Dependencias de los recursos con DependsOn
Al escribir configuraciones, agregue bloques de recursos para configurar aspectos de un nodo de destino. A medida que se agregan bloques de recursos, las configuraciones pueden crecer bastante y pasar a ser difíciles de administrar. Un desafío de este tipo es el orden aplicado de los bloques de recursos. Normalmente, los recursos se aplican en el orden en que se definen dentro de la configuración. A medida que la configuración crece y se hace más grande y compleja, puede usar la clave DependsOn para cambiar el orden aplicado de los recursos mediante la especificación de que un recurso depende de otro recurso.
La clave DependsOn puede utilizarse en cualquier bloque de recursos. Se define con el mismo mecanismo de clave-valor que otras claves de recursos. La clave DependsOn espera una matriz de cadenas con la siguiente sintaxis.
DependsOn = '[<Resource Type>]<Resource Name>', '[<Resource Type>]<Resource Name'
El ejemplo siguiente configura una regla de firewall después de habilitar y configurar el perfil público.
# Install the NetworkingDSC module to configure firewall rules and profiles.
Install-Module -Name NetworkingDSC
Configuration ConfigureFirewall
{
Import-DSCResource -Name Firewall, FirewallProfile
Node localhost
{
Firewall Firewall
{
Name = 'IIS-WebServerRole-HTTP-In-TCP'
Ensure = 'Present'
Enabled = 'True'
DependsOn = '[FirewallProfile]FirewallProfilePublic'
}
FirewallProfile FirewallProfilePublic
{
Name = 'Public'
Enabled = 'True'
DefaultInboundAction = 'Block'
DefaultOutboundAction = 'Allow'
AllowInboundRules = 'True'
AllowLocalFirewallRules = 'False'
AllowLocalIPsecRules = 'False'
NotifyOnListen = 'True'
LogFileName = '%systemroot%\system32\LogFiles\Firewall\pfirewall.log'
LogMaxSizeKilobytes = 16384
LogAllowed = 'False'
LogBlocked = 'True'
LogIgnored = 'NotConfigured'
}
}
}
ConfigureFirewall -OutputPath C:\Temp\
Al aplicar la configuración, el perfil del firewall siempre se configurará en primer lugar, independientemente del orden en que están definidos los bloques de recursos. Si aplica la configuración, asegúrese de tomar nota de la configuración existente de los nodos de destino, para poder revertir la acción si lo desea.
PS> Start-DSCConfiguration -Verbose -Wait -Path C:\Temp\ -ComputerName localhost
VERBOSE: Perform operation 'Invoke CimMethod' with following parameters, ''methodName' = SendConfigurationApply,'className' = MSFT_DSCLocalConfigurationManager,'namespaceName' = root/Microsoft/Windows/DesiredStateConfiguration'.
VERBOSE: An LCM method call arrived from computer SERVER01 with user sid S-1-5-21-181338-0189125723-1543119021-1282804.
VERBOSE: [SERVER01]: LCM: [ Start Set ]
VERBOSE: [SERVER01]: [DSCEngine] Importing the module C:\Program Files\WindowsPowerShell\Modules\NetworkingDsc\6.1.0.0\DscResources\MSFT_Firewall\MSFT_Firewall.psm1 in force mode.
VERBOSE: [SERVER01]: [DSCEngine] Importing the module C:\Program Files\WindowsPowerShell\Modules\NetworkingDsc\6.1.0.0\DscResources\MSFT_FirewallProfile\MSFT_FirewallProfile.psm1 in force mode.
VERBOSE: [SERVER01]: LCM: [ Start Resource ] [[FirewallProfile]FirewallProfilePublic]
VERBOSE: [SERVER01]: LCM: [ Start Test ] [[FirewallProfile]FirewallProfilePublic]
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Importing the module MSFT_FirewallProfile in force mode.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Testing Firewall Public Profile.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "AllowInboundRules" is "NotConfigured" but should be "True". Change required.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "AllowLocalFirewallRules" is "NotConfigured" but should be "False". Change required.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "AllowLocalIPsecRules" is "NotConfigured" but should be "False". Change required.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "DefaultOutboundAction" is "NotConfigured" but should be "Allow". Change required.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "LogBlocked" is "False" but should be "True". Change required.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Test-TargetResource: Firewall Public Profile "LogMaxSizeKilobytes" is "4096" but should be "16384". Change required.
