Skip to content

Commit 79f27cc

Browse files
v-regandownerv-regandowner
authored
Merge pull request #235032 from michaeltlombardi/ab-85436/main/machine-config-cleanup
(AB#85436) Bulk Cleanup: Machine Configuration
2 parents 71e3afb + a19162b commit 79f27cc

15 files changed

+1616
-1520
lines changed

‎articles/governance/machine-configuration/agent-notes.md

Lines changed: 56 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,33 @@
11
---
22
title: Azure Automanage machine configuration agent release notes
33
description: Details guest configuration agent release notes, issues, and frequently asked questions.
4-
ms.date: 09/13/2022
4+
ms.date: 04/18/2023
55
ms.topic: conceptual
66
---
77
# Azure Automanage machine configuration agent release notes
88

9-
[!INCLUDE [Machine config rename banner](../includes/banner.md)]
9+
[!INCLUDE [Machine configuration rename banner](../includes/banner.md)]
1010

11-
## About the guest configuration agent
11+
## About the machine configuration agent
1212

13-
The guest configuration agent receives improvements on an ongoing basis. To stay up to date with the most recent developments, this article provides you with information about:
13+
The machine configuration agent receives improvements on an ongoing basis. To stay up to date with
14+
the most recent developments, this article provides you with information about:
1415

1516
- The latest releases
1617
- Known issues
1718
- Bug fixes
1819

19-
For information on release notes for the connected machine agent, please see [What's new with the connected machine agent](../../azure-arc/servers/agent-release-notes.md).
20+
For information on release notes for the connected machine agent, see
21+
[What's new with the connected machine agent][01].
2022

2123
## Release notes
2224

2325
### Version 1.29.48 - January 2023
2426

2527
#### New Features
2628

27-
- In this release we have added support for Linux distributions such as Red Hat Enterprise Linux (RHEL) 9, Mariner 1&2, Alma 9, and Rocky 9.
29+
- In this release, we've added support for Linux distributions such as Red Hat Enterprise Linux
30+
(RHEL) 9, Mariner 1&2, Alma 9, and Rocky 9.
2831

2932
#### Fixed
3033

@@ -33,34 +36,61 @@ For information on release notes for the connected machine agent, please see [Wh
3336

3437
### Guest Configuration Linux Extension version 1.26.38
3538

36-
In this release, various improvements were made.
39+
In this release, various improvements were made.
3740

38-
- You can now restrict which URLs can be used to download machine configuration packages by setting the allowedGuestConfigPkgUrls tag on the server resource and providing a comma-separated list of URL patterns to allow. If the tag exists, the agent will only allow custom packages to be downloaded from the specified URLs. Built-in packages are unaffected by this feature.
41+
- You can now restrict which URLs can be used to download machine configuration packages by setting
42+
the `allowedGuestConfigPkgUrls` tag on the server resource and providing a comma-separated list of
43+
URL patterns to allow. If the tag exists, the agent only allows custom packages to be
44+
downloaded from the specified URLs. Built-in packages are unaffected by this feature.
3945

