Save 37% off PRO during our Black Friday Sale! »

Windows Deployment with PowerShell

Windows Deployment with PowerShell

C61c4df7cb3f2da2b4a7e7fe08bca7e1?s=128

guitarrapc

April 12, 2014
Tweet

Transcript

  1. None
  2. @Job PowerShell @Private http://tech.guitarrapc.com @guitarrapc_tech https://github.com/guitarrapc/valentia

  3. 2012/09/16 株式会社グラニ設立 2013/01/25 「神獄のヴァルハラゲート」リリース(PHP) 2013/07/15 PHPからC#にリニューアル(見た目一緒だけど中身完全別物) 2014/02/19 「モンスタハンターロアオブカード」リリース

  4. AWS で動いています

  5. None
  6. None
  7. 突然ですが、

  8. Deployment

  9. って何ですか?

  10. Configuration Orchestration Cluster Management 今回は Bootstrap (OS自動展開など) にはほぼ触れない (なんだと)

  11. Configuration インフラの 静的な部分の自動化 プログラマブルなインフラが可能になり、自動化も可能に OS ~ ミドルウェアレベルでのプロビジョニング

  12. Orchestration インフラの 動的な部分の自動化 画一的な設定適用ではなく、サーバーの機能に合わせた設定適用とか アプリケーションデプロイ アプリケーションデプロイされた全ノードで1つのサービスを提供する

  13. Cluster Management 同じ役割の各ノードが他ノードと連携して動作 Orchestration 的だが、協調/自律的に動作するので重複しつつ分離しておく ノードと他サービスが協調的に動作 インスタンスの停止状態になるときに、ロードバランサに通知して ロー ドバランサから自動的にはずれるなど。

  14. Deploy って細かい

  15. Linux :)

  16. None
  17. Windows :(

  18. None
  19. AWS 上の Windowsでどうやるのか

  20. None
  21. None
  22. None
  23. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  24. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  25. None
  26. None
  27. None
  28. None
  29. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  30. None
  31. None
  32. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  33. None
  34. None
  35. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  36. None
  37. Deployment x Automation

  38. @

  39. None
  40. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  41. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  42. EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances

    EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances EC2 Instances
  43. 目的 自動化と任意トリガー 非同期実行

  44. ようは 面倒だから()

  45. None
  46. Orchestration

  47. None
  48. None
  49. Orchestration Tool by PowerShell PowerShell Remoting のラッパー 認証や初期設定を簡略化

  50. Orchestration, Orchestration, Orchestration!! MSDeploy との連携 サーバーの状態を変更、展開

  51. Cmdlet/Function/Snap-in Remoting/Module/Job/ISE Intellisense/Workflow DSC/MethodSyntax 2006 PS 1.0 2008 PS 2.0

    2012 PS 3.0 2013 PS 4.0 Monad Automation Model Monad Shell Monad Remote Scripting Monad Management Console Monad Management Model OneGet/Network 2014 PS 5.0 Preview
  52. None
  53. Demo

  54. valentia は Orchestration (Deploy) ツール Infrastructure As Code とはいかない 直観的じゃない

    (Configurationにはこれじゃダメ) Configuration はしたくない
  55. Configurationまだですか

  56. で、

  57. None
  58. Configuration

  59. None
  60. None
  61. DSC = Chef ライクな環境 をWindowsで!

  62. Configuration Management by CIM 宣言型(Declare)の記述 目的

  63. Cmdlet/Function/Snap-in Remoting/Module/Job/ISE Intellisense/Workflow DSC/MethodSyntax 2006 PS 1.0 2008 PS 2.0

    2012 PS 3.0 2013 PS 4.0 Monad Automation Model Monad Shell Monad Remote Scripting Monad Management Console Monad Management Model OneGet/Network 2014 PS 5.0 Preview
  64. None
  65. PUSH PULL

