在 Terraform 中通过 WinRM 连接到远程主机失败答案

【问题标题】：Connecting to remote host via WinRM fails in Terraform在 Terraform 中通过 WinRM 连接到远程主机失败
【发布时间】：2021-01-18 10:55:17
【问题描述】：

我正在尝试在 Windows VM 上使用 terraform 在配置器下运行

provisioner "remote-exec" {
    connection {
      type = "winrm"
      user     = "${local.admin_username}"
      password = "${local.admin_password}"
      port     = 5986
      https    = true
      timeout  = "10m"
      host = azurerm_public_ip.example.ip_address        
      insecure = true
    }

    inline = [
      "powershell.exe New-Item -Path c:\\ -Name testfile1.txt -ItemType file -Value This is a text string."
    ]
  }

在配置 VM 时，我在尝试使用 remote-exec 建立连接时遇到错误

azurerm_virtual_machine.example (remote-exec): Connecting to remote host via WinRM...
azurerm_virtual_machine.example (remote-exec):   Host: 52.172.xxx.xxx
azurerm_virtual_machine.example (remote-exec):   Port: 5986
azurerm_virtual_machine.example (remote-exec):   User: testadmin
azurerm_virtual_machine.example (remote-exec):   Password: true
azurerm_virtual_machine.example (remote-exec):   HTTPS: true
azurerm_virtual_machine.example (remote-exec):   Insecure: true
azurerm_virtual_machine.example (remote-exec):   NTLM: false
azurerm_virtual_machine.example (remote-exec):   CACert: false
azurerm_virtual_machine.example: Still creating... [11m50s elapsed]
azurerm_virtual_machine.example: Still creating... [12m0s elapsed]


Error: timeout - last error: unknown error Post "https://52.172.xxx.xxx:5986/wsman": dial tcp 52.172.xxx.xxx:5986: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

provisioner 是否以正确的格式提供？

【问题讨论】：

您是否在 Windows 主机上启用/配置了 WinRM 和 ICF（防火墙）？默认情况下，WinRM 服务已安装并正在运行，但未配置任何侦听器，而且 Windows 防火墙将阻止与 WinRM 端口的连接。

标签： azure terraform terraform-provider-azure

【解决方案1】：

如果要使用 WinRM 访问 Azure WM，我们需要配置一些东西。更多详情请参考here。

例如

创建密钥库

New-AzKeyVault -VaultName "<vault-name>" -ResourceGroupName "<rg-name>" -Location "<vault-location>" -EnabledForDeployment -EnabledForTemplateDeployment

创建证书

$certificateName = "somename"

$thumbprint = (New-SelfSignedCertificate -DnsName $certificateName -CertStoreLocation Cert:\CurrentUser\My -KeySpec KeyExchange).Thumbprint

$cert = (Get-ChildItem -Path cert:\CurrentUser\My\$thumbprint)

$password = Read-Host -Prompt "Please enter the certificate password." -AsSecureString

Export-PfxCertificate -Cert $cert -FilePath ".\$certificateName.pfx" -Password $password

将证书上传到 Azure 密钥保管库

$fileName = "<Path to the .pfx file>"
$fileContentBytes = Get-Content $fileName -Encoding Byte
$fileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes)

[System.Collections.HashTable]$TableForJSON = @{
    "data"     = $filecontentencoded;
    "dataType" = "pfx";
    "password" = "<password>";
}
[System.String]$JSONObject = $TableForJSON | ConvertTo-Json

$secret = ConvertTo-SecureString -String $jsonEncoded -AsPlainText –Force
Set-AzKeyVaultSecret -VaultName "<vault name>" -Name "<secret name>" -SecretValue $secret

参考您的自签名证书 URL

"osProfile": {
      ...
      "secrets": [
        {
          "sourceVault": {
            "id": "<resource id of the Key Vault containing the secret>"
          },
          "vaultCertificates": [
            {
              "certificateUrl": "<URL for the certificate you got in Step 4>",
              "certificateStore": "<Name of the certificate store on the VM>"
            }
          ]
        }
      ],
      "windowsConfiguration": {
        ...
        "winRM": {
          "listeners": [
            {
              "protocol": "http"
            },
            {
              "protocol": "https",
              "certificateUrl": "[reference(resourceId(resourceGroup().name, 'Microsoft.KeyVault/vaults/secrets', '<vault-name>', '<secret-name>'), '2015-06-01').secretUriWithVersion]"
            }
          ]
        },
        ...
      }
    },

连接到 Azure VM 以启用 winRm 服务

Enable-PSRemoting -Force

【讨论】：