1 / 27

Get to Know DSC

Get to Know DSC. A PowerShell.org TechSession. Remember. Find the latest TechSessions at http://powershell.org/wp/techsession-webinars / . Advanced registration is required to attend the live events, where you can participate in Q&A Recordings posted to YouTube, usually in 48 hours.

rianne
Download Presentation

Get to Know DSC

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Get to Know DSC A PowerShell.orgTechSession

  2. Remember • Find the latest TechSessions at http://powershell.org/wp/techsession-webinars/. • Advanced registration is required to attend the live events, where you can participate in Q&A • Recordings posted to YouTube, usually in 48 hours.

  3. Today • We’ll introduce the DSC technology, explain what it is (and isn’t), and provide some guidance for using it. • We’ll also look at where it currently falls short, and try to predict where it’ll go next. • This will be about 50/50 lecture and demo… • …and you’re encouraged to ask questions as we go, using the Q&A panel in GoToWebinar.

  4. Basic Information • Level: 100-200Technology introduction and feature overviewPlanning and architecture • Pre-requisites:Solid experience with Windows PowerShell and Windows administration

  5. What is DSC? • A means of declaratively specifying the configuration a computer should adopt. • Mainly focused on servers at this time. • Rather than writing a script that checks the config and then corrects it, you simply specify the config. Microsoft (and others) provide the code that does the checking and fixing.

  6. Applicability • Part of WMF 4 and later • Win2008R2, Win7, and later • Included in Win2012R2 and Win8.1 • Note that because Win8.1 was a free update, WMF 4 does not technically apply to Win8; the expectation is that you’ll upgrade to 8.1. • Much more limited resource availability on Win2008R2 and Win7, meaning DSC is there, but it can do less.

  7. Architecture

  8. “Target Node” • Because not every node is a computer these days • Although presently, an LCM exists only for Windows and Linux*LCM=Local Configuration Manager, the client-side bit of DSC that does all the dirty work

  9. Configuration Scripts • These can contain zero logic, to incredibly complex logic. • They run once on your authoring computer, and produce a static MOF. • The MOF is what you deploy. Keep in mind that the MOF is static – it doesn’t contain code or logic. • A configuration can be written to target one computer, or contain logic that allows it to produce MOFs for multiple computers. • Let’s take a look…

  10. Resources • A Configuration Script (and thus, the MOF it produces) references one or more Resources. • Resources are what actually check the config, and when necessary fix it. • Non-core resources must be explicitly imported. • Use Get-DscResource to discover installed resources. • A Config can reference any resource that will be available on the target node (e.g., you can code a Config for Linux on Windows) • Resources should be available on the authoring system (for IntelliSense and whatnot)

  11. One Machine, One MOF • You can only deploy a single MOF to a given computer. • To “modularize,” you can… • Add logic to a monolithic configuration script so that it produces “customized” MOFs per computer • Save a configuration as a resource, and then “include” it in another, top-level composite configuration

  12. Composite Configurations Composite Configurationfor Domain Controllers Composite Configurationfor aux. DNS servers Configuration forall company servers Configuration forDNS servers Configuration forAD DS

  13. DSC Resources • Several come bundled with WMF 4 • MANY MANY MORE are in the DSC Resource Kit (at Wave 4 as of June 2014) • Resource Kit also includes Diagnostics and Resource Designer modules • A Resource is a special PowerShell script module, and multiple Resources can be bundled into a single Resource Module. The RM is what gets distributed; the R is what gets referenced in a configuration script • Let’s see one…

  14. Deploying Resources • Containing module should go in \Program Files\WindowsPowerShell\Modules • This is in PSModulePath as of WMF4. • Simple file copy is sufficient…However, resources usually have their own dependencies, usually other PowerShell modules.

  15. Deploying MOFs • PUSH Mode • Uses WinRM to deploy the MOF and kick off the Local Configuration Manager (LCM) • You must deploy all Resource Modules referenced in the MOF • PULL Mode • Configure machines’ LCM to grab their config from a central Web or file server • They can also grab needed Resource Modules from the pull server • Available on 2008R2+ (harder to install on older OS)

  16. “Compliance” Server • Additional optional feature of a Web-based pull server • Gives machines a place to check back in with their current state of conformity • This is only a status code, not a detailed “difference” report. • By default, stored in a Win Internal DB; can be pointed to SQL Server.

  17. “Diffs” • LCMs can be configured to Apply (e.g., look at the config) and Monitor (report back)… • …and Apply and AutoCorrect (e.g., look at the config and do something about it) • DSC is designed to ensure there are no differences; while the technology does support the concept of “report back and tell me what’s non-conforming” there are presently no tools which do so.

  18. Mental Switch • We’re used to asking “what changed?” for troubleshooting. • With DSC, if you’re doing it right, the answer is always nothing. Which is why it doesn’t natively report back with a difference. There is no difference. • You can extract this information from diagnostic logs, but difference reporting isn’t the main goal of the technology.

  19. What’s Missing • Full resource coverage (improving almost monthly) • Tooling (aside from ISE, there basically is nothing) • Documentation (“The DSC Book” is about the best starting point; see also articles on PowerShellMagazine.com and the PowerShell team blog; it’s all a bit scattered at present).

  20. What DSC Isn’t • A catchall replacement for everything • E.g., you’d use DSC to configure WSUS, not to deploy updates

  21. Sketchy Areas • Software installation is a little primitive – the current Package resource is a bit finicky • Broad availability of OneGet (WMF 5) will probably help move this further toward the goal

  22. Security • The LCM runs as SYSTEM, so it has almost no authority off-computer • Anything you need to do non-local (e.g., retrieve a package from a file server) will need to be given a credential • You can specify, in a config, the thumbprint of a certificate (which you must pre-deploy to nodes) that can be used to decrypt credentials in the config

  23. HTTPS! • Pull Servers should be set up using SSL – this is what they want by default • Without SSL, you get NO AUTHENTICATION OF THE PULL SERVER IDENTITY THIS IS A MASSIVE SECURITY FAIL AND YOU WILL PROBABLY GO TO HELL AND YOU’VE GOT NOBODY TO BLAME BUT YOURSELF PLEASE DON’T USE A NON-HTTPS PULL SERVER THANK YOU VERY MUCH.

  24. This Isn’t GPO (Yet) • There is no connection to Active Directory. • Targeting is basically manual, or whatever logic you build. • There’s no apply-time dynamic targeting or filtering (MOFs are static). • You get only one MOF per computer (which complicates authoring, but massively simplifies everything else).

  25. Let’s Take Some Questions • I know you’ve got ‘em… ask away.

  26. Follow-Up Resources • The DSC Book (soon to be retitled The Free DSC Book) at PowerShell.org (on the “Resources” menu) • The DSC Hub at PowerShell.org (including our GitHub repo) • Watch for a DSC Microsoft Virtual Academy from Don Jones and Jeffrey Snover in 2014Q4 • DSC Q&A Forum at PowerShell.org

  27. Thank You! • Find the latest TechSessions at http://powershell.org/wp/techsession-webinars/. Advanced registration is required to attend the live events, where you can participate in Q&ARecordings posted to YouTube, usually in 48 hours. • Ask follow-up questions in the Forums on PowerShell.org.

More Related