您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

教程 - 如何在 Azure 中的 Linux 虚拟机首次启动时使用 cloud-init 对其进行自定义Tutorial - How to use cloud-init to customize a Linux virtual machine in Azure on first boot

在前面的教程中,已学习如何通过 SSH 连接到虚拟机 (VM) 并手动安装 NGINX。In a previous tutorial, you learned how to SSH to a virtual machine (VM) and manually install NGINX. 若要以快速一致的方式创建 VM,通常需要某种形式的自动化。To create VMs in a quick and consistent manner, some form of automation is typically desired. 在首次启动 VM 时实现自定义的常见方法是使用 cloud-initA common approach to customize a VM on first boot is to use cloud-init. 本教程介绍如何执行下列操作:In this tutorial you learn how to:

  • 创建 cloud-init 配置文件Create a cloud-init config file
  • 创建使用 cloud-init 文件的 VMCreate a VM that uses a cloud-init file
  • 在创建 VM 后,查看正在运行的 Node.js 应用View a running Node.js app after the VM is created
  • 使用 Key Vault 安全地存储证书Use Key Vault to securely store certificates
  • 使用 cloud-init 自动进行 NGINX 的安全部署Automate secure deployments of NGINX with cloud-init

打开 Azure Cloud ShellOpen Azure Cloud Shell

Azure Cloud Shell 是免费的交互式 shell,可以使用它运行本文中的步骤。Azure Cloud Shell is a free, interactive shell that you can use to run the steps in this article. Cloud Shell 中预安装并配置了常用 Azure 工具供你与帐户一起使用。Common Azure tools are preinstalled and configured in Cloud Shell for you to use with your account. 只需选择“复制”按钮即可复制代码,将其粘贴到 Cloud Shell 中,然后按 Enter 来运行它。Just select the Copy button to copy the code, paste it in Cloud Shell, and then press Enter to run it. 可通过多种方式打开 Cloud Shell:There are a few ways to open Cloud Shell:

选择代码块右上角的“试用”。Select Try It in the upper-right corner of a code block. 本文中的 Cloud Shell
在浏览器中打开 Cloud Shell。Open Cloud Shell in your browser. https://shell.azure.com/bash
选择 Azure 门户右上角菜单上的“Cloud Shell”按钮。Select the Cloud Shell button on the menu in the upper-right corner of the Azure portal. 门户中的 Cloud Shell

如果选择在本地安装并使用 CLI,本教程要求运行 Azure CLI 2.0.30 或更高版本。If you choose to install and use the CLI locally, this tutorial requires that you are running the Azure CLI version 2.0.30 or later. 运行 az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

Cloud-init 概述Cloud-init overview

Cloud-init 是一种广泛使用的方法,用于在首次启动 Linux VM 时对其进行自定义。Cloud-init is a widely used approach to customize a Linux VM as it boots for the first time. 可使用 cloud-init 安装程序包和写入文件,或者配置用户和安全。You can use cloud-init to install packages and write files, or to configure users and security. 在初始启动期间运行 cloud-init 时,无需额外的步骤且无需代理来应用配置。As cloud-init runs during the initial boot process, there are no additional steps or required agents to apply your configuration.

Cloud-init 还支持不同的分发。Cloud-init also works across distributions. 例如,不要使用 apt-get 安装或 yum 安装来安装包。For example, you don't use apt-get install or yum install to install a package. 可定义要安装的程序包的列表。Instead you can define a list of packages to install. Cloud-init 将为所选发行版自动使用本机包管理工具。Cloud-init automatically uses the native package management tool for the distro you select.

我们正在与合作伙伴协作,将 cloud-init 纳入用户向 Azure 提供的映像中并使其在映像中正常运行。We are working with our partners to get cloud-init included and working in the images that they provide to Azure. 下表概述了 cloud-init 当前在 Azure 平台映像上的可用性:The following table outlines the current cloud-init availability on Azure platform images:

别名Alias 发布者Publisher 产品/服务Offer SKUSKU 版本Version
UbuntuLTSUbuntuLTS CanonicalCanonical UbuntuServerUbuntuServer 16.04-LTS16.04-LTS 最新latest
UbuntuLTSUbuntuLTS CanonicalCanonical UbuntuServerUbuntuServer 14.04.5-LTS14.04.5-LTS 最新latest
CoreOSCoreOS CoreOSCoreOS CoreOSCoreOS StableStable 最新latest
OpenLogicOpenLogic CentOSCentOS 7-CI7-CI 最新latest
RedHatRedHat RHELRHEL 7-RAW-CI7-RAW-CI 最新latest

创建 cloud-init 配置文件Create cloud-init config file

要运行 cloud-init,请创建一个 VM,该 VM 将安装 NGINX 并运行简单的“Hello World”Node.js 应用。To see cloud-init in action, create a VM that installs NGINX and runs a simple 'Hello World' Node.js app. 以下 cloud-init 配置会安装所需的程序包、创建 Node.js 应用,然后初始化并启动该应用。The following cloud-init configuration installs the required packages, creates a Node.js app, then initialize and starts the app.

