Continuous Delivery with TFS / VSTS – Join a VM to a Domain with Azure Resource Manager Templates

In the previous post in my blog post series on Continuous Delivery with TFS / VSTS we learned how to provision a Windows Server virtual machine using Azure Resource Manager templates. The next major step in this quest to automate the creation and configuration of the infrastructure to which we’ll deploy our application is to configure server internals, starting with joining a VM to the domain. My initial thinking was that this would need to be some kind of PowerShell command, and whilst this is an option I was very pleased to find that there is an ARM template resource to do this. The resource in question goes by the name of JsonADDomainExtension; it’s a VM extension and you can read about it (and the PowerShell commands to do the same thing) in this blog post.

I have to confess that I struggled to get the extension to work at first. I spent a whole afternoon fiddling with the settings and getting nowhere, and spent quite a bit of time reading forum posts from others who were having similar difficulties (mostly with the PowerShell commands though). I gave up in frustration, only to come back to it a few days later to try again to find it was all working! I describe the steps I took below – please be aware that it’s very much a direct continuation of this post so please do check that out first if you haven’t done so already.

Adding the JsonADDomainExtension to the JSON Template

Getting starting with the extension is very easy, as it’s just a case of dropping the JSON in to the resources part of the template. The code I initially used to make the extension work was as follows:

{
  "apiVersion": "2015-06-15",
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "name": "[concat(variables('nodeNameToLower'),'/joindomain')]",
  "location": "[resourceGroup().location]",
  "dependsOn": [
    "[concat('Microsoft.Compute/virtualMachines/', variables('nodeNameToUpper'))]"
  ],
  "tags": {
    "displayName": "JoinDomain"
  },
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "JsonADDomainExtension",
    "typeHandlerVersion": "1.0",
    "settings": {
      "Name": "prm.local",
      "OUPath": "",
      "User": "prm\\graham",
      "Restart": "true",
      "Options": "3"
    },
    "protectedsettings": {
      "Password": "MySuperSecureDomainAdminPassword"
    }
  }
}

I added this code to the WindowsServer2012R2Datacenter.json file which has variables defined for use where the VM name is required. Note that OUPath can be an empty string, the requirement for the escaped backslash for the (domain) User and the use of the magic number 3 in Options (just go with it or see here for the details).

Whilst this (eventually) worked fine for me the big issue was how to hide the password for the account that will join the VM to the domain. I hard coded it in to the template to get the extension working but even when refactored as a parameter the password is still in plain view – now just in the PowerShell calling script.

Say Hello to Azure Key Vault

As luck would have it around the time I was initially getting JsonADDomainExtension to work I watched Cloud Cover Episode 200: Azure Resource Manager Tooling with Brian Moore where Brian mentioned the forthcoming ability to use Azure Key Vault to supply secret values such as passwords to ARM templates. Following a very helpful email exchange Brian pointed me towards this page which is a partial answer to the solution I wanted to get working.

At the time of writing there was no portal interface for configuring Azure Key Vault so it’s over to PowerShell (no bad thing) to create a new vault:

# Authentication details are abstracted away in a PS module
Set-AzureRmAuthenticationForMsdnEnterprise

New-AzureRmKeyVault -VaultName 'prmkeyvault' -ResourceGroupName PRM-COMMON -Location 'West Europe'

In the code above this creates a vault named prmkeyvault. Next we need to add our password as a secret:

$secretValue = ConvertTo-SecureString 'MySuperSecureDomainAdminPassword' -AsPlainText -Force
Set-AzureKeyVaultSecret -VaultName 'prmkeyvault' -Name 'DomainAdminPassword' -SecretValue $secretValue

This creates a new secret called DomainAdminPassword. Of course, the objects that have just been created can be examined with Azure Resource Explorer:

Use the Secret in the JSON Template

The Microsoft guidance for passing secrets to templates is based on the use of an ARM parameters file. This wasn’t quite what I wanted as I’m using a PowerShell script to supply my parameters. The way to access secrets using PowerShell is along the following lines:

# Assumes authentication has already been made
$domainAdminPassword = Get-AzureKeyVaultSecret –VaultName prmkeyvaulttest –Name DomainAdminAdminPassword

# Use this syntax to return the secret
$domainAdminPassword.SecretValueText

You can see how I integrated the code above in to my PowerShell script by examining Create PRM-DAT.ps1 in the code release that accompanies this post on my Infrastructure repository on GitHub. It’s not quite the full solution at the moment though because despite having a mechanism in place for automatically authenticating to Azure PowerShell the use of Azure Key Vault cmdlets in the script causes the authentication dialog to pop-up. I’m still working on how to stop that – if you know please leave a message in the comments!

Cheers – Graham

The post Continuous Delivery with TFS / VSTS – Join a VM to a Domain with Azure Resource Manager Templates appeared first on Please Release Me.