Terraform文件提供程序

Question

我正在使用地形提供程序文件&虚拟机创建完成后，使用remote-exec安装chrome浏览器。但它在运行地形应用时给出了错误。我还启用了nsg规则，允许所有端口。我不确定这个错误是否与nsg规则有关。

Error: timeout - last error: unknown error Post "https://10.0.2.4:5986/wsman": dial tcp 10.0.2.4:5986: connectex: A connection attempt failed because the connected party did not properly respond after a 
period of time, or established connection failed because connected host has failed to respond.

resource "azurerm_virtual_machine" "myterraformvm" {
name                  = "Test-01"
location              = "East Us"
resource_group_name = data.azurerm_resource_group.test.name
network_interface_ids = ["${azurerm_network_interface.main.id}"]
vm_size               = "Standard_DS1_v2"

storage_os_disk {
name              = "${azurerm_managed_disk.copy.name}"
os_type           = "Windows"
managed_disk_id   = "${azurerm_managed_disk.copy.id}"
create_option     = "Attach"
}
provisioner "file" {
source      = "./google_chrome_install.ps1"
destination = "C:/"

connection {
host = "${azurerm_network_interface.main.private_ip_address}"
type     = "winrm"
https    = true
port     = 5986
use_ntlm = true
insecure = true
user     = "testadmin"
password = "*******"
}
}

provisioner "remote-exec" {
connection {
host = "${azurerm_network_interface.main.private_ip_address}"
type     = "winrm"
https    = true
port     = 5986
use_ntlm = true
insecure = true
user     = "testadmin"
password = "***"
}

inline = [
"powershell -ExecutionPolicy Unrestricted -File C:/google_chrome_install.ps1 -Schedule"
]
}
}

Answer 1

我在从Terraform到aws ec2实例的ssh连接中遇到了类似的问题。有几件事我想提一下。如果他们不工作请告诉我。

1. 这个问题可能是由于防火墙规则。我的问题是安全组(相当于法律中的防火墙规则)，请看看这篇文章是否有帮助:https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal

2. 你不应该把凭证放在开放文本中。您应该始终创建私钥(我创建了一个pem密钥，并使用本文中提到的private_key参数):https://github.com/DeekshithSN/Terraform/blob/master/Provisioner/file-Provisioner/main.tf

3. 如果您从中创建一个模块，您可能会使用相同的连接块。看看这个参考https://learn.hashicorp.com/tutorials/terraform/module-use

Answer 2

创建windows实例时，"WinRM"将处于运行状态，但未配置为接受连接。所以，你必须打开5985;和"5986";.

你可以在用户数据

中添加这个脚本

<powershell>
winrm quickconfig -q
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
winrm set winrm/config/service/auth '@{Basic="true"}'
Start-Service WinRM
set-service WinRM -StartupType Automatic
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled false"
</powershell>