将服务器配置到所需状态并管理偏移Configure servers to a desired state and manage drift

使用 Azure 自动化状态配置可以指定服务器配置,并确保这些服务器在一段时间后处于指定状态。Azure Automation State Configuration allows you to specify configurations for your servers and ensure that those servers are in the specified state over time.

  • 登记要由 Azure Automation DSC 管理的 VMOnboard a VM to be managed by Azure Automation DSC
  • 将配置上传到 Azure 自动化Upload a configuration to Azure Automation
  • 将配置编译为节点配置Compile a configuration into a node configuration
  • 将节点配置分配给托管节点Assign a node configuration to a managed node
  • 检查托管节点的符合性状态Check the compliance status of a managed node

对于本教程,我们将使用简单 DSC 配置,以确保在 VM 上安装 IIS。For this tutorial, we use a simple DSC configuration that ensures that IIS is installed on the VM.

先决条件Prerequisites

要完成本教程,需要:To complete this tutorial, you need:

支持部分配置Support for partial configurations

Azure 自动化状态配置支持使用部分配置Azure Automation State Configuration supports the use of partial configurations. 在此方案中,DSC 配置为独立管理多个配置,并且每个配置都从 Azure 自动化中检索。In this scenario, DSC is configured to manage multiple configurations independently, and each configuration is retrieved from Azure Automation. 但是,每个自动化帐户只能为一个节点分配一个配置。However, only one configuration can be assigned to a node per automation account. 这意味着,如果对节点使用两种配置,则需要两个自动化帐户。This means if you are using two configurations for a node you will require two Automation accounts.

有关如何从请求服务注册部分配置的详细信息,请参阅部分配置的文档。For details about how to register a partial configuration from a pull service, see the documentation for partial configurations.

有关团队如何协作以代码形式使用配置来协作管理服务器的更多信息,请参见了解 DSC 在 CI/CD 管道中的角色For more information about how teams can work together to collaboratively manage servers using configuration as code, see Understanding DSC's role in a CI/CD Pipeline.

登录 AzureLog in to Azure

使用 Connect-AzAccount cmdlet 登录到 Azure 订阅,然后按屏幕说明操作。Log in to your Azure subscription with the Connect-AzAccount cmdlet and follow the on-screen directions.

Connect-AzAccount -Environment AzureChinaCloud

创建配置并将配置上传到 Azure 自动化Create and upload a configuration to Azure Automation

在文本编辑器中键入以下内容,并在本地将文件保存为 TestConfig.ps1。In a text editor, type the following and save it locally as TestConfig.ps1.

configuration TestConfig {
   Node WebServer {
      WindowsFeature IIS {
         Ensure               = 'Present'
         Name                 = 'Web-Server'
         IncludeAllSubFeature = $true
      }
   }
}

Note

在需要导入多个提供 DSC 资源的模块的更高级方案中,请确保每个模块在配置中都有唯一的 Import-DscResource 行。In more advanced scenarios where you require multiple modules to be imported that provide DSC Resources, make sure each module has a unique Import-DscResource line in your configuration.

调用 Import-AzAutomationDscConfiguration cmdlet 将配置上传到自动化帐户。Call the Import-AzAutomationDscConfiguration cmdlet to upload the configuration into your Automation account.

 Import-AzAutomationDscConfiguration -SourcePath 'C:\DscConfigs\TestConfig.ps1' -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -Published

将配置编译为节点配置Compile a configuration into a node configuration

必须先将 DSC 配置编译为节点配置,然后才能将它分配给节点。A DSC configuration must be compiled into a node configuration before it can be assigned to a node. 参阅 DSC 配置See DSC configurations.

调用 Start-AzAutomationDscCompilationJob cmdlet,将 TestConfig 配置编译为自动化帐户中名为 TestConfig.WebServer 的节点配置。Call the Start-AzAutomationDscCompilationJob cmdlet to compile the TestConfig configuration into a node configuration named TestConfig.WebServer in your Automation account.

Start-AzAutomationDscCompilationJob -ConfigurationName 'TestConfig' -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount'

注册要由状态配置管理的 VMRegister a VM to be managed by State Configuration

可以使用 Azure 自动化状态配置来管理 Azure VM(包括经典 VM 和资源管理器 VM)、本地 VM、Linux 计算机、AWS VM,以及本地物理机。You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines. 在本主题中,我们介绍如何仅注册 Azure 资源管理器 VM。In this topic, we cover how to register only Azure Resource Manager VMs. 有关注册其他类型的计算机的信息,请参阅登记由 Azure 自动化状态配置管理的计算机For information about registering other types of machines, see Onboarding machines for management by Azure Automation State Configuration.

调用 Register-AzAutomationDscNode cmdlet,以托管节点形式在 Azure 自动化状态配置中注册 VM。Call the Register-AzAutomationDscNode cmdlet to register your VM with Azure Automation State Configuration as a managed node.

