Crying Cloud
,

MAAS Image Builder Exclude Update by KB#

,

This briefly shows how to alter the image builder scripts to exclude broken KBs for specific OS versions. This example shows excluding Cumulative Update for Windows 11 Insider Preview (KB5019765) on an HCI image.

Trying to build a newer HCI Maas image and receive an error trying to download an update via release channel. Specifically, Windows 11 insider preview KB5019765

If you edit the Logon.ps1 found in the UnattendedResource folder from cloudbase/windows-imaging-tools: Tools to automate the creation of a Windows image for OpenStack, supporting KVM, Hyper-V, ESXi and more. (github.com) you can see there is a section that allows you to create a blacklist of KBs for different OS version.

Using PowerShell [System.Environment]::OSVersion.Version you can find the OS version

Finally add a record for the OS version and KB you want to exclude

Which is displayed via verbose output during build

,

Ensure your AAD Users can't create AD Tenants!!

,

I do understand distributed management and delegation, but this seems like a step too far. There is a new setting that allows users to be able to create their own Azure AD tenants. While it is a great privilege and setting to have, why ‘Yes’ would be the default choice is an interesting default and I would like to understand the rationale behind that.

Save your future self from a number of headaches, just select no.

,

Using Developer Tools to get the Payload to Create Azure Budget Alerts for Action Groups (New-AzConsumptionBudget)

,

Are you trying to create a budget with PowerShell using New-AzConsumptionBudget on a resource group? You might have tried the code reference on this page New-AzConsumptionBudget (Az.Billing) | Microsoft Learn. 

# If you update the sample command and try to execute
New-AzConsumptionBudget -ResourceGroupName budgetThis -Amount 60 -Name PSBudgetRG -Category Cost -StartDate 2022-11-01 -EndDate 2024-11-01 -TimeGrain Monthly

If you’re not using a subscription in an EA, you’ll get this error New-AzConsumptionBudget: Operation returned an invalid status code 'BadRequest'

Running get-error doesn’t provide much in the way of help to resolve. After further digging you’ll find the PowerShell reference page, you’ll probably find that Microsoft docs states you have to be an “EA customer, you can create and edit budgets programmatically using the Azure PowerShell module. However, we recommend that you use REST APIs to create and edit budgets because CLI commands might not support the latest version of the APIs."

If you are using EA subscription it still doesn’t create the alerts and the PowerShell doco doesn’t seem easy to use to create these notifications either.

Hopefully, you found this script SetConsumptionBudget.ps1 Create a Consumption Budget for ResourceGroups in Azure (github.com). It is a complete script and is helpful. This is a good implementation of the content documented here. Budgets - Create Or Update - REST API (Azure Consumption) | Microsoft Learn.

What if you couldn’t find a pre-created script what would you do? Or if you wanted a simplified call rather than the long doc example, in this case, I wanted to leverage using an Action Group.

Let’s create a budget through the Azure portal called “CreatedWithUI” and use the browser developer tools (F12) to capture the traffic requests to the Azure API.

After you click “Create” you’ll see traffic and see the request payload

You can copy the properties section, you just need to add the properties name back in.

With some changes to the syntax object, we can create a script to create the budget alerting an Action Group.

# Converted Syntax for use in script
$bodyObject = @{
    "properties"= @{
        "timePeriod" = @{
            "startDate"= "2022-10-01T00:00:00Z"
            "endDate"= "2024-09-30T00:00:00Z"
        }
        "timeGrain" = "Monthly"
        "amount"= 62
        "category"= "Cost"
        "notifications" =@{
            "forecasted_GreaterThan_90_Percent"= @{
                "enabled" = $true
                "operator"= "GreaterThan"
                "threshold"= 90
                "contactGroups"= @("/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/cloudmodernization-rg/providers/microsoft.insights/actionGroups/BudgetAlerts")
                "thresholdType"= "Forecasted"
            }
        }
    }
}

The last piece of data we need is the Action Group, which still works in PowerShell

# Parameters
$ActionGroupRGName = "cloudmodernization-rg"
$ActionGroupEmails = @("admin@yourorg.com")
$ActionGroupName = "BudgetAlerts"

# Get existing action Group ID
$ActionGroupId = (Get-AzActionGroup -resourcegroup  cloudmodernization-rg  -Name BudgetAlerts).id

# Create New Action Group
$AlertEmail = New-AzActionGroupReceiver -EmailAddress $ActionGroupEmail -Name ForcastBudgetAlert
$ActionGroupId = (Set-AzActionGroup -ResourceGroupName ($cb.ResourceGroup) -Name $ActionGroupName -ShortName $ActionGroupName -Receiver $AlertEmail).Id

Finally, if you pull all this together calling Invoke-RestMethod it would like something like