4046
## Fixed
4147

42-
- Resolves local elevation of privilege vulnerability [CVE-2022-38007](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38007).
43-
- If you're currently running an older version of the AzurePolicyforLinux extension, use the PowerShell or Azure CLI commands below to update your extension to the latest version.
44-
45-
```powershell
46-
Set-AzVMExtension -Publisher 'Microsoft.GuestConfiguration' -Type 'ConfigurationforLinux' -Name 'AzurePolicyforLinux' -TypeHandlerVersion 1.26.38 -ResourceGroupName 'myResourceGroup' -Location 'myLocation' -VMName 'myVM' -EnableAutomaticUpgrade $true
48+
- Resolves local elevation of privilege vulnerability [CVE-2022-38007][03].
49+
- If you're currently running an older version of the AzurePolicyforLinux extension, use the
50+
PowerShell or Azure CLI commands in the following examples to update your extension to the latest
51+
version.
52+
53+
```azurepowershell-interactive
54+
$params = @{
55+
Publisher = 'Microsoft.GuestConfiguration'
56+
Type = 'ConfigurationforLinux'
57+
Name = 'AzurePolicyforLinux'
58+
TypeHandlerVersion = '1.26.38'
59+
ResourceGroupName = '<resource-group>'
60+
Location = '<location>'
61+
VMName = '<vm-name>'
62+
EnableAutomaticUpgrade = $true
63+
}
64+
Set-AzVMExtension @params
4765
```
4866

4967
```azurecli
50-
az vm extension set --publisher Microsoft.GuestConfiguration --name ConfigurationforLinux --extension-instance-name AzurePolicyforLinux --resource-group myResourceGroup --vm-name myVM --version 1.26.38 --enable-auto-upgrade true
68+
az vm extension set \
69+
--publisher Microsoft.GuestConfiguration \
70+
--name ConfigurationforLinux \
71+
--extension-instance-name AzurePolicyforLinux \
72+
--resource-group <resource-group> \
73+
--vm-name <vm-name> \
74+
--version 1.26.38 \
75+
--enable-auto-upgrade true
5176
```
5277

5378
## Next steps
5479

55-
- Set up a custom machine configuration package [development environment](./machine-configuration-create-setup.md).
56-
- [Create a package artifact](./machine-configuration-create.md)
57-
for machine configuration.
58-
- [Test the package artifact](./machine-configuration-create-test.md)
59-
from your development environment.
60-
- Use the `GuestConfiguration` module to
61-
[create an Azure Policy definition](./machine-configuration-create-definition.md)
62-
for at-scale management of your environment.
63-
- [Assign your custom policy definition](../policy/assign-policy-portal.md) using
64-
Azure portal.
65-
- Learn how to view
66-
[compliance details for machine configuration](../policy/how-to/determine-non-compliance.md) policy assignments.
80+
- Set up a custom machine configuration package [development environment][04].
81+
- [Create a package artifact][05] for machine configuration.
82+
- [Test the package artifact][06] from your development environment.
83+
- Use the `GuestConfiguration` module to [create an Azure Policy definition][07] for at-scale
84+
management of your environment.
85+
- [Assign your custom policy definition][08] using Azure portal.
86+
- Learn how to view [compliance details for machine configuration][09] policy assignments.
87+
88+
<!-- Reference link definitions -->
89+
[01]: ../../azure-arc/servers/agent-release-notes.md
90+
[03]: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38007
91+
[04]: ./machine-configuration-create-setup.md
92+
[05]: ./machine-configuration-create.md
93+
[06]: ./machine-configuration-create-test.md
94+
[07]: ./machine-configuration-create-definition.md
95+
[08]: ../policy/assign-policy-portal.md
96+
[09]: ../policy/how-to/determine-non-compliance.md

‎articles/governance/machine-configuration/index.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ metadata:
99
ms.service: machine-configuration
1010
ms.topic: landing-page
1111
ms.collection: collection
12-
author: timwarner-msft
13-
ms.author: timwarner
12+
author: michaeltlombardi
13+
ms.author: mlombardi
1414
ms.date: 08/01/2022
1515

1616
landingContent:

‎articles/governance/machine-configuration/machine-configuration-assignments.md

Lines changed: 57 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,21 @@
11
---
22
title: Understand machine configuration assignment resources
33
description: Machine configuration creates extension resources named machine configuration assignments that map configurations to machines.
4-
ms.date: 01/12/2023
4+
ms.date: 04/18/2023
55
ms.topic: conceptual
66
---
77
# Understand machine configuration assignment resources
88

