I am trying to setup a custom build agent on a Windows VM in Azure. I installed the build agent from Azure Pipelines. The VM shows in the agent pool, but is offline. For this VM I used the default settings, so it automatically created a virtual network, public IP, and network security group. The network security group is modified to allow RDP traffic from my IP address only, and to allow HTTPS traffic. I am assuming something with this setup is preventing Azure Pipelines from sending data to the VM.
My first question is how do I get this setup to work. What am I missing?
My second question is how do I get this to work in a more secure way by removing the default link between the public IP and the VM, and ultimately blocking direct access to the VM with a firewall?
VM only needs outbound HTTPS access to Azure Devops
You dont need public ip for the agent vm
https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/v2-windows?view=azure-devops#im-running-a-firewall-and-my-code-is-in-azure-repos-what-urls-does-the-agent-need-to-communicate-with
Related
can anyone help with some azure vm issues. I wished to connect a domain server VM and a ordinary server VM and use active directory synchronization. But every time I deploy new VM from azure portal, it always have the DNS name status as not configured. I really don't understand why. I set the DNS server with the private IPs of the VMs on the vNet. Thanks for replies and advise. VM DNS name not configured
As the comment stated, the DNS name for that VM is actually associated with the public IP attached to that VM. You can follow this step to create FQDN for an Azure VM.
If you want to join the Azure VM to your local domain, you can follow this link:
The main steps are as follows:
Establish cross-site connectivity using Azure site-to-site VPN connections
Configure a custom DNS server
Provision a VM with a custom DNS server
Join the Azure VM to the on-premises Active Directory domain
If you intend to join a Windows Server virtual machine to an Azure Active Directory Domain Services managed domain, read this tutorial.
I am unable to access Blob Service from Azure Virtual Machines running in the same region. I have created a storage account and planned to access to selected IP addresses i.e. MY Laptop, My Office PC and My Virtual Machine which is running is Azure. After whitelisting 3 of the IP's I am able to access the Blob Service from MY Laptop and MY Office PC but unable to access the same of Virtual Machine which is running in Azure.
Pl. let me know if anyone is facing similar issues and the resolution. Thanks in Advance.
Check the NSG the VM belongs to and see if you are allowing the VM to communicate outbound, if so check if Azure storage is allowing incoming connections from the network to which the VM is connected to.
Your VM uses the internal network to attempt to access the Storage so adding the public IP won't work and you can't use internal IP's.
The easiest way would be adding the Virtual Network subnet of the VM to the firewall rules and add Azure.Storage as service endpoint to the subnet. If you add the subnet using the Azure Portal the service endpoint will be automatically added as well. Another way would be setting up a private endpoint.
I have a Private AKS cluster deployed in a VNET on Azure. Once I deployed it, a private endpoint and a private DNS zone were created by default therefore making the cluster accessible from VM's which are part of the same VNET. (I have a VM deployed in the same VNET as the AKS cluster and "kubectl" commands work in it.)
My requirement is that I want to perform the "kubectl" commands from my local machine (connected to my home network) and also connected to the VPN which connects to the VNET.
My machine can talk to resources within the VNET but cannot seem to resolve the FQDN of the private cluster.
I read somewhere that having a DNS forwarder setup in the same VNET can help resolve the DNS queries made from the local machine which can then be resolved by Azure DNS. Is this the way to go about this? Or is there a better way to solve this problem?
It would really help if someone could give me an action plan to follow to solve this problem.
The better way to perform the "kubectl" commands from your local machine to your private AKS cluster is to use AKS Run Command (Preview). This feature allows you to remotely invoke commands in an AKS cluster through the AKS API. This feature provides an API that allows you to, for example, execute just-in-time commands from a remote laptop for a private cluster. Before using it, you need to enable the RunCommandPreview feature flag on your subscription and install aks-preview extension locally. However, there is a limitation that AKS-RunCommand does not work on clusters with AKS managed AAD and Private link enabled.