在当前 shell 中,创建名为“cloud-init.txt”的文件并粘贴下面的配置。In your current shell, create a file named cloud-init.txt and paste the following configuration. 例如,在不处于本地计算机上的 Cloud Shell 中创建文件。For example, create the file in the Cloud Shell not on your local machine. 可使用任何想要使用的编辑器。You can use any editor you wish. 输入 sensible-editor cloud-init.txt 以创建文件并查看可用编辑器的列表。Enter sensible-editor cloud-init.txt to create the file and see a list of available editors. 请确保已正确复制整个 cloud-init 文件,尤其是第一行:Make sure that the whole cloud-init file is copied correctly, especially the first line:

#cloud-config
package_upgrade: true
packages:
  - nginx
  - nodejs
  - npm
write_files:
  - owner: www-data:www-data
  - path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 80;
        location / {
          proxy_pass http://localhost:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection keep-alive;
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
        }
      }
  - owner: azureuser:azureuser
  - path: /home/azureuser/myapp/index.js
    content: |
      var express = require('express')
      var app = express()
      var os = require('os');
      app.get('/', function (req, res) {
        res.send('Hello World from host ' + os.hostname() + '!')
      })
      app.listen(3000, function () {
        console.log('Hello world app listening on port 3000!')
      })
runcmd:
  - service nginx restart
  - cd "/home/azureuser/myapp"
  - npm init
  - npm install express -y
  - nodejs index.js

有关 cloud-init 配置选项的详细信息,请参阅 cloud-init 配置示例For more information about cloud-init configuration options, see cloud-init config examples.

创建虚拟机Create virtual machine

使用 az group create 创建资源组,才能创建 VM。Before you can create a VM, create a resource group with az group create. 以下示例在“eastus”位置创建名为“myResourceGroupAutomate”的资源组:The following example creates a resource group named myResourceGroupAutomate in the eastus location:

az group create --name myResourceGroupAutomate --location eastus

现使用 az vm create 创建 VM。Now create a VM with az vm create. 使用 --custom-data 参数传递到 cloud-init 配置文件中。Use the --custom-data parameter to pass in your cloud-init config file. 如果未将 cloud-init.txt 配置文件保存在现有工作目录中,请提供该文件的完整路径。Provide the full path to the cloud-init.txt config if you saved the file outside of your present working directory. 以下示例创建一个名为“myAutomatedVM”的 VM:The following example creates a VM named myAutomatedVM:

az vm create \
    --resource-group myResourceGroupAutomate \
    --name myVM \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --custom-data cloud-init.txt

创建 VM、安装程序包和启动应用需耗时几分钟。It takes a few minutes for the VM to be created, the packages to install, and the app to start. 在 Azure CLI 向你返回提示之后,仍然存在继续运行的后台任务。There are background tasks that continue to run after the Azure CLI returns you to the prompt. 可能还需等待几分钟才能访问应用。It may be another couple of minutes before you can access the app. 创建 VM 后,请记下 Azure CLI 显示的 publicIpAddressWhen the VM has been created, take note of the publicIpAddress displayed by the Azure CLI. 此地址用于通过 Web 浏览器访问 Node.js 应用。This address is used to access the Node.js app via a web browser.

若要使 VM 能使用 Web 流量,请通过 az vm open-port 从 Internet 中打开端口 80:To allow web traffic to reach your VM, open port 80 from the Internet with az vm open-port:

az vm open-port --port 80 --resource-group myResourceGroupAutomate --name myVM

测试 Web 应用Test web app

现在可以打开 Web 浏览器,并在地址栏中输入“http://”。Now you can open a web browser and enter http:// in the address bar. 在 VM 创建过程中提供自己的公共 IP 地址。Provide your own public IP address from the VM create process. 将显示 Node.js 应用,如下例所示:Your Node.js app is displayed as shown in the following example:

查看运行中的 NGINX 站点

插入 Key Vault 中的证书Inject certificates from Key Vault

此可选部分展示了如何在 Azure Key Vault 中安全存储证书,并在 VM 部署期间将其插入。This optional section shows how you can securely store certificates in Azure Key Vault and inject them during the VM deployment. 此过程可确保首次启动时会最新的证书插入到 VM 中,而不是使用内置证书中随附的自定义映像。Rather than using a custom image that includes the certificates baked-in, this process ensures that the most up-to-date certificates are injected to a VM on first boot. 在该过程中,证书永远不会离开 Azure 平台,也不会在脚本、命令行历史记录或模板中公开。During the process, the certificate never leaves the Azure platform or is exposed in a script, command-line history, or template.