# Parameters
$subscriptionId = "00000000-1111-2222-3333-444444444444"
$resourceGroupName = "cloudmodernization-rg"
$ActionGroupName = "BudgetAlerts"
$budgetName = "$resourceGroupName-cb"

# Get existing action Group ID
$ActionGroupId = (Get-AzActionGroup -resourcegroup  $resourceGroupName -Name $ActionGroupName ).id

$bodyObject = @{
    "properties"= @{
        "timePeriod" = @{
            "startDate"= "2022-10-01T00:00:00Z"
            "endDate"= "2024-09-30T00:00:00Z"
        }
        "timeGrain" = "Monthly"
        "amount"= 62
        "category"= "Cost"
        "notifications" = @{
            "forecasted_GreaterThan_90_Percent"= @{
                "enabled" = $true
                "operator"= "GreaterThan"
                "threshold"= 90
                "contactGroups"= @($ActionGroupId)
                "thresholdType"= "Forecasted"
            }
        }
    }
    "filter" =@{}
}

$bearerToken=(Get-AzAccessToken).token
$headers = @{'Authorization' = "Bearer $bearerToken"}
$RequestBody = $bodyObject | convertto-json -Depth 15

$URI = "https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Consumption/budgets/$budgetName"+"?api-version=2021-10-01"
Invoke-RestMethod -Method Put -ContentType  "application/json; charset=utf-8" -Uri $URI -Headers $headers  -Body $RequestBody

Here are the three budgets $60, $61, and $62 created through this article.

This was aimed at showing you how to get to the payload submitted to the Azure Portal to solve a problem using PowerShell and how to revert to using a direct Azure API call.

Azure Arc Connected vSphere (Preview)

This isn’t a groundbreaking demo in terms of the end result; we deploy some VMs, however, the interesting conversation is about how we got there and what we can do with these VMs. With Azure Arc, we can now connect vSphere to the Azure platform, meaning using Azure we can use cloud methods to deploy servers such as Azure templates. This is a step towards creating an environment with a single-pane-of-glass, at least to view and query your IT estate.

The features today are simple, but Azure is a constantly evolving platform and when you are connected, as new features and services are developed and released, and the ecosystem evolves, you can grow with it.

The goal of this article is to give you some ideas about why connecting your vSphere cluster to Azure via Azure Arc and how having VMWare-connected VMs can start providing a path to a consistent cloud experience. This allows administrators to develop management processes in the cloud without requiring a complete lift and shift of all existing servers. As of this writing, this feature is still in preview.

This is assuming you have deployed the Azure Arc bridge to connect your on-premises resources. This process is evolving and is not meant to be the focus of this article.

Once connected using the Azure portal, you can do a simple VM deployment.

Click, click, VM name, deploy-demo-01 next, next, finish.

We can save this as an ARM template, I created a template spec and saved it to Azure, which I am using through the portal to deploy VM deploy-demo-02 but you could use pipeline tools such as Azure DevOps or other CI/CD tooling or templates from PowerShell command line.

You could use PowerShell to deploy that ARM Template to deploy deploy-demo-03

you could convert this into a Bicep template if that’s your standard.

What I do have now is 3 new vSphere hosted VMs all deployed via Azure ARM

however, I never touched the VMware console, and I now have an Azure Resource object.

You have access to basic controls. You could assign this via Azure RBAC rather than having administrators and users needing to access the vSphere console. There are options for resizing, adding disks, and managing networking, standardizing the experience.

In addition, you can also onboard existing deployed vSphere VMs and enable guest management to help manage things like VMware tools versions from Azure.

While the monitoring agent options are changing, I’ll keep this simple. You could also include VM extension such as the monitoring agent in your template.

which in term allows us to query these servers via Log analytics. This means it can be connected to alerts like low disk space and other services like Azure Policy.

This space is changing, there are a lot of new features coming to Azure Arc which we see as a gateway to connecting your existing IT servers to Azure allowing companies to gain the benefits of Azure without having to execute migrations for every server.

Hopefully, you found this insightful or informative

,

Creating an Azure Stack HCI Image for MAAS

,

This blog is a follow on from Creating a MAAS Image Builder Server (Windows Server 2022 example) — Crying Cloud the goal here is to create a MAAS usable Azure Stack HCI image for deployment with MAAS. This is still using the component from cloudbase/windows-imaging-tools: Tools to automate the creation of a Windows image for OpenStack, supporting KVM, Hyper-V, ESXi and more. (github.com) this repo.

The primary issue is if you try to “generalize” an HCI image, if you attempt to use that prepped image, you get the perpetual error “Windows could not finish configuring the system. To attempt to resume configuration, restart the computer”

However, if you don’t “generalize” the HCI base image, the deployment works. The problem with using the existing tools/repo and scripts is creating a MAAS image with this option not to generalize it.