Register-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -AzureVMName 'DscVm'

指定配置模式设置Specify configuration mode settings

使用 Register-AzAutomationDscNode cmdlet,以托管节点形式注册 VM 并指定配置属性。Use the Register-AzAutomationDscNode cmdlet to register a VM as a managed node and specify configuration properties. 例如,可以通过将 ApplyOnly 指定为 ConfigurationMode 属性的值来指定计算机状态仅应用一次。For example, you can specify that the state of the machine is to be applied only once by specifying ApplyOnly as the value of the ConfigurationMode property. 状态配置在初始检查结束后不会尝试应用这些配置。State Configuration doesn't try to apply the configuration after the initial check.

Register-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -AzureVMName 'DscVm' -ConfigurationMode 'ApplyOnly'

还可以使用 ConfigurationModeFrequencyMins 属性指定 DSC 检查配置状态的频率。You can also specify how often DSC checks the configuration state by using the ConfigurationModeFrequencyMins property. 有关 DSC 配置设置的详细信息,请参阅配置本地配置管理器For more information about DSC configuration settings, see Configuring the Local Configuration Manager.

# Run a DSC check every 60 minutes
Register-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -AzureVMName 'DscVm' -ConfigurationModeFrequencyMins 60

将节点配置分配给托管节点Assign a node configuration to a managed node

现在我们可以将已编译的节点配置分配给我们想要配置的 VM。Now we can assign the compiled node configuration to the VM we want to configure.

# Get the ID of the DSC node
$node = Get-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -Name 'DscVm'

# Assign the node configuration to the DSC node
Set-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -NodeConfigurationName 'TestConfig.WebServer' -NodeId $node.Id

这会将名为 TestConfig.WebServer 的节点配置分配到已注册的 DSC 节点 DscVmThis assigns the node configuration named TestConfig.WebServer to the registered DSC node DscVm. 默认情况下,每隔 30 分钟会检查一次 DSC 节点是否符合节点配置。By default, the DSC node is checked for compliance with the node configuration every 30 minutes. 有关如何更改符合性检查间隔的信息,请参阅配置本地配置管理器For information about how to change the compliance check interval, see Configuring the Local Configuration Manager.

检查托管节点的符合性状态Check the compliance status of a managed node

可以使用 Get-AzAutomationDscNodeReport cmdlet 获取有关托管节点符合性状态的报告。You can get reports on the compliance status of a managed node using the Get-AzAutomationDscNodeReport cmdlet.

# Get the ID of the DSC node
$node = Get-AzAutomationDscNode -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -Name 'DscVm'

# Get an array of status reports for the DSC node
$reports = Get-AzAutomationDscNodeReport -ResourceGroupName 'MyResourceGroup' -AutomationAccountName 'myAutomationAccount' -NodeId $node.Id

# Display the most recent report
$reports[0]

从服务中删除节点Remove nodes from service

当节点添加到 Azure 自动化 State Configuration 时,本地配置管理器中的设置会设置为注册到服务,并拉取配置和所需的模块,以配置计算机。When you add a node to Azure Automation State Configuration, the settings in Local Configuration Manager are set to register with the service and pull configurations and required modules to configure the machine. 如果选择从服务中删除节点,则可以使用 Azure 门户或 Az cmdlet 进行删除。If you choose to remove the node from the service, you can do so using either the Azure portal or the Az cmdlets.

Note

从服务注销节点只会设置本地配置管理器设置,这样,该节点便不再连接到该服务。Unregistering a node from the service only sets the Local Configuration Manager settings so the node is no longer connecting to the service. 这不影响当前应用于该节点的配置。This does not effect the configuration that is currently applied to the node. 若要删除当前配置,请使用 PowerShell 或删除本地配置文件(这是适用于 Linux 节点的唯一选项)。To remove the current configuration, use the PowerShell or delete the local configuration file (this is the only option for Linux nodes).

Azure 门户Azure portal

在 Azure 自动化中,单击目录中的“状态配置(DSC)”。From Azure Automation, click on State configuration (DSC) in the table of contents. 接下来,单击“节点”,以查看注册到服务的节点的列表。Next click Nodes to view the list of nodes that are registered with the service. 单击要删除的节点的名称。Click on the name of the node you wish to remove. 在打开的“节点”视图中,单击“注销”。In the Node view that opens, click Unregister.

PowerShellPowerShell

若要使用 PowerShell 从 Azure 自动化 State Configuration 服务中注销节点,请按照 cmdlet Unregister-AzAutomationDscNode 的文档进行操作。To unregister a node from Azure Automation State Configuration service using PowerShell, follow the documentation for the cmdlet Unregister-AzAutomationDscNode.

后续步骤Next steps