Azure Custom Script Extensions, Software Deployment and Package Management

Azure allows Virtual Machine extension objects to be attached to provisioned virtual machines.  As they are objects, they may be declared directly with Resource Manager templates.

Enabling Azure Point-to-site-VPN

Using Azure's Point-to-site vpn avoids having to expose ssh or winrm ports to the internet to get onto the systems.

Before a Point-to-site VPN can be established, a Virtual Network Gateway must be created.  This will be associated with the Virtual Network that will be accessible.

Access to the network will be controlled by certificates.

Create an Azure App Registration for Disk Encryption

Enabling Azure Disk Encryption requires the creation of a dedicated account to be able to access a Key Vault for the backup of disk encryption keys.  This occurs through enabling an Application Registration in the desired tenant and providing the associated Service Principal Key Wrap and Secret Set rights to the Key Vault in question.

Create and Azure Application & SPN with Certificate Authentication

This PowerShell code snippet creates an Azure AD application registration with an associated SPN and self-signed certificate for Azure authentication.

I've used this for generating certificates that Virtual Machines can use for authenticating to Azure as an alternative to Managed Identities.

Updating Azure Automation Modules

Azure Automation Module versions are continually changing with Azure.  The inconsistencies caused due to module dependencies is a modern equivalent of DLL Hell and questions the wisdom of creating complex runbooks for use with Azure.

Azure Disk Encryption Process

Architectural Overview

All virtual machine disks are accessible by WebAPI off their underlying Storage volume (either through Storage Account Access or through Snapshot usage with Managed Disks).  In the case of Storage Accounts, a single factor of access exists for retrieval of disk Images from the internet (knowledge of URI and Storage Account key).  Different controls may be implemented to reduce the threat of data loss.  Core to these controls is the requirement for all data to be encrypted at REST. 

Using Azure Automation to generate a certificate

Some time back I had cause to demonstrate the possibility of using Azure Automation in generating time limited certificates for use with Azure.  It turned out to be more difficult than I thought as certificate creation on a local server or desktop uses the COM based CryptoAPI... which isnt available for use with Automation Runbooks.

This example script used the brilliant "Bouncy Castle" library for creating certificates.

Establishing a Chocolatey Environment (Windows Server 2016)

Chocolatey is a variation of NuGet server that is freely available in different forms.  NuGet is targeted as a class or library distribution system that allows developers to search for (and install) modules into developed projects.  The variation of Chocolatey allows packages to also run install and uninstall scripts – which transforms the NuGet framework into a fully-fledged package management system. 

Windows Management Framework 5.1 incorporates Chocolatey providers that allow packages to be installed to a Windows system with single-line PowerShell commands.

PowerShell DSC (Pull) Sequence

The PowerShell DSC sequence I’m using to deploy my Windows machines primarily uses script elements although a multitude of other elements (such as WindowsFeature shown below) could be used.  The Pull Server has PowerShell DSC installed as a feature.

With this example, I’m using Server 2016 in Azure against other Azure provisioned systems.

PowerShell DSC – Pull Mode, Server 2012 R2 Client and Server 2016 Server

This example is from provisioning a Windows client on Azure and using a bootstrap (Custom Script Extension) for using PowerShell DSC (Pull) off a Server 2016 (WMF 5) DSC server.

I’m using Self-Signed certificates in my environment.  One certificate is for the webserver of my DSC server.  The second certificate is for DSC to use for encryption.


Subscribe to RSS - blogs