Azure Key Vault 保护加密密钥和机密,例如证书或密码。Azure Key Vault safeguards cryptographic keys and secrets, such as certificates or passwords. Key Vault 有助于简化密钥管理过程,从而可持续掌控用于访问和加密数据的密钥。Key Vault helps streamline the key management process and enables you to maintain control of keys that access and encrypt your data. 此方案介绍了一些用于证书创建和使用的 Key Vault 概念,但未详尽概述如何使用 Key Vault。This scenario introduces some Key Vault concepts to create and use a certificate, though is not an exhaustive overview on how to use Key Vault.

以下步骤演示可如何:The following steps show how you can:

  • 创建 Azure Key VaultCreate an Azure Key Vault
  • 生成证书或将其上传到 Key VaultGenerate or upload a certificate to the Key Vault
  • 利用要插入到 VM 的证书创建密钥Create a secret from the certificate to inject in to a VM
  • 创建 VM 并插入证书Create a VM and inject the certificate

创建 Azure Key VaultCreate an Azure Key Vault

首先,使用 az keyvault create 创建 Key Vault,并在部署 VM 时启用该 Key Vault。First, create a Key Vault with az keyvault create and enable it for use when you deploy a VM. 每个 Key Vault 均需具备唯一名称且全部小写。Each Key Vault requires a unique name, and should be all lower case. 将下例中的 mykeyvault 替换为自己唯一的 Key Vault 名称:Replace mykeyvault in the following example with your own unique Key Vault name:

keyvault_name=mykeyvault
az keyvault create \
    --resource-group myResourceGroupAutomate \
    --name $keyvault_name \
    --enabled-for-deployment

生成证书并存储在 Key Vault 中Generate certificate and store in Key Vault

为供生产使用,应通过 az keyvault certificate import 导入由受信任的提供程序签名的有效证书。For production use, you should import a valid certificate signed by trusted provider with az keyvault certificate import. 在本教程中,以下示例显示了如何使用 az keyvault certificate create 生成使用默认证书策略的自签名证书:For this tutorial, the following example shows how you can generate a self-signed certificate with az keyvault certificate create that uses the default certificate policy:

az keyvault certificate create \
    --vault-name $keyvault_name \
    --name mycert \
    --policy "$(az keyvault certificate get-default-policy)"

准备用于 VM 的证书Prepare certificate for use with VM

若要在 VM 创建过程中使用该证书,请使用 az keyvault secret list-versions 获取证书的 ID。To use the certificate during the VM create process, obtain the ID of your certificate with az keyvault secret list-versions. VM 需要特定格式的证书才能在启动时将其注入,因此请使用 az vm secret format 转换该证书。The VM needs the certificate in a certain format to inject it on boot, so convert the certificate with az vm secret format. 以下示例将这些命令的输出分配给变量,以便在后续步骤中使用:The following example assigns the output of these commands to variables for ease of use in the next steps:

secret=$(az keyvault secret list-versions \
          --vault-name $keyvault_name \
          --name mycert \
          --query "[?attributes.enabled].id" --output tsv)
vm_secret=$(az vm secret format --secret "$secret")

创建 cloud-init 配置以保护 NGINXCreate cloud-init config to secure NGINX

创建 VM 时,证书和密钥都将存储在受保护的 /var/lib/waagent/ 目录中。When you create a VM, certificates and keys are stored in the protected /var/lib/waagent/ directory. 要将证书自动添加到 VM 并配置 NGINX,可使用上一示例中的已更新的 cloud-init 配置。To automate adding the certificate to the VM and configuring NGINX, you can use an updated cloud-init config from the previous example.

创建名为“cloud-init-secured.txt”的文件并粘贴下面的配置。Create a file named cloud-init-secured.txt and paste the following configuration. 同样,如果使用 Cloud Shell,则在此处而非本地计算机上创建 cloud-init 配置文件。Again, if you use the Cloud Shell, create the cloud-init config file there and not on your local machine. 使用 sensible-editor cloud-init-secured.txt 创建文件并查看可用编辑器的列表。Use sensible-editor cloud-init-secured.txt to create the file and see a list of available editors. 请确保已正确复制整个 cloud-init 文件,尤其是第一行:Make sure that the whole cloud-init file is copied correctly, especially the first line:

#cloud-config
package_upgrade: true
packages:
  - nginx
  - nodejs
  - npm
write_files:
  - owner: www-data:www-data
  - path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 80;
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/mycert.cert;
        ssl_certificate_key /etc/nginx/ssl/mycert.prv;
        location / {
          proxy_pass http://localhost:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection keep-alive;
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
        }
      }
  - owner: azureuser:azureuser
  - path: /home/azureuser/myapp/index.js
    content: |
      var express = require('express')
      var app = express()
      var os = require('os');
      app.get('/', function (req, res) {
        res.send('Hello World from host ' + os.hostname() + '!')
      })
      app.listen(3000, function () {
        console.log('Hello world app listening on port 3000!')
      })
runcmd:
  - secretsname=$(find /var/lib/waagent/ -name "*.prv" | cut -c -57)
  - mkdir /etc/nginx/ssl
  - cp $secretsname.crt /etc/nginx/ssl/mycert.cert
  - cp $secretsname.prv /etc/nginx/ssl/mycert.prv
  - service nginx restart
  - cd "/home/azureuser/myapp"
  - npm init
  - npm install express -y
  - nodejs index.js

创建安全的 VMCreate secure VM

现使用 az vm create 创建 VM。Now create a VM with az vm create. 使用 --secrets 参数插入 Key Vault 中的证书数据。The certificate data is injected from Key Vault with the --secrets parameter. 与上个示例一样,使用 --custom-data 参数传递到 cloud-init 配置中:As in the previous example, you also pass in the cloud-init config with the --custom-data parameter:

az vm create \
    --resource-group myResourceGroupAutomate \
    --name myVMSecured \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --custom-data cloud-init-secured.txt \
    --secrets "$vm_secret"

创建 VM、安装程序包和启动应用需耗时几分钟。It takes a few minutes for the VM to be created, the packages to install, and the app to start. 在 Azure CLI 向你返回提示之后,仍然存在继续运行的后台任务。There are background tasks that continue to run after the Azure CLI returns you to the prompt. 可能还需等待几分钟才能访问应用。It may be another couple of minutes before you can access the app. 创建 VM 后,请记下 Azure CLI 显示的 publicIpAddressWhen the VM has been created, take note of the publicIpAddress displayed by the Azure CLI. 此地址用于通过 Web 浏览器访问 Node.js 应用。This address is used to access the Node.js app via a web browser.

若要使 VM 能使用安全的 Web 流量,请通过 az vm open-port 从 Internet 中打开端口 443:To allow secure web traffic to reach your VM, open port 443 from the Internet with az vm open-port:

az vm open-port \
    --resource-group myResourceGroupAutomate \
    --name myVMSecured \
    --port 443

测试 Web 应用是否安全Test secure web app

现在可以打开 Web 浏览器,并在地址栏中输入“https://”。Now you can open a web browser and enter https:// in the address bar. 提供你自己的公共 IP 地址,如前面的 VM 创建过程的输出中所示。Provide your own public IP address as shown in the output of the previous VM create process. 若使用自签名的证书,请接受安全警告:Accept the security warning if you used a self-signed certificate:

接受 Web 浏览器安全警告

随即显示受保护的 NGINX 站点和 Node.js 应用,如下例所示:Your secured NGINX site and Node.js app is then displayed as in the following example:

查看运行中的安全 NGINX 站点

后续步骤Next steps

在本教程中,使用 cloud-init 在首次启动时配置 VM。In this tutorial, you configured VMs on first boot with cloud-init. 你已了解如何:You learned how to:

  • 创建 cloud-init 配置文件Create a cloud-init config file
  • 创建使用 cloud-init 文件的 VMCreate a VM that uses a cloud-init file
  • 在创建 VM 后,查看正在运行的 Node.js 应用View a running Node.js app after the VM is created
  • 使用 Key Vault 安全地存储证书Use Key Vault to securely store certificates
  • 使用 cloud-init 自动进行 NGINX 的安全部署Automate secure deployments of NGINX with cloud-init

转到下一教程,了解如何创建自定义 VM 映像。Advance to the next tutorial to learn how to create custom VM images.