In this case, If you want to resolve the FQDN of the private cluster from your on-premise network, you could select to use either the hosts file locally(used for testing) or use your DNS forwarder to override the DNS resolution for a private link resource like this.
The DNS forwarder will be responsible for all the DNS queries via a server-level forwarder to the Azure-provided DNS 168.63.129.16.You can provision IaaS Windows VM with DNS role or Linux VM with bind configured as a DNS forwarder. This template shows how to create a DNS server that forwards queries to Azure's internal DNS servers for Linux VM. Refer to this for DNS forwarder on Windows VM.
If there is an internal DNS server in your on-premise network. The on-premises DNS solution needs to forward DNS traffic to Azure DNS via a conditional forwarder for your public DNS zones(e.g. {region}.azmk8s.io). The conditional forwarder references the DNS forwarder deployed in Azure. You could read this blog about DNS configuration sections for more details.
VM and App Service are located in the same Virtual Network.
App Service is added to VM through VNet Integration (preview)
VM is autoregistered in Private DNS zone, say by name myvm1. And full name myvm1.priv.zone
Private DNS zone is linked to Virtual Network.
Virtual Network - DNS Servers is set to default.
VM and App Service were restarted after configuration.
Problem is I can resolve neither myvm1 nor myvm1.priv.zone from App Service console by nameresolver.exe
UPDATE:
Actually, the issue is even bigger. App Service is not able to send requests to VMs in Virtual Network by their Private IPs (10.1.x.x) even if everything is allowed on VMs' subnet. If the same requests are sent to VMs' Public IPs there is no problem.
As the existing answer, for scenario Name resolution from App Service Web Apps to VMs in the same virtual network. in this DOC, you need to deploy your own DNS server to help name resolution.
Here are the steps:
On the Azure VM in the VNet, add a server role DNS server, after the installation, configure the DNS server, add Zone name such as qaz.lab in my example. You also can manually add an A record for your Azure VM in this Zone.
Add the DNS server private IP address in the custom DNS server of Azure VNet. Then restart the Azure VM to make it effective.
Configure VNet Integration with your app, in this case, select the new VNet integration. After that, refresh your VNet Integration. You will see the DNS server update in your app service plan --- networking.
Navigate your app service, run nameresolver FQDN to validate the DNS resolution. Currently, It only supports FQDN resolution.
Let me know if you have any question.
As of today, you need to use DNS proxies or forwarders to achieve your ask. It is documented here in the scenario table.
For scenario "Name resolution from App Service Web Apps to VMs in the same virtual network.", the solution is to "Customer-managed DNS servers forwarding queries between virtual networks for resolution by Azure (DNS proxy)."
On How to perform "Name resolution with your own DNS" check here, where your scenario is described.
Scenario:
I have a website on Windows Azure. That website needs to connect to a (new) Azure VM.
I have done the following:
Created new Virtual Network on Azure
Added the VM to the Virtual Network, and it does get an IP in the virtual network.
I have configured the appropiate Endpoint for the VM (Public/Private port).
Now, how do I "connect" the Azure website to the same virtual network, such that my .NET code in the website can create a TCP connection to the VM on it's IP on the Virtual Network ?
This is now possible. Be sure to use the NEW Azure Portal. For details, check out:
http://azure.microsoft.com/blog/2014/09/15/azure-websites-virtual-network-integration/
Currently you cannot connect/add Azure Web Site to a Virtual Network. You can only add VMs and Cloud Services to a Virtual Network. However this is a demanded feature and I believe we will see it in the future releases of the Web Sites service (my speculation).
The key here is to create the Virtual Network before the Virtual Machine and then place the VM in the VN during it's creation. The article here gives instructions moving a VM into a VN.
http://blogs.msdn.com/b/walterm/archive/2013/05/29/moving-a-virtual-machine-from-one-virtual-network-to-another.aspx