The following content is assuming the layout as described here Creating a MAAS Image Builder Server (Windows Server 2022 example) — Crying Cloud.

Looking into the file C:\BuilderFiles\windows-openstack-imaging-tools\UnattendResources\Logon.ps1 around line 714 we find the command that is calling sysprep.exe

& "$ENV:SystemRoot\System32\Sysprep\Sysprep.exe" `/generalize `/oobe `/shutdown `/unattend:"$unattendedXmlPath"

Without breaking the ability to build other images or have a complete clone of the repo we need to make a few changes. Being able to have a parameter in the ini file makes sense. Create a copy of the ini file C:\BuilderFiles\Scripts\config-Server-HCI-UEFI.ini. I have added a parameter to the [sysprep] section run_sysprep_generalize=False. The differences between the 2022 file and HCI are as follows. 

# config-Server-HCI-UEFI key diff to config-Server-2022-UEFI

image_name=Azure Stack HCI SERVERAZURESTACKHCICORE
image_path=C:\BuilderFiles\Images\HCI.10.2022.tgz
custom_scripts_path="C:\BuilderFiles\scripts\HCICS"
unattend_xml_path="UnattendTemplateHCI.xml"

# new parameter in section
[sysprep]
run_sysprep_generalize=False

I have created a copy of unattendTemplate2022.xml and save as unattendTemplateHCI.xml stored here C:\BuilderFiles\windows-openstack-imaging-tools with the following changes. 

# Delete the following component from specialize node
#     <settings pass="specialize">

        <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <fDenyTSConnections>false</fDenyTSConnections>
        </component>
        <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <UserAuthentication>0</UserAuthentication>
        </component>
        <component name="Networking-MPSSVC-Svc" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
            <FirewallGroups>
                <FirewallGroup wcm:action="add" wcm:keyValue="RemoteDesktop">
                    <Active>true</Active>
                    <Profile>all</Profile>
                    <Group>@FirewallAPI.dll,-28752</Group>
                </FirewallGroup>
            </FirewallGroups>
        </component>

Next is changes to C:\BuilderFiles\windows-openstack-imaging-tools\UnattendResources\Logon.ps1

# line  575 under 
#     if ($installQemuGuestAgent -and $installQemuGuestAgent -ne 'False') {
#        Install-QemuGuestAgent
#    }

# add the following get-ini parameter call

    try {
        $generalizeWindowsImage = Get-IniFileValue -Path $configIniPath -Section "sysprep" -Key "run_sysprep_generalize" -Default "True"
    } catch{}

then, lets a simple if statement to flip the call

# line 741 under
# Optimize-SparseImage

if ($generalizeWindowsImage -eq "False") {
    & "$ENV:SystemRoot\System32\Sysprep\Sysprep.exe" `/oobe `/shutdown `/unattend:"$unattendedXmlPath"
} else {
    & "$ENV:SystemRoot\System32\Sysprep\Sysprep.exe" `/generalize `/oobe `/shutdown `/unattend:"$unattendedXmlPath"
}

Next, create the C:\BuilderFiles\Scripts\HCICS folder. Which will also copy in the RunBeforeSysprep.ps1 script for HCI I have added an additional script C:\BuilderFiles\Scripts\HCICS\RunBeforeWindowsUpdates.ps1 with a script to install the pre-requisites needed for HCI clusters.

function Write-Log {
    Param($messageToOut)
    add-content -path "c:\build.log" ("{0} - {1}" -f @((Get-Date), $messageToOut))
}

Write-Log "RunBeforeWindowsUpdate.ps1 starting" 

Write-Log "install windows Features"
install-windowsfeature FS-Data-Deduplication,BitLocker,Data-Center-Bridging,Failover-Clustering,NetworkATC,RSAT-AD-PowerShell,RSAT-Hyper-V-Tools,RSAT-Clustering,RSAT-DataCenterBridging-LLDP-Tools

Write-Log "RunBeforeWindowsUpdate.ps1 finished"

And to bring it all together the script to call this Build-HCI.ps1. These can be more normalized but for now, create a separate file with the appropriate parameters.

# Build-HCI.ps1 parameters

Param ( 
    $VerbosePreference = "Continue",
    $ISOImage =  "C:\BuilderFiles\ISOs\AzureStackHCI_20348.587_en-us.iso",
    $ConfigFilePath = "C:\BuilderFiles\Scripts\config-Server-HCI-UEFI.ini",
    $CloudBuildModules = "C:\BuilderFiles\windows-openstack-imaging-tools"
)

Fingers crossed, let’s run the Build-HCI.ps1 script

After deployment we can RDP to the server, as it is named in MAAS

Let’s try the credentials and add the server to Windows Admin Center

I believe there is room to refine this process and automate more of it, but these are the steps I took to get an Azure Stack HCI image with updates, users and features installed and able to deploy directly to bare metal with MAAS