  66. 今日はPUSH

  67. リソース リソースの確認Cmdlet Get-DscResource

  68. None
  69. Windows Feature File

  70. Demo : PUSH

  71. $status = Get-WindowsFeature -Name DSC-Service if ($status.InstallStatus -ne "Installed") {

    Install-WindowsFeature -Name DSC-Service }
  72. configuration InstallDSCService { node localhost { WindowsFeature DSCService { Name

    = "DSC-Service" Ensure = "Present" } } }
  73. $dsc = InstallDSCService -output "." $path = ($dsc.Directory.FullName | select

    -First 1)
  74. instance of MSFT_RoleResource as $MSFT_RoleResource1ref { ResourceID = "[WindowsFeature]DSCService"; Ensure

    = "Present"; SourceInfo = "C:¥¥DSC¥¥Push¥¥WindowsFeature- DSCService¥¥InstallDSCService.ps1::5::9::WindowsFeature"; Name = "DSC-Service"; ModuleName = "PSDesiredStateConfiguration"; ModuleVersion = "1.0"; }; instance of OMI_ConfigurationDocument { Version="1.0.0"; Author="Administrator"; GenerationDate="04/12/2014 18:47:15"; GenerationHost="WIN-P45DJOFHDO4"; };
  75. Start-DscConfiguration -Wait -Force -Verbose -Path $path

  76. PowerShell DSC は CIM 実行 Domain 参加サーバー同士の認証では容易 WorkGroupのみ / Domain参加の併用

    は CIMを使う
  77. $cimSession = New-CimSession -Authentication CredSSP -Credential $credential ` -ComputerName $ComputerName

    $dsc = CopyFileCred –SourcePath $sourcePath –Credential (Get-ValentiaCredential) ` -ConfigurationData $ConfigurationData $path = $dsc.Directory.FullName | select –First 1 Set-DscLocalConfigurationManager –Path $path –Verbose –CimSession $cimsession Start-DscConfiguration –Wait –Force –Verbose –Path $path -CimSession $cimSession Remove-CimSession -CimSession $cimSession
  78. Start-DSCConfiguration に渡して便利に利用

  79. $nodeName = $ComputerName | %{@{NodeName = $_}} $ConfigurationData = @{

    AllNodes = @( @{ NodeName = "*" PSDscAllowPlainTextPassword = $true } $nodeName ) }
  80. 同一ホスト内での処理はSystemアカウントを利用 別ホストの参照はコンピュータ認証を利用

  81. 認証生パスワードが.mofに記述されている PSDscAllowPlainTextPassword = $true #明示しないとパスワード使えない 証明書を使うことで、パスワードが暗号化される (解読用) (暗号用) (解読参照用)

  82. configuration InstallDSCServiceCredential { param ( [PSCredential] $credential ) node $AllNodes.NodeName

    { WindowsFeature DSCService { Name = "DSC-Service" Ensure = "Present" Credential = $credential } } }
  83. function Start-DSCPushSample { [CmdletBinding()] param ( [string[]] $computerName, [pscredential] $Credential

    ) $nodeName = $ComputerName | %{@{NodeName = $_}} $ConfigurationData = @{ AllNodes = @( @{ NodeName = "*" PSDscAllowPlainTextPassword = $true #明示が必須 } $nodeName ) } #Domain参加ノード->WorkGroupノードでもCimセッションで認証可能 $cimSession = New-CimSession -Authentication Negotiate -Credential $credential -ComputerName $ComputerName # ConfigurationDataを渡してAPSDscAllowPlainTextPassword で認証パスワードを生テキストに! $dsc = InstallDSCServiceCredential -output "." -ConfigurationData $ConfigurationData -credential $credential Start-DscConfiguration -Wait -Force -Verbose -Path ($dsc.Directory.FullName | select -First 1) -CimSession $cimSession }
  84. 生パスワードがかかれてる! KUSOすぎる

  85. 各ノード Local Machine¥My に配置する サーバー Local Machine¥My に配置しておくと、ThumPrintを動的に読めるので便利

