Question

λ封隔器版本 Packer v1.3.2

Packer文件：

{
  "builders"                           : [{
    "type"                             : "azure-arm",

    "client_id"                        : "asdf",
    "client_secret"                    : "asdf",
    "tenant_id"                        : "asdf",
    "subscription_id"                  : "asdf",

    "managed_image_resource_group_name": "asdf",
    "managed_image_name"               : "cis-rhel7-l1",

    "os_type"                          : "Linux",
    "image_publisher"                  : "center-for-internet-security-inc",
    "image_offer"                      : "cis-rhel-7-v2-2-0-l1",
    "image_sku"                        : "cis-rhel7-l1",

    "plan_info"                        : {
        "plan_name"                    : "cis-rhel7-l1",
        "plan_product"                 : "cis-rhel-7-v2-2-0-l1",
        "plan_publisher"               : "center-for-internet-security-inc"
    },

    "communicator"                     : "ssh",

    "azure_tags"                       : {
        "docker"                       : "18.09.0"
    },

    "location"                         : "West Europe",
    "vm_size"                          : "Standard_D2_v3"
  }],
  "provisioners"                       : [
        {
            "type"                     : "shell",
            "script"                   : "./cisrhel7-script.sh"
        }
    ]
}

它正在调用的脚本：

DOCKERURL="asdf"

sudo -E sh -c 'echo "asdf/rhel" > /etc/yum/vars/dockerurl'

sudo sh -c 'echo "7" > /etc/yum/vars/dockerosversion'

sudo yum install -y yum-utils device-mapper-persistent-data lvm2

sudo yum-config-manager --enable rhel-7-server-extras-rpm

sudo yum-config-manager --enable rhui-rhel-7-server-rhui-extras-rpms

curl -sSL "asdf/rhel/gpg" -o /tmp/storebits.gpg

sudo rpm --import /tmp/storebits.gpg

sudo -E yum-config-manager --add-repo "asdf/rhel/docker-ee.repo"

sudo yum -y install docker-ee-18.09.0

sudo yum-config-manager --enable docker-ee-stable-18.09

sudo systemctl unmask --now firewalld.service

sudo systemctl enable --now firewalld.service

systemctl status firewalld

list=(
    "22/tcp"
    "80/tcp"
    "179/tcp"
    "443/tcp"
    "2376/tcp"
    "2377/tcp"
    "4789/udp"
    "6443/tcp"
    "6444/tcp"
    "7946/tcp"
    "7946/udp"
    "10250/tcp"
    "12376/tcp"
    "12378/tcp"
    "12379/tcp"
    "12380/tcp"
    "12381/tcp"
    "12382/tcp"
    "12383/tcp"
    "12384/tcp"
    "12385/tcp"
    "12386/tcp"
    "12387/tcp"
    "12388/tcp"
)
for i in "${list[@]}"; do
    sudo firewall-cmd --zone=public --add-port=$i --permanent
done

sudo firewall-cmd --reload

sudo firewall-cmd --list-all

sudo systemctl stop docker

sudo sh -c 'echo "{\"storage-driver\": \"overlay2\"}" > /etc/docker/daemon.json'

CURRENT_USER=$(whoami)

if [ "$CURRENT_USER" != "root" ]
then
        sudo usermod -g docker "$CURRENT_USER"
fi

sudo systemctl start docker

sudo docker info

然后我使用Terraform进行部署：

# skipping pre-TF resources...
resource "azurerm_virtual_machine" "main" {
  name                              = "${var.prefix}-vm"
  location                          = "${azurerm_resource_group.main.location}"
  resource_group_name               = "${azurerm_resource_group.main.name}"
  network_interface_ids             = ["${azurerm_network_interface.main.id}"]
  vm_size                           = "Standard_D2_v3"

  delete_os_disk_on_termination     = true

  storage_image_reference {
    id                            = "${data.azurerm_image.custom.id}"
  }

  storage_os_disk {
    name                            = "${var.prefix}-osdisk"
    caching                         = "ReadWrite"
    create_option                   = "FromImage"
    managed_disk_type               = "Standard_LRS"
  }

  os_profile {
    computer_name                   = "${var.prefix}"
    admin_username                  = "rhel76"
  }

  os_profile_linux_config {
    disable_password_authentication = true

    ssh_keys {
      path                          = "/home/rhel76/.ssh/authorized_keys"
      key_data                      = "${file("rhel76.pub")}"
    }
  }

  plan {
      name                          = "cis-rhel7-l1"
      publisher                     = "center-for-internet-security-inc"
      product                       = "cis-rhel-7-v2-2-0-l1"
  }
}

构建正常，部署正常，但是当我连接时：

λ ssh -i rhel76 rhel76@some-ip
The authenticity of host 'some-ip (some-ip)' can't be established.
ECDSA key fingerprint is SHA256:some-fingerprint.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'some-ip' (ECDSA) to the list of known hosts.
Authorized uses only. All activity may be monitored and reported.
rhel76@some-ip: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

我不确定这是Packer还是Terraform问题。我已经通过Terrraform部署了基础映像“ cis-rhel7-l1”，将仅映像从我的映像更改为基础映像，将ssh关键部分保留了下来，并且工作正常（我能够SSH OK）。

连接到VM的唯一方法是在Azure中重置SSH密钥。我使用admin_username作为rhel76（从模板）将其重置，并且工作正常，检查了/home/rhel76/.ssh/*并有东西在里面。显然，因为我刚刚进行了一次重置。因此，重新构建了整个内容，没有进行任何更改，但是当我下次无法登录时，我对随机用户名asdf进行了SSH密钥重置，然后查看了{{1} }目录，找不到/home/rhel76或.ssh/文件夹/文件，就好像它无权创建它们。

此后，我一直在尝试使用脚本，试图创建这些文件夹并对其进行CHMOD处理，以防万一，但是由于在Packer构建过程中出现错误，所以这永远行不通：

./ssh/authorized_keys

有人有什么想法吗？

Answer 1

因此，事实证明您需要运行Azure Linux代理的“取消配置”，而我已经通过在预配器部分中加入推荐来完成了操作：

  "provisioners"                       : [
        {
            "type"                     : "shell",
            "script"                   : "./cisrhel7-script.sh"
        },
        {
            "type"                     : "shell",
            "inline"                   : [
                "echo '************ DEPROVISION'",
                "sudo /usr/sbin/waagent -force -deprovision+user && export HISTSIZE=0 && sync"
            ]
        }
    ]
}

来自：https://docs.microsoft.com/en-us/azure/virtual-machines/linux/build-image-with-packer

无法SSH到Terraform部署的Packer映像创建的VM上

1 个答案: