使用Terraform的Azure虚拟机扩展执行PowerShell脚本报错求助

问题详情 #

本地Terraform执行路径下存在winrm.ps1脚本，通过azurerm_virtual_machine_extension部署CustomScriptExtension执行该脚本时失败，报错提示脚本未被识别；但本地登录虚拟机实例执行该脚本可正常运行。

Terraform代码 #

resource "azurerm_virtual_machine_extension" "win_vmext" {
  name                  = azurerm_windows_virtual_machine.windows_vm.name
  virtual_machine_id    = azurerm_windows_virtual_machine.windows_vm.id
  publisher             = "Microsoft.Compute"
  type                  = "CustomScriptExtension"
  type_handler_version  = "1.10"
  settings = <<SETTINGS
    {
        "commandToExecute": "powershell.exe ./winrm.ps1"
    }
SETTINGS
}

错误日志 #

[ERROR] Command execution finished, but failed because it returned a non-zero exit code of: '1'. The command had an error output of: './winrm.ps1 : The term './winrm.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

问题原因 #

CustomScriptExtension不会自动将本地Terraform路径下的脚本上传到虚拟机中，你指定的./winrm.ps1路径是相对于虚拟机的扩展执行工作目录（通常为C:\Packages\Plugins\Microsoft.Compute.CustomScriptExtension\对应版本\Downloads\0），但该目录下并没有你的脚本文件，因此报错找不到。

解决方法 #

方法1：通过存储账户Blob上传脚本（推荐） #

将winrm.ps1上传到Azure存储账户的Blob容器，在扩展配置中指定脚本的公共URI；若容器为私有，需在protected_settings中添加存储账户的认证信息。示例代码：

resource "azurerm_virtual_machine_extension" "win_vmext" {
  name                  = azurerm_windows_virtual_machine.windows_vm.name
  virtual_machine_id    = azurerm_windows_virtual_machine.windows_vm.id
  publisher             = "Microsoft.Compute"
  type                  = "CustomScriptExtension"
  type_handler_version  = "1.10"

  settings = <<SETTINGS
    {
        "fileUris": ["https://你的存储账户名.blob.core.windows.net/你的容器名/winrm.ps1"],
        "commandToExecute": "powershell.exe -ExecutionPolicy Unrestricted -File winrm.ps1"
    }
SETTINGS

  # 私有容器需添加以下配置
  protected_settings = <<PROTECTED_SETTINGS
    {
        "storageAccountName": "你的存储账户名",
        "storageAccountKey": "你的存储账户密钥"
    }
PROTECTED_SETTINGS
}

方法2：将脚本内容嵌入配置 #

若脚本内容较短，可将脚本内容转换为Base64编码，直接嵌入到commandToExecute中，无需额外上传脚本：

resource "azurerm_virtual_machine_extension" "win_vmext" {
  name                  = azurerm_windows_virtual_machine.windows_vm.name
  virtual_machine_id    = azurerm_windows_virtual_machine.windows_vm.id
  publisher             = "Microsoft.Compute"
  type                  = "CustomScriptExtension"
  type_handler_version  = "1.10"

  settings = <<SETTINGS
    {
        "commandToExecute": "powershell.exe -ExecutionPolicy Unrestricted -EncodedCommand ${base64encode(file("winrm.ps1"))}"
    }
SETTINGS
}

内容的提问来源于stack exchange，提问作者virtualramblings