教學課程 - 如何使用 cloud-init 在首次開機時於 Azure 中自訂 Linux 虛擬機器Tutorial - How to use cloud-init to customize a Linux virtual machine in Azure on first boot

在先前的教學課程中,您學到了如何以 SSH 連線到虛擬機器 (VM) 並手動安裝 NGINX。In a previous tutorial, you learned how to SSH to a virtual machine (VM) and manually install NGINX. 若要以快速且一致的方式建立 VM,您通常需要借助某種形式的自動化。To create VMs in a quick and consistent manner, some form of automation is typically desired. 在初次開機時自訂 VM 的常見方法是使用 cloud-init (英文)A common approach to customize a VM on first boot is to use cloud-init. 在本教學課程中,您將了解如何:In this tutorial you learn how to:

  • 建立 Cloud-init 組態檔Create a cloud-init config file
  • 建立 VM 來使用 Cloud-init 檔案Create a VM that uses a cloud-init file
  • 在建立 VM 之後,檢視執行中的 Node.js 應用程式View a running Node.js app after the VM is created
  • 使用 Key Vault 安全地儲存憑證Use Key Vault to securely store certificates
  • 使用 Cloud-init 來安全地自動部署 NGINXAutomate secure deployments of NGINX with cloud-init

使用 Azure Cloud ShellUse Azure Cloud Shell

Azure Cloud Shell 是裝載於 Azure 中的互動式殼層環境,可在瀏覽器中使用。Azure hosts Azure Cloud Shell, an interactive shell environment that you can use through your browser. Cloud Shell 可讓您使用 bashPowerShell 以與 Azure 服務搭配使用。Cloud Shell lets you use either bash or PowerShell to work with Azure services. Azure Cloud Shell 已預先安裝一些命令,可讓您執行本文提到的程式碼,而不必在本機環境上安裝任何工具。You can use the Cloud Shell pre-installed commands to run the code in this article without having to install anything on your local environment.

若要啟動 Azure Cloud Shell:To launch Azure Cloud Shell:

選項Option 範例/連結Example/Link
選取程式碼區塊右上角的 [試試看] 。Select Try It in the upper-right corner of a code block. 選取 [試用] 並不會自動將程式碼複製到 Cloud Shell 中。Selecting Try It doesn't automatically copy the code to Cloud Shell. Azure Cloud Shell 的試試看範例
請前往 https://shell.azure.com 或選取 [啟動 Cloud Shell] 按鈕,在瀏覽器中開啟 Cloud Shell。Go to https://shell.azure.com or select the Launch Cloud Shell button to open Cloud Shell in your browser. 在新視窗中啟動 Cloud ShellLaunch Cloud Shell in a new window
選取 Azure 入口網站右上角功能表列中的 [Cloud Shell] 按鈕。Select the Cloud Shell button on the top-right menu bar in the Azure portal. Azure 入口網站中的 [Cloud Shell] 按鈕

若要在 Azure Cloud Shell 中執行本文中的程式碼:To run the code in this article in Azure Cloud Shell:

  1. 啟動 Cloud Shell。Launch Cloud Shell.

  2. 選取程式碼區塊上的 [複製] 按鈕,複製程式碼。Select the Copy button on a code block to copy the code.

  3. 在 Windows 和 Linux 上按 Ctrl+Shift+V;或在 macOS 上按 Cmd+Shift+V,將程式碼貼到 Cloud Shell工作階段中。Paste the code into the Cloud Shell session with Ctrl+Shift+V on Windows and Linux, or Cmd+Shift+V on macOS.

  4. 按下 Enter 鍵執行程式碼。Press Enter to run the code.

