使用维护控制和 Azure PowerShell 来控制更新Control updates with Maintenance Control and Azure PowerShell

维护控制允许你决定何时向隔离的 VM 和 Azure 专用主机应用更新。Maintenance control lets you decide when to apply updates to your isolated VMs and Azure dedicated hosts. 本主题介绍维护控制的 Azure PowerShell 选项。This topic covers the Azure PowerShell options for Maintenance control. 有关使用维护控制的好处、其限制和其他管理选项的详细信息,请参阅使用维护控制管理平台更新For more about benefits of using Maintenance control, its limitations, and other management options, see Managing platform updates with Maintenance Control.

启用 PowerShell 模块Enable the PowerShell module

确保 PowerShellGet 为最新版本。Make sure PowerShellGet is up to date.

Install-Module -Name PowerShellGet -Repository PSGallery -Force 

安装 Az.Maintenance PowerShell 模块。Install the Az.Maintenance PowerShell module.

Install-Module -Name Az.Maintenance

如果在本地安装,请确保以管理员身份打开 PowerShell 提示符。If you are installing locally, make sure you open your PowerShell prompt as an administrator.

系统还可能会要求你确认是否要从不受信任的存储库进行安装。You may also be asked to confirm that you want to install from an untrusted repository. 键入 Y 或选择“全是”以安装该模块。Type Y or select Yes to All to install the module.

创建维护配置Create a maintenance configuration

创建一个资源组作为适用于配置的容器。Create a resource group as a container for your configuration. 此示例在 chinaeast2 中创建名为 myMaintenanceRG 的资源组 。In this example, a resource group named myMaintenanceRG is created in chinaeast2. 如果已有一个可供使用的资源组,则可跳过此部分,并在其余示例中将资源组名称替换为你自己的名称。If you already have a resource group that you want to use, you can skip this part and replace the resource group name with you own in the rest of the examples.

New-AzResourceGroup `
   -Location chinaeast2 `
   -Name myMaintenanceRG

使用 New-AzMaintenanceConfiguration 创建维护配置。Use New-AzMaintenanceConfiguration to create a maintenance configuration. 此示例创建名为 myConfig 的维护配置,该配置的范围限定为主机。This example creates a maintenance configuration named myConfig scoped to the host.

$config = New-AzMaintenanceConfiguration `
   -ResourceGroup myMaintenanceRG `
   -Name myConfig `
   -MaintenanceScope host `
   -Location  chinaeast2

使用 -MaintenanceScope host 确保将维护配置用于控制对主机的更新。Using -MaintenanceScope host ensures that the maintenance configuration is used for controlling updates to the host.

如果尝试创建同名的但位于不同位置的配置,则会收到错误。If you try to create a configuration with the same name, but in a different location, you will get an error. 配置名称必须是你的订阅特有的。Configuration names must be unique to your subscription.

可以使用 Get-AzMaintenanceConfiguration 来查询可用的维护配置。You can query for available maintenance configurations using Get-AzMaintenanceConfiguration.

Get-AzMaintenanceConfiguration | Format-Table -Property Name,Id

分配此配置Assign the configuration

使用 New-AzConfigurationAssignment 将配置分配到隔离的 VM 或 Azure 专用主机。Use New-AzConfigurationAssignment to assign the configuration to your isolated VM or Azure Dedicated Host.

隔离的 VMIsolated VM

使用此配置的 ID 将配置应用到 VM。Apply the configuration to a VM using the ID of the configuration. 指定 -ResourceType VirtualMachines,为 -ResourceName 提供 VM 的名称,为 -ResourceGroupName 提供 VM 的资源组。Specify -ResourceType VirtualMachines and supply the name of the VM for -ResourceName, and the resource group of the VM for -ResourceGroupName.

New-AzConfigurationAssignment `
   -ResourceGroupName myResourceGroup `
   -Location chinaeast2 `
   -ResourceName myVM `
   -ResourceType VirtualMachines `
   -ProviderName Microsoft.Compute `
   -ConfigurationAssignmentName $config.Name `
   -MaintenanceConfigurationId $config.Id

专用主机Dedicated host

若要将配置应用到专用主机,还需要包含 -ResourceType hosts、带主机组名称的 -ResourceParentName,以及 -ResourceParentType hostGroupsTo apply a configuration to a dedicated host, you also need to include -ResourceType hosts, -ResourceParentName with the name of the host group, and -ResourceParentType hostGroups.

New-AzConfigurationAssignment `
   -ResourceGroupName myResourceGroup `
   -Location chinaeast2 `
   -ResourceName myHost `
   -ResourceType hosts `
   -ResourceParentName myHostGroup `
   -ResourceParentType hostGroups `
   -ProviderName Microsoft.Compute `
   -ConfigurationAssignmentName $config.Name `
   -MaintenanceConfigurationId $config.Id

检查是否有挂起的更新Check for pending updates

使用 Get-AzMaintenanceUpdate 查看是否存在挂起的更新。Use Get-AzMaintenanceUpdate to see if there are pending updates. 使用 -subscription 指定 VM 的 Azure 订阅(如果其订阅不同于你登录到的订阅)。Use -subscription to specify the Azure subscription of the VM if it is different from the one that you are logged into.

