Linux VMSS从SIG镜像创建失败：误装WindowsAttestation扩展

执行New-AzVmss时出现长时间运行操作失败错误，提示为Linux虚拟机安装Microsoft.Azure.Security.WindowsAttestation.GuestAttestation扩展。使用PowerShell脚本从SIG镜像创建Linux VMSS，已传入Linux SIG镜像引用并指定OSType为Linux；但使用Windows SIG镜像并指定OSType为Windows时可正常运行，不清楚Linux场景的问题所在。

用户提供的脚本如下：

$imageref = ""
$resourceGroupName = "myrg"
$location = region
$vnetName = "my-vnet"
$vmssNetwork = "my-net"
$computerName = "myvm"
$securityType = "TrustedLaunch"
$ipName = "my-ip"
$VMSSName = "my vmss"
$SkuName = "Standard_D2s_v3"
$osType = "Linux"
$adminUser = "AdminUsername"
$adminPass = "Adminpassword"

# create resource group
New-AzResourceGroup -ResourceGroupName $resourceGroupName -Location $location

# vnet 
$frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name "frontendSubnet" -AddressPrefix "10.0.1.0/24"
$backendSubnet  = New-AzVirtualNetworkSubnetConfig -Name "backendSubnet"  -AddressPrefix "10.0.2.0/24"
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName -Location $location -AddressPrefix "10.0.0.0/16" -Subnet $frontendSubnet,$backendSubnet
$vnet = Get-AzureRmVirtualNetwork -ResourceGroupName $resourceGroupName -Name $vnetName

#ipconfig
$ipConfig = New-AzureRmVmssIpConfig -Name $ipName -LoadBalancerBackendAddressPoolsId $null -SubnetId $vnet.Subnets[0].Id

# vmss configuration
$vmss = New-AzureRmVmssConfig -Location $location -SkuCapacity 2 -SkuName $SkuName -UpgradePolicyMode "Automatic" -ErrorAction Stop
$vmss1 = Set-AzVmssSecurityProfile -VirtualMachineScaleSet $vmss -SecurityType $securityType;

# network interface config
Add-AzureRmVmssNetworkInterfaceConfiguration -VirtualMachineScaleSet $vmss1 -Name $vmssNetwork -Primary $true -IPConfiguration $ipConfig 

# set the stroage profile 
Set-AzureRmVmssStorageProfile -VirtualMachineScaleSet $vmss1 -OsDiskCreateOption "FromImage" -OsDiskCaching "None" -ImageReferenceId $imageref -OsDiskOsType $osType

# os profile
Set-AzureRmVmssOSProfile -ComputerNamePrefix $computerName -AdminUsername $adminUser -AdminPassword $adminPass -VirtualMachineScaleSet $vmss1

#create the vmss
New-AzVMss -ResourceGroupName $resourceGroupName -Name $VMSSName -VirtualMachineScaleSet $vmss1

原因分析 #

当SecurityType设置为TrustedLaunch时，Azure会自动尝试为虚拟机安装对应的Guest Attestation扩展，但Microsoft.Azure.Security.WindowsAttestation.GuestAttestation是仅适用于Windows系统的扩展，Linux系统需要使用Microsoft.Azure.Security.LinuxAttestation.GuestAttestation扩展。你的脚本未明确指定Linux对应的扩展，导致Azure错误尝试安装Windows版本的扩展，最终失败。

解决方案 #

修改脚本，在设置安全配置后，添加Linux系统专属的Guest Attestation扩展配置：

1. 在Set-AzVmssSecurityProfile代码块后插入以下扩展配置代码：

# 为Linux VMSS添加适配的Guest Attestation扩展
$extensionConfig = Add-AzVmssExtension -VirtualMachineScaleSet $vmss1 `
    -Name "GuestAttestation" `
    -Publisher "Microsoft.Azure.Security.LinuxAttestation" `
    -Type "GuestAttestation" `
    -TypeHandlerVersion "1.0" `
    -AutoUpgradeMinorVersion $true

2. 确保你的Linux SIG镜像已启用TrustedLaunch特性，且镜像的OS类型正确标记为Linux。

修改后的完整脚本示例：

$imageref = ""
$resourceGroupName = "myrg"
$location = region
$vnetName = "my-vnet"
$vmssNetwork = "my-net"
$computerName = "myvm"
$securityType = "TrustedLaunch"
$ipName = "my-ip"
$VMSSName = "my vmss"
$SkuName = "Standard_D2s_v3"
$osType = "Linux"
$adminUser = "AdminUsername"
$adminPass = "Adminpassword"

# create resource group
New-AzResourceGroup -ResourceGroupName $resourceGroupName -Location $location

# vnet 
$frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name "frontendSubnet" -AddressPrefix "10.0.1.0/24"
$backendSubnet  = New-AzVirtualNetworkSubnetConfig -Name "backendSubnet"  -AddressPrefix "10.0.2.0/24"
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName -Location $location -AddressPrefix "10.0.0.0/16" -Subnet $frontendSubnet,$backendSubnet
$vnet = Get-AzureRmVirtualNetwork -ResourceGroupName $resourceGroupName -Name $vnetName

#ipconfig
$ipConfig = New-AzureRmVmssIpConfig -Name $ipName -LoadBalancerBackendAddressPoolsId $null -SubnetId $vnet.Subnets[0].Id

# vmss configuration
$vmss = New-AzureRmVmssConfig -Location $location -SkuCapacity 2 -SkuName $SkuName -UpgradePolicyMode "Automatic" -ErrorAction Stop
$vmss1 = Set-AzVmssSecurityProfile -VirtualMachineScaleSet $vmss -SecurityType $securityType;

# 添加Linux Guest Attestation扩展
$extensionConfig = Add-AzVmssExtension -VirtualMachineScaleSet $vmss1 `
    -Name "GuestAttestation" `
    -Publisher "Microsoft.Azure.Security.LinuxAttestation" `
    -Type "GuestAttestation" `
    -TypeHandlerVersion "1.0" `
    -AutoUpgradeMinorVersion $true

# network interface config
Add-AzureRmVmssNetworkInterfaceConfiguration -VirtualMachineScaleSet $vmss1 -Name $vmssNetwork -Primary $true -IPConfiguration $ipConfig 

# set the stroage profile 
Set-AzureRmVmssStorageProfile -VirtualMachineScaleSet $vmss1 -OsDiskCreateOption "FromImage" -OsDiskCaching "None" -ImageReferenceId $imageref -OsDiskOsType $osType

# os profile
Set-AzureRmVmssOSProfile -ComputerNamePrefix $computerName -AdminUsername $adminUser -AdminPassword $adminPass -VirtualMachineScaleSet $vmss1

#create the vmss
New-AzVMss -ResourceGroupName $resourceGroupName -Name $VMSSName -VirtualMachineScaleSet $vmss1

内容的提问来源于stack exchange，提问作者Talang_madave