如果您選擇在本機安裝和使用 CLI,本教學課程會要求您執行 Azure CLI 2.0.30 版或更新版本。If you choose to install and use the CLI locally, this tutorial requires that you are running the Azure CLI version 2.0.30 or later. 執行 az --version 以尋找版本。Run az --version to find the version. 如果您需要安裝或升級,請參閱安裝 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

Cloud-Init 概觀Cloud-init overview

Cloud-init (英文) 是在 Linux VM 初次開機時,廣泛用來自訂它們的方法。Cloud-init is a widely used approach to customize a Linux VM as it boots for the first time. 您可以使用 cloud-init 來安裝封裝和寫入檔案,或者設定使用者和安全性。You can use cloud-init to install packages and write files, or to configure users and security. 當 cloud-init 在初次開機程序期間執行時,不需要使用任何額外的步驟或必要的代理程式來套用您的組態。As cloud-init runs during the initial boot process, there are no additional steps or required agents to apply your configuration.

Cloud-init 也適用於散發套件。Cloud-init also works across distributions. 例如,您不使用 apt-get installyum install 來安裝套件。For example, you don't use apt-get install or yum install to install a package. 您可以改為定義要安裝的套件清單。Instead you can define a list of packages to install. Cloud-init 會針對您選取的散發套件自動使用原生的套件管理工具。Cloud-init automatically uses the native package management tool for the distro you select.

我們正在與合作夥伴合作,以期在他們提供給 Azure 的映像中包含和使用 cloud-init。We are working with our partners to get cloud-init included and working in the images that they provide to Azure. 下表概述 cloud-init 目前在 Azure 平台映像上的可用性:The following table outlines the current cloud-init availability on Azure platform images:

AliasAlias 發行者Publisher 供應項目Offer SKUSKU 版本Version
UbuntuLTSUbuntuLTS CanonicalCanonical UbuntuServerUbuntuServer 16.04-LTS16.04-LTS 最新latest
UbuntuLTSUbuntuLTS CanonicalCanonical UbuntuServerUbuntuServer 14.04.5-LTS14.04.5-LTS 最新latest
CoreOSCoreOS CoreOSCoreOS CoreOSCoreOS StableStable 最新latest
OpenLogicOpenLogic CentOSCentOS 7-CI7-CI 最新latest
RedHatRedHat RHELRHEL 7-RAW-CI7-RAW-CI 最新latest

建立 Cloud-init 組態檔Create cloud-init config file

若要查看作用中的 cloud-init,請建立 VM 來安裝 NGINX 並執行簡單 'Hello World' Node.js 應用程式。To see cloud-init in action, create a VM that installs NGINX and runs a simple 'Hello World' Node.js app. 下列 cloud-init 組態會安裝必要的封裝、建立 Node.js 應用程式,然後初始化並啟動應用程式。The following cloud-init configuration installs the required packages, creates a Node.js app, then initialize and starts the app.

您目前的殼層中,建立名為 cloud-init.txt 的檔案,並貼上下列組態。In your current shell, create a file named cloud-init.txt and paste the following configuration. 例如,在 Cloud Shell 中建立不在本機電腦上的檔案。For example, create the file in the Cloud Shell not on your local machine. 您可以使用任何您想要的編輯器。You can use any editor you wish. 輸入 sensible-editor cloud-init.txt 可建立檔案,並查看可用的編輯器清單。Enter sensible-editor cloud-init.txt to create the file and see a list of available editors. 請確定已正確複製整個 cloud-init 檔案,特別是第一行:Make sure that the whole cloud-init file is copied correctly, especially the first line:

#cloud-config
package_upgrade: true
packages:
  - nginx
  - nodejs
  - npm
write_files:
  - owner: www-data:www-data
    path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 80;
        location / {
          proxy_pass http://localhost:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection keep-alive;
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
        }
      }
  - owner: azureuser:azureuser
    path: /home/azureuser/myapp/index.js
    content: |
      var express = require('express')
      var app = express()
      var os = require('os');
      app.get('/', function (req, res) {
        res.send('Hello World from host ' + os.hostname() + '!')
      })
      app.listen(3000, function () {
        console.log('Hello world app listening on port 3000!')
      })
runcmd:
  - service nginx restart
  - cd "/home/azureuser/myapp"
  - npm init
  - npm install express -y
  - nodejs index.js

如需 Cloud-init 組態選項的詳細資訊,請參閱 Cloud-init 組態範例 (英文)。For more information about cloud-init configuration options, see cloud-init config examples.