如果没有可显示的更新,此命令不会返回任何内容。If there are no updates to show, this command will return nothing. 否则,它会返回一个 PSApplyUpdate 对象:Otherwise, it will return a PSApplyUpdate object:

{
   "maintenanceScope": "Host",
   "impactType": "Freeze",
   "status": "Pending",
   "impactDurationInSec": 9,
   "notBefore": "2020-02-21T16:47:44.8728029Z",
   "properties": {
      "resourceId": "/subscriptions/39c6cced-4d6c-4dd5-af86-57499cd3f846/resourcegroups/Ignite2019/providers/Microsoft.Compute/virtualMachines/MCDemo3"
} 

隔离的 VMIsolated VM

检查隔离的 VM 的挂起更新。Check for pending updates for an isolated VM. 在此示例中,输出的格式为表格,方便你阅读。In this example, the output is formatted as a table for readability.

Get-AzMaintenanceUpdate `
  -ResourceGroupName myResourceGroup `
  -ResourceName myVM `
  -ResourceType VirtualMachines `
  -ProviderName Microsoft.Compute | Format-Table

专用主机Dedicated host

检查专用主机的挂起更新。To check for pending updates for a dedicated host. 在此示例中,输出的格式为表格,方便你阅读。In this example, the output is formatted as a table for readability. 将资源的值替换为你自己的值。Replace the values for the resources with your own.

Get-AzMaintenanceUpdate `
   -ResourceGroupName myResourceGroup `
   -ResourceName myHost `
   -ResourceType hosts `
   -ResourceParentName myHostGroup `
   -ResourceParentType hostGroups `
   -ProviderName Microsoft.Compute | Format-Table

应用更新Apply updates

使用 New-AzApplyUpdate 应用挂起的更新。Use New-AzApplyUpdate to apply pending updates.

隔离的 VMIsolated VM

创建向隔离的 VM 应用更新的请求。Create a request to apply updates to an isolated VM.

New-AzApplyUpdate `
   -ResourceGroupName myResourceGroup `
   -ResourceName myVM `
   -ResourceType VirtualMachines `
   -ProviderName Microsoft.Compute

成功时,此命令会返回一个 PSApplyUpdate 对象。On success, this command will return a PSApplyUpdate object. 可以在 Get-AzApplyUpdate 命令中使用 Name 特性来检查更新状态。You can use the Name attribute in the Get-AzApplyUpdate command to check the update status. 请参阅检查更新状态See Check update status.

专用主机Dedicated host

将更新应用到专用主机。Apply updates to a dedicated host.

New-AzApplyUpdate `
   -ResourceGroupName myResourceGroup `
   -ResourceName myHost `
   -ResourceType hosts `
   -ResourceParentName myHostGroup `
   -ResourceParentType hostGroups `
   -ProviderName Microsoft.Compute

检查更新状态Check update status

使用 Get-AzApplyUpdate 检查更新状态。Use Get-AzApplyUpdate to check on the status of an update. -ApplyUpdateName 参数使用 default 时,以下命令会显示最新更新的状态。The commands shown below show the status of the latest update by using default for the -ApplyUpdateName parameter. 可以使用更新的名称(由 New-AzApplyUpdate 命令返回)来获取特定更新的状态。You can substitute the name of the update (returned by the New-AzApplyUpdate command) to get the status of a specific update.

Status         : Completed
ResourceId     : /subscriptions/12ae7457-4a34-465c-94c1-17c058c2bd25/resourcegroups/TestShantS/providers/Microsoft.Comp
ute/virtualMachines/DXT-test-04-iso
LastUpdateTime : 1/1/2020 12:00:00 AM
Id             : /subscriptions/12ae7457-4a34-465c-94c1-17c058c2bd25/resourcegroups/TestShantS/providers/Microsoft.Comp
ute/virtualMachines/DXT-test-04-iso/providers/Microsoft.Maintenance/applyUpdates/default
Name           : default
Type           : Microsoft.Maintenance/applyUpdates

LastUpdateTime 是完成更新的时间,此更新是你发起的,或由平台在你未使用自行维护时段时发起的。LastUpdateTime will be the time when the update got complete, either initiated by you or by the platform in case self-maintenance window was not used. 如果从未通过维护控制来应用更新,则会显示默认值。If there has never been an update applied through maintenance control it will show default value.

隔离的 VMIsolated VM

检查对特定虚拟机的更新。Check for updates to a specific virtual machine.

Get-AzApplyUpdate `
   -ResourceGroupName myResourceGroup `
   -ResourceName myVM `
   -ResourceType VirtualMachines `
   -ProviderName Microsoft.Compute `
   -ApplyUpdateName default

专用主机Dedicated host

检查对专用主机的更新。Check for updates to a dedicated host.

Get-AzApplyUpdate `
   -ResourceGroupName myResourceGroup `
   -ResourceName myHost `
   -ResourceType hosts `
   -ResourceParentName myHostGroup `
   -ResourceParentType hostGroups `
   -ProviderName Microsoft.Compute `
   -ApplyUpdateName myUpdateName

删除维护配置Remove a maintenance configuration

使用 Remove-AzMaintenanceConfiguration 删除维护配置。Use Remove-AzMaintenanceConfiguration to delete a maintenance configuration.

Remove-AzMaintenanceConfiguration `
   -ResourceGroupName myResourceGroup `
   -Name $config.Name

后续步骤Next steps

若要了解详细信息,请参阅维护和更新To learn more, see Maintenance and updates.