问题
我在创建新的 VMSS 时尝试将多个证书添加到该 VMSS,但收到错误列表 secret 包含重复的实例
/subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.KeyVault/vaults/xxxxx, which is disallowed.
我用于创建 VMSS 的 powershell 是:
$vmssConfig = New-AzureRmVmssConfig -Location $location -SkuCapacity $trgVMSSCapacity -SkuName $trgVMSSSize -UpgradePolicyMode 'Manual'
$vmssConfig = Set-AzureRmVmssStorageProfile -VirtualMachineScaleSet $vmssConfig -OsDiskCaching ReadWrite -OsDiskCreateOption FromImage -OsDiskOsType Windows -ImageReferenceId $Image.Id -ManagedDisk $trgVMSSDisk
$vmssConfig = Set-AzureRmVmssOsProfile -VirtualMachineScaleSet $vmssConfig -AdminUsername $trgOSAdminUser -AdminPassword $trgOSAdminPass -ComputerNamePrefix $trgComputerName -WindowsConfigurationEnableAutomaticUpdate $false -WindowsConfigurationProvisionVMAgent $true
$vmssConfig = Add-AzureRmVmssNetworkInterfaceConfiguration -VirtualMachineScaleSet $vmssConfig -Name 'network-config' -Primary $true -IPConfiguration $ipConfig
$cgCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $cgCertURL -CertificateStore 'My'
$ktuCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $ktuCertURL -CertificateStore 'My'
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $cgCertConfig
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $ktuCertConfig
$vmssConfig = Set-AzureRmVmssBootDiagnostic -VirtualMachineScaleSet $vmssConfig -Enabled $true -StorageUri $trgStorage.Context.BlobEndPoint
预期
常见问题解答:https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-faq 它有一节“当我从同一 key 保管库添加多个证书后运行 Update-AzureRmVmss 时,我看到以下消息:”,但我无法弄清楚如何修复我的脚本以使其正常工作,任何人都可以提供帮助吗?
最佳答案
我无法测试,但根据我对文档的阅读,您不能多次使用Add-AzureRmVmssSecret
。您必须在初始命令中添加同一存储中的所有证书,或者在此处编辑列表:$vmss.properties.osProfile.secrets[0].vaultCertificates
对于你的代码,我会尝试:
$cgCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $cgCertURL -CertificateStore 'My'
$ktuCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $ktuCertURL -CertificateStore 'My'
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $cgCertConfig,$ktuCertConfig
VaultCertificate
属性接受一个数组,因此请尝试一次传递所有证书。
关于powershell - 将多个证书从同一 KeyVault 添加到新的 VMSS,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/48117164/