Add Multiple Certificates to new VMSS from the same KeyVault

3
votes

Question

I'm trying to add multiple certificates to a new VMSS when creating it but i'm receiving error List secrets contains repeated instances of

/subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.KeyVault/vaults/xxxxx, which is disallowed.

My powershell to create the VMSS is:

$vmssConfig = New-AzureRmVmssConfig -Location $location -SkuCapacity $trgVMSSCapacity -SkuName $trgVMSSSize -UpgradePolicyMode 'Manual'
$vmssConfig = Set-AzureRmVmssStorageProfile -VirtualMachineScaleSet $vmssConfig -OsDiskCaching ReadWrite -OsDiskCreateOption FromImage -OsDiskOsType Windows -ImageReferenceId $Image.Id -ManagedDisk $trgVMSSDisk
$vmssConfig = Set-AzureRmVmssOsProfile -VirtualMachineScaleSet $vmssConfig -AdminUsername $trgOSAdminUser -AdminPassword $trgOSAdminPass -ComputerNamePrefix $trgComputerName -WindowsConfigurationEnableAutomaticUpdate $false -WindowsConfigurationProvisionVMAgent $true
$vmssConfig = Add-AzureRmVmssNetworkInterfaceConfiguration -VirtualMachineScaleSet $vmssConfig -Name 'network-config' -Primary $true -IPConfiguration $ipConfig
$cgCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $cgCertURL -CertificateStore 'My'
$ktuCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $ktuCertURL -CertificateStore 'My'
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $cgCertConfig
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $ktuCertConfig
$vmssConfig = Set-AzureRmVmssBootDiagnostic -VirtualMachineScaleSet $vmssConfig -Enabled $true -StorageUri $trgStorage.Context.BlobEndPoint

Expected

On the faq here: https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-faq it has a section 'When I run Update-AzureRmVmss after adding more than one certificate from the same key vault, I see the following message:' but I cannot work out how to fix my script to work, can anyone help?

2
powershellazureazure-vm-scale-set

2 Answers

3
votes

I'm not able to test, but based on my reading of the documentation, you can't use the Add-AzureRmVmssSecret more than once. You either have to add all of the certs from the same store in the initial command or edit the list here: $vmss.properties.osProfile.secrets[0].vaultCertificates

For your code, I would try:

$cgCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $cgCertURL -CertificateStore 'My'
$ktuCertConfig = New-AzureRmVmssVaultCertificateConfig -CertificateUrl $ktuCertURL -CertificateStore 'My'
$vmssConfig = Add-AzureRmVmssSecret -VirtualMachineScaleSet $vmssConfig -SourceVaultId $vaultId -VaultCertificate $cgCertConfig,$ktuCertConfig

The VaultCertificate property accepts an array so try passing all of the certificates at one time.

0
votes

This is possible using the .Add function on the VaultCertificates property, for example:

$vmss = Get-AzVmss -ResourceGroupName $vmssResourceGroupName -VMScaleSetName $vmssName

# Add the certificate to the same collection
$vmss.VirtualMachineProfile.OsProfile.Secrets[0].VaultCertificates.Add($certConfig)

# Update VMSS
Update-AzVmss -ResourceGroupName $vmssResourceGroupName -Verbose -Name $vmssName -VirtualMachineScaleSet $vmss