  86. 対象ノードで使用する証明書ThumbPrintを指定 対象ノードのパスワード暗号化に使用する公開鍵ファイルパス を指定

  87. ThumPrint が一致する証明書を証明書ストアから探す 見つけた秘密鍵で公開鍵暗号がかけられたパスワードを解除

  88. configuration InstallDSCServiceCredentialCert { param ( [PSCredential] $credential ) node $AllNodes.NodeName

    { WindowsFeature DSCService { Name = "DSC-Service" Ensure = "Present" } LocalConfigurationManager { CertificateId = $node.Thumbprint } } }
  89. function Start-CredentialEncryptionExample { [CmdletBinding()] param ($computerName, $credential) $thumbprint = "6CBD916822BBDA1BEBEDBF4819071C86C461C082"

    Write-Verbose "using cert: $thumbprint" $certificatePath = "c:¥dsc¥dsc.cer" $nodeName = $computerName | %{@{NodeName = $_}} $ConfigurationData = @{ AllNodes = @( @{ # The name of the node we are describing NodeName = "*" # The path to the .cer file containing the public key of the Encryption Certificate CertificateFile = "$certificatePath" # The thumbprint of the Encryption Certificate used to decrypt the credentials Thumbprint = $thumbprint } $nodeName ) } $cimSession = New-CimSession -Authentication CredSsp -Credential $credential -ComputerName $computerName $dsc = InstallDSCServiceCredentialCert -output "." -ConfigurationData $ConfigurationData -credential $credential Set-DscLocalConfigurationManager -Path ($dsc.Directory.FullName | select -First 1) -Verbose Start-DscConfiguration -Wait -Verbose -Path ($dsc.Directory.FullName | select -First 1) }
  90. やっと安心して使えるけど、秘密鍵の配置がだるい

  91. 新たに生成された .meta.mof にクライアントに渡す thumbprint が

  92. PSRemoting との使い分け

  93. PSRemoting => Orchestration DSC PUSH => Configuration PSRemotingよりコードでインフラ状態を管理しやすい

  94. 処理速度 https://gist.github.com/guitarrapc/9748680 DSC PUSH は、並列度少な目/CIMオーバーヘッドにみえる? (PS 5.0のDSC Refreshに期待)

  95. None
  96. Cluster Management

  97. http://www.slideshare.net/sonots/serf-iiconf-20140325

  98. Windowsでやってる人知らないです (Serf は Windowsも対応してるらしい)

  99. Immutable Infrastructure

  100. https://speakerdeck.com/naoya/immutable-infrastructuregakai-fa-purosesuniyu-eruying-xiang-jia-number-immutableinfra

  101. Windowsでやってる人いませんかー (今更 CHEF/Puppet と同等の DSC って……)

  102. キーとなるのは : Docker

  103. 超軽量なVM(Box)の高速展開が可能に! (Microsoft はVagrant に Win2012 R2をpreview提供してて期待)

  104. Deployment は Linux が断然先行

  105. Windowsの圧倒的事例のなさ!!

  106. None
  107. Orchestration : valentia Cluster Management : valentia + AWSPowerShell +

    Serf? State-less なWebサーバーは他ノードと協調した復帰など Configuration : DSC
  108. なるべく Immutableにできるところはする

  109. 何から何までDSCでやるのはちがうしNAI

  110. シンプルな自動化を実例に

  111. None
  112. Orchestration は 各自が PSRemotingで実装 http://guitarrapc.github.io/valentia/ https://github.com/AppVeyor/AppRolla Configuration は DSC が提供

  113. Clustering Management は Serf が使えるか謎 apt-get なリポジトリ共通基盤として OneGet PowerShell は

    Azureを初めとして Cloud Automationに注力
  114. Windows Automation with PowerShell

  115. None
  116. 大規模なモジュール http://visualstudiogallery.msdn.microsoft.com/c9eb3ba8-0c59-4944-9a62-6eee37294597 単体ファイル http://www.powertheshell.com/isesteroids/

  117. await

  118. None