使用 Terraform 创建 Azure IaaS 域控制器

Posted 2023-03-23

技术标签:

【中文标题】使用 Terraform 创建 Azure IaaS 域控制器【英文标题】：Create Azure IaaS Domain Controller using Terraform 【发布时间】：2021-10-29 13:25:08 【问题描述】：

我正在尝试使用 terraform（在 Azure 中）将域控制器添加到现有域。我在我的服务器的主 terraform 文件中声明了一些本地值，如下所示：

locals 
  username_command = "$username = $var.domainAdminUsername"
  password_command = "$password = ConvertTo-SecureString $var.domainAdminPassword -AsPlainText -Force"
  credentials_command  = "$credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ($username,$password)"
  install_ad_command   = "Add-WindowsFeature -name ad-domain-services -IncludeManagementTools"
  configure_ad_command = "Install-ADDSDomainController -DomainName $var.domainName -InstallDns -Credential $credentials -SafeModeAdministratorPassword $password -Force:$true"
  shutdown_command     = "shutdown -r -t 10"
  exit_code_hack       = "exit 0"
  powershell_command   = "$local.username_command; $local.password_command; $local.credentials_command; $local.install_ad_command; $local.configure_ad_command; $local.shutdown_command; $local.exit_code_hack"

然后我将在 VM 上应用自定义脚本扩展资源，该资源运行由本地值构建的 powershell cmdlet：

resource "azurerm_virtual_machine_extension" "promote-to-domain-controller" 
  count = 2
  depends_on = [
    azurerm_windows_virtual_machine.vm
  ]

  name                 = "promote-to-domain-controller"
  virtual_machine_id   = azurerm_windows_virtual_machine.vm[count.index].id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.9"

  settings = <<SETTINGS
    
        "commandToExecute": "powershell.exe -Command \"$local.powershell_command\""
    
SETTINGS

似乎一切正常，但 VM 扩展。 [ "code": "ComponentStatus/StdOut/succeeded", "level": "Info", "displayStatus": "Provisioning succeeded", "message": "" , "code": "ComponentStatus/StdErr/succeeded", "level": "Info", "displayStatus": "Provisioning succeeded", "message": "azadmin : The term 'azadmin' is not recognized as the name of a cmdlet, function, script file, or operable program. \r\nCheck the spelling of the name, or if a path was included, verify that the path is correct and try again.\r\nAt line:1 char:13\r\n+ $username = azadmin; $password = ConvertTo-SecureString <redacted>...\r\n+ ~~~~~~~\r\n + CategoryInfo : ObjectNotFound: (azadmin:String) [], CommandNotFoundException\r\n + FullyQualifiedErrorId : CommandNotFoundException\r\n \r\nNew-Object : Exception calling \".ctor\" with \"2\" argument(s): \"Cannot process argument because the value of argument \r\n\"userName\" is not valid. Change the value of the \"userName\" argument and run the operation again.\"\r\nAt line:1 char:118\r\n+ ... edentials = New-Object -TypeName System.Management.Automation.PSCrede ...\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n + CategoryInfo : InvalidOperation: (:) [New-Object], MethodInvocationException\r\n + FullyQualifiedErrorId : ConstructorInvokedThrowException,Microsoft.PowerShell.Commands.NewObjectCommand\r\n \r\n" ]

var.domainAdminUsername 设置为“azadmin”。在第 11 行的第一个屏幕截图中，您可以看到我正在将此值 ($username) 传递给 PSCredential 构造函数。这个构造函数有两个重载：一个字符串和一个安全字符串。就好像传递给构造函数的值不是字符串，尽管它应该是。

