Automation for Large Scale Deployment of Agents on Servers managed by Azure Arc

Posted by

This post has been republished via RSS; it originally appeared at: New blog articles in Microsoft Community Hub.

There is a growing need for the deployment of tools or agents on on-premise servers in bulk. Its highly time consuming to manually deploy the agent in bulk.

 

Microsoft Azure uses Azure Arc for the agents/tools/application deployments and can be combined with Azure policy for large scale mass deployment. In the below usecase Log Analytics and Dependency agents pushed via the policy.

 

Agents can be deployed manually using Azure portal, though for large environment, it is recommended to push these agents via custom Azure Policy or using PowerShell automation scripting.

 

surao_0-1673434564816.jpeg

 

 

Deployment using Azure Policy

Below usecase helps deploying Log Analytics and Dependency agents using Azure policy.

There are 2 core functionalities of Azure policy that allows the automation

  • Creating Azure Policy Definition
  • Policy assignment & Remediation

Creating Azure Policy Definition

In order to push through Azure policy the first step is to define policy rule as below, for Arc the resource type is Microsoft.HybridCompute, For Linux we just need to change imageOffer to “linux*”.

 

"policyRule": {

      "if": {

        "allOf": [

          {

            "field": "type",

            "equals": "Microsoft.HybridCompute/machines"

          },

          {

            "field": "Microsoft.HybridCompute/imageOffer",

            "like": "windows*"

          }

If we want to deploy MMA only to certain Arc servers, then we can

add a tag to the machine, for example “loganalytics:true” and define

the below section in PolicyRule, then it will push MMA agent only to VMs where this tag is set as true.

{

 "field": "tags.loganalytics",

 "equals": "true"

 }

 surao_12-1673435122748.png

 

 

Define OMSagent for Linux & MMA for Windows.

 

surao_13-1673435214209.png

Policy Assignment and Remediation

After creating policy definition create policy assignment to define scope, resource exclusion against the assignment defined in the first step.

Next is to create remediation task with managed identity to auto remediate all non-compliant Arc Machine.

For Dependency Agent, the policy rule will remain same as defined for MMA, define imageOffer “windows*” for windows server & “Linux*” for Linux respectively. Existence condition will change based on the extension type.

 

surao_14-1673435251422.png

Define Parameter, Variables and resources as below:

 

surao_15-1673435282848.png

 

Deployment using Powershell Script

We can also deploy MMA/OMSAgent extensions to Arc servers via PowerShell command for all the servers aligned within same resource group.

In order to run the below command, put all the VMs, separated per line, in a text file and create a loop logic as below

$VMname=get-content "C:\list.txt"  

foreach($vm in $VMname){

$vm1 = Get-AzConnectedMachine -Name $vm -ResourceGroupName <RGNAME>

$Setting = @{ "workspaceId" = "workspaceId" }

$protectedSetting = @{ "workspaceKey" = "workspaceKey" }

New-AzConnectedMachineExtension -Name OMSLinuxAgent -ResourceGroupName "RGName" -MachineName $vm1.Name -Location "regionName" -Publisher "Microsoft.EnterpriseCloud.Monitoring" -Settings $Setting -ProtectedSetting $protectedSetting -ExtensionType "OmsAgentForLinux"

}

For windows change the value for the -ExtensionType parameter to "MicrosoftMonitoringAgent".

 

References

 

Azure Arc

Azure Arc helps client to bring their distributed workloads under single control planes using Azure Public Cloud. This will allow for direct enablement and integration with Microsoft Security tools and monitoring agents.

https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=ARMAgentPowerShell%2CPowerShellWindows%2CPowerShellWindowsArc%2CCLIWindows%2CCLIWindowsArc

Azure Policy

Azure policy helps assess organization compliance and overall environmental state. Azure policy allows to restrict usage of Azure resources based on compliance requirements.

https://learn.microsoft.com/en-us/azure/governance/policy/

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-policies-mma

 

 

About Author

 

surao_0-1673434327250.png

Kritika Gupta

I am an experienced IT professional, focused on cloud technologies and DevOps. I specialize in Azure, Azure DevOps, Arc, AKS , PowerShell/CLI.

I am currently working at DXC Technology as an Azure Sr. Engineer in the Global India Azure Delivery Team. LinkedIn: "linkedin.com/in/kritika-gupta-609757b6"

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.