VERBOSE: [SERVER01]: LCM: [ End Test ] [[FirewallProfile]FirewallProfilePublic] in 1.6890 seconds.
VERBOSE: [SERVER01]: LCM: [ Start Set ] [[FirewallProfile]FirewallProfilePublic]
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Importing the module MSFT_FirewallProfile in force mode.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile.
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter AllowInboundRules to "AllowInboundRules".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter AllowLocalFirewallRules to "AllowLocalFirewallRules".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter AllowLocalIPsecRules to "AllowLocalIPsecRules".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter DefaultOutboundAction to "DefaultOutboundAction".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter LogBlocked to "LogBlocked".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile parameter LogMaxSizeKilobytes to "LogMaxSizeKilobytes".
VERBOSE: [SERVER01]: [[FirewallProfile]FirewallProfilePublic] Set-TargetResource: Setting Firewall Public Profile updated.
VERBOSE: [SERVER01]: LCM: [ End Set ] [[FirewallProfile]FirewallProfilePublic] in 10.0360 seconds.
VERBOSE: [SERVER01]: LCM: [ End Resource ] [[FirewallProfile]FirewallProfilePublic]
VERBOSE: [SERVER01]: LCM: [ Start Resource ] [[Firewall]Firewall]
VERBOSE: [SERVER01]: LCM: [ Start Test ] [[Firewall]Firewall]
VERBOSE: [SERVER01]: [[Firewall]Firewall] Importing the module MSFT_Firewall in force mode.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Test-TargetResource: Checking settings for firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Test-TargetResource: Find firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Get-FirewallRule: No Firewall Rule found with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Test-TargetResource: Firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP' does not exist.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Test-TargetResource: Check Firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP' returning False.
VERBOSE: [SERVER01]: LCM: [ End Test ] [[Firewall]Firewall] in 1.1780 seconds.
VERBOSE: [SERVER01]: LCM: [ Start Set ] [[Firewall]Firewall]
VERBOSE: [SERVER01]: [[Firewall]Firewall] Importing the module MSFT_Firewall in force mode.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Set-TargetResource: Applying settings for firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Set-TargetResource: Find firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Get-FirewallRule: No Firewall Rule found with Name 'IIS-WebServerRole-HTTP-In-TCP'.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Set-TargetResource: We want the firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP' to exist since Ensure is set to Present.
VERBOSE: [SERVER01]: [[Firewall]Firewall] Set-TargetResource: We want the firewall rule with Name 'IIS-WebServerRole-HTTP-In-TCP' to exist, but it does not.
VERBOSE: [SERVER01]: [[Firewall]Firewall] New-NetFirewallRule DisplayName: IIS-WebServerRole-HTTP-In-TCP
VERBOSE: [SERVER01]: LCM: [ End Set ] [[Firewall]Firewall] in 1.0850 seconds.
VERBOSE: [SERVER01]: LCM: [ End Resource ] [[Firewall]Firewall]
VERBOSE: [SERVER01]: LCM: [ End Set ]
VERBOSE: [SERVER01]: LCM: [ End Set ] in 15.2880 seconds.
VERBOSE: Operation 'Invoke CimMethod' complete.
VERBOSE: Time taken for configuration job to complete is 15.385 seconds
Esto también garantiza que si el recurso FirewallProfile falla por cualquier motivo, el bloque Firewall no se ejecutará, ni siquiera en el caso de que se haya definido en primer lugar. La clave DependsOn permite más flexibilidad en la agrupación de bloques de recursos y permite garantizar la resolución de las dependencias antes de que se ejecute un recurso.
En configuraciones más avanzadas, también se puede usar la dependencia entre nodos para permitir incluso un control más pormenorizado (por ejemplo, garantizando que un controlador de dominio esté configurado antes de unir a un cliente al dominio).
Limpieza
Si ha aplicado la configuración anterior, puede invertir las claves para deshacer los cambios. En el ejemplo anterior, el establecimiento de la clave Enabled como "False" deshabilitará la regla de firewall y el perfil. Debe modificar el ejemplo según sea necesario para que coincida con el estado configurado anterior del nodo de destino.
Firewall Firewall
{
Name = 'IIS-WebServerRole-HTTP-In-TCP'
Enabled = 'False'
DependsOn = '[FirewallProfile]FirewallProfilePublic'
}
FirewallProfile FirewallProfilePublic
{
Name = 'Public'
Enabled = 'False'
}