建立虛擬機器Create virtual machine

建立 VM 之前,請先使用 az group create 來建立資源群組。Before you can create a VM, create a resource group with az group create. 下列範例會在 eastus 位置建立名為 myResourceGroupAutomate 的資源群組:The following example creates a resource group named myResourceGroupAutomate in the eastus location:

az group create --name myResourceGroupAutomate --location eastus

現在,使用 az vm create 建立 VM。Now create a VM with az vm create. 使用 --custom-data 參數以傳入 cloud-init 組態檔。Use the --custom-data parameter to pass in your cloud-init config file. 如果您將檔案儲存於目前工作目錄之外的位置,請提供 cloud-init.txt 組態的完整路徑。Provide the full path to the cloud-init.txt config if you saved the file outside of your present working directory. 下列範例會建立名為 myVM 的 VM。The following example creates a VM named myVM:

az vm create \
    --resource-group myResourceGroupAutomate \
    --name myVM \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --custom-data cloud-init.txt

系統需要花幾分鐘的時間來建立 VM、安裝封裝和啟動應用程式。It takes a few minutes for the VM to be created, the packages to install, and the app to start. 在 Azure CLI 將您返回提示字元之後,背景工作會繼續執行。There are background tasks that continue to run after the Azure CLI returns you to the prompt. 可能需要再等候幾分鐘,才能存取應用程式。It may be another couple of minutes before you can access the app. 建立 VM 之後,請注意 Azure CLI 所顯示的 publicIpAddressWhen the VM has been created, take note of the publicIpAddress displayed by the Azure CLI. 此位址是用來透過 Web 瀏覽器存取 Node.js 應用程式。This address is used to access the Node.js app via a web browser.

若要讓 Web 流量到達您的 VM,請使用 az vm open-port 從網際網路開啟通訊埠 80:To allow web traffic to reach your VM, open port 80 from the Internet with az vm open-port:

az vm open-port --port 80 --resource-group myResourceGroupAutomate --name myVM

測試 Web 應用程式Test web app

現在,您可以開啟 Web 瀏覽器,並在網址列輸入 http://<publicIpAddress>Now you can open a web browser and enter http://<publicIpAddress> in the address bar. 提供您自己從 VM 建立程序中取得的公用 IP 位址。Provide your own public IP address from the VM create process. 您的 Node.js 應用程式即會顯示,如下列範例所示:Your Node.js app is displayed as shown in the following example:

檢視執行中的 NGINX 網站

從 Key Vault 插入憑證Inject certificates from Key Vault

您可以選擇性閱讀這一節,其中示範如何安全地將憑證儲存在 Azure Key Vault 中,並在 VM 部署期間插入它們。This optional section shows how you can securely store certificates in Azure Key Vault and inject them during the VM deployment. 不需使用包含憑證的自訂映像內建中,此程序可確保會在初次開機時將最新憑證插入至 VM。Rather than using a custom image that includes the certificates baked-in, this process ensures that the most up-to-date certificates are injected to a VM on first boot. 過程中,憑證絕對不會離開 Azure 平台,或在指令碼、命令列記錄或範本中公開。During the process, the certificate never leaves the Azure platform or is exposed in a script, command-line history, or template.

Azure Key Vault 會保護密碼編譯金鑰和祕密,像是憑證或密碼。Azure Key Vault safeguards cryptographic keys and secrets, such as certificates or passwords. Key Vault 有助於簡化金鑰管理程序,並可讓您控管存取和加密資料的金鑰。Key Vault helps streamline the key management process and enables you to maintain control of keys that access and encrypt your data. 此案例會引進一些 Key Vault 概念來建立和使用憑證,但並不是如何使用 Key Vault 的詳盡概觀。This scenario introduces some Key Vault concepts to create and use a certificate, though is not an exhaustive overview on how to use Key Vault.