【问题讨论】：

【参考方案1】：

您可以使用以下内容将您的 VM 提升为现有林的域控制器。

Main.tf 文件：

   provider "azurerm" 
  features 

locals 
  password_command = "$password = ConvertTo-SecureString $var.admin_password -AsPlainText -Force"

  credentials_command  = "$credentials = Get-Credential $var.domainAdminUsername"
  install_ad_command   = "Add-WindowsFeature -name ad-domain-services -IncludeManagementTools"
  configure_ad_command = "Install-ADDSDomainController -DomainName $var.active_directory_domain -InstallDns -Credential $credentials -SafeModeAdministratorPassword $password -Force:$true"
  shutdown_command     = "shutdown -r -t 10"
  exit_code_hack       = "exit 0"
  powershell_command   = " $local.password_command;$local.credentials_command; $local.install_ad_command; $local.configure_ad_command; $local.shutdown_command; $local.exit_code_hack"



data "azurerm_virtual_machine" "example" 
 name = "$var.vmname"
 resource_group_name = "$var.resource_group_name"


resource "azurerm_virtual_machine_extension" "promote-to-domain-controller" 
  name                 = "promote-to-domain-controller"
   virtual_machine_id = data.azurerm_virtual_machine.example.id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.9"

  settings = <<SETTINGS
    
        "commandToExecute": "powershell.exe -Command \"$local.powershell_command\""
    
SETTINGS

variable.tf 文件：

variable resource_group_name 
  description = "The name of the Resource Group where the VM is"
  default = "resourcegroup"

variable location 
  description = "The Azure Region in which the Resource Group exists"
  default = "resourcegrouplocation"


# Active Directory & Domain Controller
variable vmname 
  description = "The Virtual Machine name that you wish to join to the domain"
  default = "vmname"


variable "active_directory_domain" 
  description = "The name of the Active Directory domain, for example `consoto.local`"
  default = "domainname"

variable "domainAdminUsername" 
    description = "The local administrator account on the Domain"
    default = "Domain\admin or admin@domain.com"


variable "admin_password" 
  description = "The password associated with the local administrator account on the virtual machine"
  default = "password"

输出：（地形规划）

将虚拟机添加到现有域：

Main.tf

resource "azurerm_virtual_machine_extension" "join-domain" 
  name                 = "join-domain"
  location             = "$var.location"
  resource_group_name  = "$var.resource_group_name"
  virtual_machine_name = "$var.vmname"
  publisher            = "Microsoft.Compute"
  type                 = "JsonADDomainExtension"
  type_handler_version = "1.3"
  

  
  settings = <<SETTINGS
    
        "Name": "$var.active_directory_domain",
        "OUPath": "",
        "User": "$var.active_directory_domain\\$var.active_directory_username",
        "Restart": "true",
        "Options": "3"
    
SETTINGS

  protected_settings = <<SETTINGS
    
        "Password": "$var.active_directory_password"
    
SETTINGS

变量.tf

variable resource_group_name 
  description = "The name of the Resource Group where the VM is"

variable location 
  description = "The Azure Region in which the Resource Group exists"


# Active Directory & Domain Controller
variable vmname 
  description = "The Virtual Machine name that you wish to join to the domain"


variable "active_directory_domain" 
  description = "The name of the Active Directory domain, for example `consoto.local`"


variable "active_directory_username" 
  description = "The username of an account with permissions to bind machines to the Active Directory Domain"


variable "active_directory_password" 
  description = "The password of the account with permissions to bind machines to the Active Directory Domain"

注意：请确保使用用户名作为域\管理员用户名，以便代码以预期用户名作为域的用户名运行。

【讨论】：

这会创建一个新的森林，这不是我正在做的。我正在尝试将域控制器添加到现有林中。您好@RNemeth，很抱歉造成混淆，在我为现有林测试后将更改代码.. 但我可以知道您是否使用了这种格式“CORP\Administrator”的用户名？跨度> 因为安装命令需要这样的用户名您可以参考：pixelrobots.co.uk/2019/03/…或docs.microsoft.com/en-us/powershell/module/addsdeployment/… 是的，这就是问题所在。我现在把它修好了，我的代码似乎运行良好。谢谢！

以上是关于使用 Terraform 创建 Azure IaaS 域控制器的主要内容，如果未能解决你的问题，请参考以下文章

使用 Terraform 创建一个 Azure Active Directory 自定义域

创建 azure vm 时，terraform 抛出“无效或未知的密钥：区域”

在 azure 中使用 terraform 为应用服务创建自动缩放规则时出错

使用 Terraform 创建具有托管标识的 Azure AKS 会导致 AutoUpgradePreview 未启用错误

使用 terraform 创建 azure 自动化 dsc 配置和 dsc 配置节点似乎不起作用

azure terraform 将 azure 文件共享附加到 Windows 机器