Automation Assembler 中的網路、安全群組和負載平衡器資源範例

可以在 Automation Assembler 雲端範本中使用網路、安全性和負載平衡器資源與設定。

如需雲端範本代碼選項的摘要，請參閱〈vRealize Automation 資源類型架構〉。

如需相關資訊，請參閱：

這些範例說明了基本雲端範本設計中的網路、安全和負載平衡器資源。

網路


資源案例	範例雲端範本設計代碼
vSphere 機器具有多個 NIC，且這些 NIC 連線到指派了 DHCP IP 的 vSphere 網路和 NSX 網路	resources: demo-machine: type: Cloud.vSphere.Machine properties: image: ubuntu flavor: small networks: - network: ${resource["demo-vSphere-Network"].id} deviceIndex: 0 - network: ${resource["demo-NSX-Network"].id} deviceIndex: 1 demo-vSphere-Network: type: Cloud.vSphere.Network properties: networkType: existing demo-NSX-Network: type: Cloud.NSX.Network properties: networkType: outbound
使用 `vlanIds` 內容指定包含 3 個 VLAN (123、456 和 7) 的陣列的 NSX 私人網路	formatVersion: 1 inputs: {} resources: Cloud_Machine_1: type: Cloud.Machine properties: image: test flavor: test networks: - network: '${resource.Cloud_NSX_Network_1.id}' Cloud_NSX_Network_1: type: Cloud.NSX.Network properties: networkType: private vlanIds: - 123 - 456 - 7
為 Azure 虛擬機器部署新增具有靜態 IP 位址的私人網路	formatVersion: 1 inputs: {} resources: Cloud_Azure_Machine_1: type: Cloud.Machine properties: image: photon flavor: Standard_B1ls networks: - network: '${resource.Cloud_Network_1.id}' assignment: static address: 10.0.0.45 assignPublicIpAddress: false Cloud_Network_1: type: Cloud.Network properties: networkType: existing
可以將靜態 IP 指派與 VMware Aria Automation IPAM (隨 VMware Aria Automation 提供的內部 IPAM，或以 VMware Aria Automation IPAM SDK 為基礎的外部 IPAM，例如，VMware Marketplace 中提供的 Infloblox 外掛程式之一的 IPAM) 搭配使用。不支援 `assignment: static` 的其他用途，如有關 VMware Aria Automation 雲端範本中的網路資源的詳細資訊的〈注意須知〉部分中所述。	resources: demo_vm: type: Cloud.vSphere.Machine properties: image: 'photon' cpuCount: 1 totalMemoryMB: 1024 networks: - network: ${resource.demo_nw.id} assignment: static demo_nw: type: Cloud.vSphere.Network properties: networkType: existing
在現有部署的 `Cloud.NSX.NAT` 資源中新增或編輯 NAT 和 DNAT 連接埠轉送規則。	resources: gw: type: Cloud.NSX.Gateway properties: networks: - ${resource.akout.id} nat: type: Cloud.NSX.Nat properties: networks: - ${resource.akout.id} natRules: - translatedInstance: ${resource.centos.networks[0].id} index: 0 protocol: TCP kind: NAT44 type: DNAT sourceIPs: any sourcePorts: 80 translatedPorts: 8080 destinationPorts: 8080 description: edit - translatedInstance: ${resource.centos.networks[0].id} index: 1 protocol: TCP kind: NAT44 type: DNAT sourceIPs: any sourcePorts: 90 translatedPorts: 9090 destinationPorts: 9090 description: add gateway: ${resource.gw.id} centos: type: Cloud.vSphere.Machine properties: image: WebTinyCentOS65x86 flavor: small customizationSpec: Linux networks: - network: ${resource.akout.id} assignment: static akout: type: Cloud.NSX.Network properties: networkType: outbound constraints: - tag: nsxt-nat-1-M2
使用內部 IP 而非公用 IP 的公有雲機器。此範例使用特定的網路識別碼。附註：`network:` 選項在 `networks:` 設定中用來指定目標網路識別碼。`networks:` 設定中的 `name:` 選項已被取代，因此不應使用。	resources: wf_proxy: type: Cloud.Machine properties: image: ubuntu 16.04 flavor: small constraints: - tag: 'platform:vsphere' networks: - network: '${resource.wf_net.id}' assignPublicIpAddress: false
使用 NSX 網路資源類型的路由網路。	Cloud_NSX_Network_1: type: Cloud.NSX.Network properties: networkType: routed
將標籤新增至雲端範本中的機器 NIC 資源。	formatVersion: 1 inputs: {} resources: Cloud_Machine_1: type: Cloud.vSphere.Machine properties: flavor: small image: ubuntu networks: - name: '${resource.Cloud_Network_1.name}' deviceIndex: 0 tags: - key: 'nic0' value: null - key: internal value: true - name: '${resource.Cloud_Network_2.name}' deviceIndex: 1 tags: - key: 'nic1' value: null - key: internal value: false
為輸出網路標記 NSX-T 邏輯交換器。 NSX-T 和 VMware Cloud on AWS 支援標記。如需有關此案例的詳細資訊，請參閱社群部落格文章在 NSX 中建立標籤。	Cloud_NSX_Network_1: type: Cloud.NSX.Network properties: networkType: outbound tags: - key: app value: opencart