下列步驟將示範如何:The following steps show how you can:

  • 建立 Azure Key VaultCreate an Azure Key Vault
  • 產生或上傳憑證至 Key VaultGenerate or upload a certificate to the Key Vault
  • 從憑證建立祕密以插入至 VMCreate a secret from the certificate to inject in to a VM
  • 建立 VM 並插入憑證Create a VM and inject the certificate

建立 Azure Key VaultCreate an Azure Key Vault

首先,使用 az keyvault create 建立 Key Vault,並加以啟用以供您在部署 VM 時使用。First, create a Key Vault with az keyvault create and enable it for use when you deploy a VM. 每個 Key Vault 需要唯一的名稱,而且應該全部小寫。Each Key Vault requires a unique name, and should be all lower case. 使用您自己唯一的 Key Vault 名稱來取代下列範例中的 mykeyvault :Replace mykeyvault in the following example with your own unique Key Vault name:

keyvault_name=mykeyvault
az keyvault create \
    --resource-group myResourceGroupAutomate \
    --name $keyvault_name \
    --enabled-for-deployment

產生憑證並儲存於 Key VaultGenerate certificate and store in Key Vault

若要在生產環境中使用,您應該使用 az keyvault certificate import 來匯入由受信任的提供者所簽署的有效憑證。For production use, you should import a valid certificate signed by trusted provider with az keyvault certificate import. 在本教學課程中,下列範例示範如何透過使用預設憑證原則的 az keyvault certificate create 來產生自我簽署憑證:For this tutorial, the following example shows how you can generate a self-signed certificate with az keyvault certificate create that uses the default certificate policy:

az keyvault certificate create \
    --vault-name $keyvault_name \
    --name mycert \
    --policy "$(az keyvault certificate get-default-policy)"

準備要與 VM 搭配使用的憑證Prepare certificate for use with VM

若要在 VM 建立程序期間使用憑證,使用 az keyvault secret list-versions 來取得憑證的識別碼。To use the certificate during the VM create process, obtain the ID of your certificate with az keyvault secret list-versions. VM 需要特定格式的憑證,才能在開機時將其插入,因此請將憑證轉換為 az vm secret formatThe VM needs the certificate in a certain format to inject it on boot, so convert the certificate with az vm secret format. 下列範例會將這些命令的輸出指派給變數,以方便在後續步驟中使用:The following example assigns the output of these commands to variables for ease of use in the next steps:

secret=$(az keyvault secret list-versions \
          --vault-name $keyvault_name \
          --name mycert \
          --query "[?attributes.enabled].id" --output tsv)
vm_secret=$(az vm secret format --secret "$secret")

建立 Cloud-init 組態來保護 NGINXCreate cloud-init config to secure NGINX

當您建立 VM 時,憑證和金鑰會儲存在受保護的 /var/lib/waagent/ 目錄中。When you create a VM, certificates and keys are stored in the protected /var/lib/waagent/ directory. 若要將憑證自動新增至 VM 並設定 NGINX,您可以從上一個範例中使用更新的 cloud-init 組態。To automate adding the certificate to the VM and configuring NGINX, you can use an updated cloud-init config from the previous example.

建立名為 cloud-init-secured.txt 的檔案,並貼上下列組態。Create a file named cloud-init-secured.txt and paste the following configuration. 同樣地,如果您使用 Cloud Shell,請在該處而非在本機電腦上建立 cloud-init 組態檔。Again, if you use the Cloud Shell, create the cloud-init config file there and not on your local machine. 使用 sensible-editor cloud-init-secured.txt 可建立檔案,並查看可用的編輯器清單。Use sensible-editor cloud-init-secured.txt to create the file and see a list of available editors. 請確定已正確複製整個 cloud-init 檔案,特別是第一行:Make sure that the whole cloud-init file is copied correctly, especially the first line:

#cloud-config
package_upgrade: true
packages:
  - nginx
  - nodejs
  - npm
write_files:
  - owner: www-data:www-data
    path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 80;
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/mycert.cert;
        ssl_certificate_key /etc/nginx/ssl/mycert.prv;
        location / {
          proxy_pass http://localhost:3000;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection keep-alive;
          proxy_set_header Host $host;
          proxy_cache_bypass $http_upgrade;
        }
      }
  - owner: azureuser:azureuser
    path: /home/azureuser/myapp/index.js
    content: |
      var express = require('express')
      var app = express()
      var os = require('os');
      app.get('/', function (req, res) {
        res.send('Hello World from host ' + os.hostname() + '!')
      })
      app.listen(3000, function () {
        console.log('Hello world app listening on port 3000!')
      })
runcmd:
  - secretsname=$(find /var/lib/waagent/ -name "*.prv" | cut -c -57)
  - mkdir /etc/nginx/ssl
  - cp $secretsname.crt /etc/nginx/ssl/mycert.cert
  - cp $secretsname.prv /etc/nginx/ssl/mycert.prv
  - service nginx restart
  - cd "/home/azureuser/myapp"
  - npm init
  - npm install express -y
  - nodejs index.js

建立安全的 VMCreate secure VM

現在,使用 az vm create 建立 VM。Now create a VM with az vm create. 使用 --secrets 參數,從 Key Vault 插入憑證資料。The certificate data is injected from Key Vault with the --secrets parameter. 如同先前範例,您也要使用 --custom-data 參數來傳入 cloud-init 組態:As in the previous example, you also pass in the cloud-init config with the --custom-data parameter:

az vm create \
    --resource-group myResourceGroupAutomate \
    --name myVMSecured \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --custom-data cloud-init-secured.txt \
    --secrets "$vm_secret"

系統需要花幾分鐘的時間來建立 VM、安裝封裝和啟動應用程式。It takes a few minutes for the VM to be created, the packages to install, and the app to start. 在 Azure CLI 將您返回提示字元之後,背景工作會繼續執行。There are background tasks that continue to run after the Azure CLI returns you to the prompt. 可能需要再等候幾分鐘,才能存取應用程式。It may be another couple of minutes before you can access the app. 建立 VM 之後,請注意 Azure CLI 所顯示的 publicIpAddressWhen the VM has been created, take note of the publicIpAddress displayed by the Azure CLI. 此位址是用來透過 Web 瀏覽器存取 Node.js 應用程式。This address is used to access the Node.js app via a web browser.

若要讓 Web 流量安全到達您的 VM,請使用 az vm open-port 從網際網路開啟通訊埠 443:To allow secure web traffic to reach your VM, open port 443 from the Internet with az vm open-port:

az vm open-port \
    --resource-group myResourceGroupAutomate \
    --name myVMSecured \
    --port 443

測試安全的 Web 應用程式Test secure web app

現在,您可以開啟 Web 瀏覽器,並在網址列輸入 https://<publicIpAddress>Now you can open a web browser and enter https://<publicIpAddress> in the address bar. 提供您自己的公用 IP 位址,其已顯示在先前 VM 建立程序中的輸出中。Provide your own public IP address as shown in the output of the previous VM create process. 如果您使用自我簽署憑證,請接受安全性警告:Accept the security warning if you used a self-signed certificate:

接受 Web 瀏覽器安全性警告

接著會顯示受保護的 NGINX 網站和 Node.js 應用程式,如下列範例所示:Your secured NGINX site and Node.js app is then displayed as in the following example:

檢視執行中安全的 NGINX 網站

後續步驟Next steps

在本教學課程中,您已在初次開機時使用 Cloud-init 來設定 VM。In this tutorial, you configured VMs on first boot with cloud-init. 您已了解如何︰You learned how to:

  • 建立 Cloud-init 組態檔Create a cloud-init config file
  • 建立 VM 來使用 Cloud-init 檔案Create a VM that uses a cloud-init file
  • 在建立 VM 之後,檢視執行中的 Node.js 應用程式View a running Node.js app after the VM is created
  • 使用 Key Vault 安全地儲存憑證Use Key Vault to securely store certificates
  • 使用 Cloud-init 來安全地自動部署 NGINXAutomate secure deployments of NGINX with cloud-init

前進至下一個教學課程,以了解如何建立自訂的 VM 映像。Advance to the next tutorial to learn how to create custom VM images.