Create onboarding scripts
Create the Bash and PowerShell scripts for onboarding using the service principal.
The most basic way is to use the portal to generate scripts which can then be used on multiple servers.
This is a good fit with customers who prefer to retain their own admin access to the on prem servers and have their own preferred tooling for remote execution of scripts on multiple hosts. It could be simple scripted WinRM and ssh commands, or something more industrial such as System Center, Ansible, Chef, Puppet, Salt etc.
A good opportunity for someone different to take control.
The scripts may commonly be created by a consultant from the partner and then given to the on prem admin team to execute.
Providing the generated script and service principal credentials to others for execution is not considered a security issue. The very limited RBAC role given to the service principal is only capable of onboarding VMs and nothing more.
The end point of this lab will emulate that script handover as it is closer to the workflow you would see in a professional services engagement.
Grab the resource id for the arc_pilot resource group
rgId=$(az group show --name arc_pilot --query id --output tsv)
Create a service principal with the Azure Connected Machine Onboarding role
az ad sp create-for-rbac --name arc_pilot --role "Azure Connected Machine Onboarding" --scopes $rgId
⚠️ Make sure that you take a copy of the JSON output as it includes the clientId/appId and the clientSecret/password.
The portal will look for service principals with the Azure Connected Machine Onboarding role when generating scripts.
⚠️ Challenge: Create PowerShell and Bash onboarding scripts.
Provide a generated script that can be executed on multiple servers
Onboard into the arc_pilot resource group and the West Europe region
Include the following tags:
Tag Value platform VMware vSphere cluster POC
If you are using a non-Azure platform for your on prem VMs then feel free to change the tag values.
Ensure the script uses the service principal that you’ve just created
💡 Hint 1: Add a shebang as the first line in the generated Bash script, e.g.:
💡 Hint 2: Lost the service principal secret already? Rerun the
az ad sp create-for-rbaccommand.
Screen share with your proctor to show your
- PowerShell script
- Bash script
In the next lab you will onboard a few of the VMs.
Help us improve
Azure Citadel is a community site built on GitHub, please contribute and send a pull requestMake a change