9-
[!INCLUDE [Machine config rename banner](../includes/banner.md)]
9+
[!INCLUDE [Machine configuration rename banner](../includes/banner.md)]
1010

11-
When an Azure Policy is assigned, if it's in the category "Guest Configuration"
12-
there's metadata included to describe a guest assignment.
11+
When an Azure Policy is assigned, if it's in the category `Guest Configuration` there's metadata
12+
included to describe a guest assignment.
1313

14-
[A video walk-through of this document is available](https://youtu.be/DmCphySEB7A).
14+
[A video walk-through of this document is available][01].
1515

16-
You can think of a guest assignment as a link between a machine and an Azure
17-
Policy scenario. For example, the following snippet associates the Azure Windows
18-
Baseline configuration with minimum version `1.0.0` to any machines in scope of
19-
the policy.
16+
You can think of a guest assignment as a link between a machine and an Azure Policy scenario. For
17+
example, the following snippet associates the Azure Windows Baseline configuration with minimum
18+
version `1.0.0` to any machines in scope of the policy.
2019

2120
```json
2221
"metadata": {
@@ -25,30 +24,31 @@ the policy.
2524
"name": "AzureWindowsBaseline",
2625
"version": "1.*"
2726
}
28-
//additional metadata properties exist
27+
//additional metadata properties exist
28+
}
2929
```
3030

3131
## How Azure Policy uses machine configuration assignments
3232

33-
The metadata information is used by the machine configuration service to
34-
automatically create an audit resource for definitions with either
35-
**AuditIfNotExists** or **DeployIfNotExists** policy effects. The resource type
36-
is `Microsoft.GuestConfiguration/guestConfigurationAssignments`. Azure Policy
37-
uses the **complianceStatus** property of the guest assignment resource to
38-
report compliance status. For more information, see
39-
[getting compliance data](../policy/how-to/get-compliance-data.md).
33+
The machine configuration service uses the metadata information to automatically create an audit
34+
resource for definitions with either `AuditIfNotExists` or `DeployIfNotExists` policy effects. The
35+
resource type is `Microsoft.GuestConfiguration/guestConfigurationAssignments`. Azure Policy uses
36+
the **complianceStatus** property of the guest assignment resource to report compliance status. For
37+
more information, see [getting compliance data][02].
4038

4139
### Deletion of guest assignments from Azure Policy
4240

43-
When an Azure Policy assignment is deleted, if a machine configuration assignment
44-
was created by the policy, the machine configuration assignment is also deleted.
41+
When an Azure Policy assignment is deleted, if the policy created a machine configuration
42+
assignment, the machine configuration assignment is also deleted.
4543

46-
When an Azure Policy assignment is deleted from an initiative, if a machine configuration assignment was created by the policy, you will need to manually delete the corresponding machine configuration assignment. This can be done by navigating to the guest assignments page on Azure portal and deleting the assignment there.
44+
When an Azure Policy assignment is deleted, you need to manually delete any machine configuration
45+
assignments the policy created. You can do so by navigating to the guest assignments page on Azure
46+
portal and deleting the assignment there.
4747

4848
## Manually creating machine configuration assignments
4949

50-
Guest assignment resources in Azure Resource Manager can be created by Azure
51-
Policy or any client SDK.
50+
You can create guest assignment resources in Azure Resource Manager by using Azure Policy or any
51+
client SDK.
5252

5353
An example deployment template:
5454

@@ -79,31 +79,30 @@ An example deployment template:
7979

8080
The following table describes each property of guest assignment resources.
8181

82-
| Property | Description |
83-
|-|-|
84-
| name | Name of the configuration inside the content package MOF file. |
85-
| contentUri | HTTPS URI path to the content package (.zip). |
86-
| contentHash | A SHA256 hash value of the content package, used to verify it has not changed. |
87-
| version | Version of the content package. Only used for built-in packages and not used for custom content packages. |
88-
| assignmentType | Behavior of the assignment. Allowed values: `Audit`, `ApplyandMonitor`, and `ApplyandAutoCorrect`. |
89-
