 Azure Automation State Configuration 配置为将此数据发送到 Log Analytics 工作区。You can configure Azure Automation State Configuration to send this data to your Log Analytics workspace. 请参阅将 Azure Automation State Configuration 报告数据转发到 Azure Monitor 日志See Forward Azure Automation State Configuration reporting data to Azure Monitor logs.

先决条件Prerequisites

使用 Azure Automation State Configuration 时,请想一想本节中的要求。Consider the requirements in this section when using Azure Automation State Configuration.

操作系统要求Operating system requirements

对于运行 Windows 的节点,支持以下版本:For nodes running Windows, the following versions are supported:

  • Windows Server 2019Windows Server 2019
  • Windows Server 2016Windows Server 2016
  • Windows Server 2012R2Windows Server 2012R2
  • Windows Server 2012Windows Server 2012
  • Windows Server 2008 R2 SP1Windows Server 2008 R2 SP1
  • Windows 10Windows 10
  • Windows 8.1Windows 8.1
  • Windows 7Windows 7

备注

Microsoft Hyper-V Server 独立产品 SKU 不包含 DSC 的实现。The Microsoft Hyper-V Server standalone product SKU does not contain an implementation of DSC. 因此,它不能由 PowerShell DSC 或 Azure Automation State Configuration 进行管理。Thus it can't be managed by PowerShell DSC or Azure Automation State Configuration.

对于运行 Linux 的节点,DSC Linux 扩展支持 PowerShell DSC 文档中列出的所有 Linux 发行版。For nodes running Linux, the DSC Linux extension supports all the Linux distributions listed in the PowerShell DSC documentation.

DSC 要求DSC requirements

对于在 Azure 中运行的所有 Windows 节点,在启用计算机时会安装 WMF 5.1For all Windows nodes running in Azure, WMF 5.1 is installed when machines are enabled. 对于运行 Windows 服务器 2012 和 Windows 7 的节点,会启用 WinRMFor nodes running Windows Server 2012 and Windows 7, WinRM is enabled.

对于在 Azure 中运行的所有 Linux 节点,将在启用计算机时安装 PowerShell DSC for LinuxFor all Linux nodes running in Azure, PowerShell DSC for Linux is installed when machines are enabled.

私有网络配置Configuration of private networks

如果节点位于专用网络中,则需要以下端口和 URL。If your nodes are located in a private network, the following port and URLs are required. 这些资源为托管节点提供网络连接,并允许 DSC 与 Azure 自动化功能通信。These resources provide network connectivity for the managed node and allow DSC to communicate with Azure Automation.

  • 端口:只需使用 TCP 443 即可进行出站 Internet 访问Port: Only TCP 443 required for outbound internet access
  • 全局 URL:* .azure-automation.cnGlobal URL: *.azure-automation.cn
  • 代理服务: https://<workspaceId>.agentsvc.azure-automation.cnAgent service: https://<workspaceId>.agentsvc.azure-automation.cn

如果使用在节点之间传递的 DSC 资源(如 WaitFor* 资源),还需要允许节点之间产生流量。If you are using DSC resources that communicate between nodes, such as the WaitFor* resources, you also need to allow traffic between nodes. 请参阅每个 DSC 资源的文档以了解这些网络要求。See the documentation for each DSC resource to understand these network requirements.

若要了解 TLS 1.2 的客户端要求,请参阅强制 Azure 自动化执行 TLS 1.2To understand client requirements for TLS 1.2, see TLS 1.2 enforcement for Azure Automation.

代理支持Proxy support

Windows 版本 1809 及更高版本中提供了对 DSC 代理的代理支持。Proxy support for the DSC agent is available in Windows version 1809 and later. 此选项的启用方法是:在用于注册节点的元配置脚本中设置 ProxyURLProxyCredential 属性的值。This option is enabled by setting the values for ProxyURL and ProxyCredential properties in the metaconfiguration script used to register nodes.

备注

Azure Automation State Configuration 不为早期版本的 Windows 提供 DSC 代理支持。Azure Automation State Configuration does not provide DSC proxy support for previous versions of Windows.

对于 Linux 节点,DSC 代理支持代理并使用 http_proxy 变量来确定 URL。For Linux nodes, the DSC agent supports proxy and uses the http_proxy variable to determine the URL. 若要详细了解代理支持,请参阅生成 DSC 元配置To find out more about proxy support, see Generate DSC metaconfigurations.

后续步骤Next steps