| configurationParameter | List of DSC resource type, name, and value in the content package MOF file to be overridden after it's downloaded in the machine. |
82+
| Property | Description |
83+
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
84+
| **name** | Name of the configuration inside the content package MOF file. |
85+
| **contentUri** | HTTPS URI path to the content package (`.zip`). |
86+
| **contentHash** | A SHA256 hash value of the content package, used to verify it hasn't changed. |
87+
| **version** | Version of the content package. Only used for built-in packages and not used for custom content packages. |
88+
| **assignmentType** | Behavior of the assignment. Allowed values: `Audit`, `ApplyandMonitor`, and `ApplyandAutoCorrect`. |
89+
| **configurationParameter** | List of DSC resource type, name, and value in the content package MOF file to be overridden after it's downloaded in the machine. |
9090

9191
### Deletion of manually created machine configuration assignments
9292

93-
Machine configuration assignments created through any manual approach (such as
94-
an Azure Resource Manager template deployment) must be deleted manually.
95-
Deleting the parent resource (virtual machine or Arc-enabled machine) will also
96-
delete the machine configuration assignment.
93+
You must manually delete machine configuration assignments created through any manual approach
94+
(such as an Azure Resource Manager template deployment). Deleting the parent resource (virtual
95+
machine or Arc-enabled machine) also deletes the machine configuration assignment.
9796

98-
To manually delete a machine configuration assignment, use the following
99-
example. Make sure to replace all example strings, indicated by "\<\>" brackets.
97+
To manually delete a machine configuration assignment, use the following example. Make sure to
98+
replace all example strings, indicated by `<>` brackets.
10099

101-
```PowerShell
100+
```azurepowershell-interactive
102101
# First get details about the machine configuration assignment
103102
$resourceDetails = @{
104-
ResourceGroupName = '<myResourceGroupName>'
103+
ResourceGroupName = '<resource-group-name>'
105104
ResourceType = 'Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments/'
106-
ResourceName = '<myVMName>/Microsoft.GuestConfiguration'
105+
ResourceName = '<vm-name>/Microsoft.GuestConfiguration'
107106
ApiVersion = '2020-06-25'
108107
}
109108
$guestAssignment = Get-AzResource @resourceDetails
@@ -117,16 +116,22 @@ $guestAssignment | Remove-AzResource
117116

118117
## Next steps
119118

120-
- Read the [machine configuration overview](./overview.md).
121-
- Setup a custom machine configuration package [development environment](./machine-configuration-create-setup.md).
122-
- [Create a package artifact](./machine-configuration-create.md)
123-
for machine configuration.
124-
- [Test the package artifact](./machine-configuration-create-test.md)
125-
from your development environment.
126-
- Use the `GuestConfiguration` module to
127-
[create an Azure Policy definition](./machine-configuration-create-definition.md)
128-
for at-scale management of your environment.
129-
- [Assign your custom policy definition](../policy/assign-policy-portal.md) using
130-
Azure portal.
131-
- Learn how to view
132-
[compliance details for machine configuration](../policy/how-to/determine-non-compliance.md) policy assignments.
119+
- Read the [machine configuration overview][03].
120+
- Set up a custom machine configuration package [development environment][04].
121+
- [Create a package artifact][05] for machine configuration.
122+
- [Test the package artifact][06] from your development environment.
123+
- Use the **GuestConfiguration** module to [create an Azure Policy definition][07] for at-scale
124+
management of your environment.
125+
- [Assign your custom policy definition][08] using Azure portal.
126+
- Learn how to view [compliance details for machine configuration][09] policy assignments.
127+
128+
<!-- Reference link definitions -->
129+
[01]: https://youtu.be/DmCphySEB7A
130+
[02]: ../policy/how-to/get-compliance-data.md
131+
[03]: ./overview.md
132+
[04]: ./machine-configuration-create-setup.md
133+
[05]: ./machine-configuration-create.md
134+
[06]: ./machine-configuration-create-test.md
135+
[07]: ./machine-configuration-create-definition.md
136+
[08]: ../policy/assign-policy-portal.md
137+
[09]: ../policy/how-to/determine-non-compliance.md

0 commit comments

Comments
 (0)