安全群組

資源案例範例雲端範本設計代碼

資源案例	範例雲端範本設計代碼
已將限制標籤套用至機器 NIC 的現有安全群組。若要使用現有的安全群組，請為 securityGroupType 內容輸入 `existing`。您可以使用標籤限制將標籤指派給 Cloud.SecurityGroup 資源，以配置現有的安全群組。不含標籤的安全群組無法在雲端範本設計中使用。必須為 `securityGroupType: existing` 安全群組資源設定限制標籤。這些限制必須與現有安全群組上設定的標籤相符。無法為 `securityGroupType: new` 安全群組資源設定限制標籤。	formatVersion: 1 inputs: {} resources: allowSsh_sg: type: Cloud.SecurityGroup properties: securityGroupType: existing constraints: - tag: allowSsh compute: type: Cloud.Machine properties: image: centos flavor: small networks: - network: '${resource.prod-net.id}' securityGroups: - '${resource.allowSsh_sg.id}' prod-net: type: Cloud.Network properties: networkType: existing
具有兩個防火牆規則的隨選安全群組，用於說明 `Allow` 和 `Deny` 存取選項。	resources: Cloud_SecurityGroup_1: type: Cloud.SecurityGroup properties: securityGroupType: new rules: - ports: 5000 source: 'fc00:10:`000`:`000`:`000`:56ff:fe89:48b4' access: Allow direction: inbound name: allow_5000 protocol: TCP - ports: 7000 source: 'fc00:10:`000`:`000`:`000`:56ff:fe89:48b4' access: Deny direction: inbound name: deny_7000 protocol: TCP Cloud_vSphere_Machine_1: type: Cloud.vSphere.Machine properties: image: photon cpuCount: 1 totalMemoryMB: 256 networks: - network: '${resource.Cloud_Network_1.id}' assignIPv6Address: true assignment: static securityGroups: - '${resource.Cloud_SecurityGroup_1.id}' Cloud_Network_1: type: Cloud.Network properties: networkType: existing
具有 2 個安全群組的複雜雲端範本，其中包括： 1 個現有安全群組 1 個隨選安全群組 (包含多個防火牆規則範例) 1 部 vSphere 機器 1 個現有網路此範例說明了以下內容的各種不同組合：通訊協定和連接埠、服務、IP CIDR (作為來源和目的地)、IP 範圍 (作為來源或目的地)，以及任何、IPv6 和 (::/0) 選項。對於機器 NIC，您可以指定已連線的網路和安全群組。您也可以指定 NIC 索引或 IP 位址。	formatVersion: 1 inputs: {} resources: DEMO_ESG : existing security group - security group 1) type: Cloud.SecurityGroup properties: constraints: - tag: BlockAll securityGroupType: existing (designation of existing for security group 1) DEMO_ODSG: (on-demand security group - security group 2)) type: Cloud.SecurityGroup properties: rules: (multiple firewall rules in this section) - name: IN-ANY (rule 1) source: any service: any direction: inbound access: Deny - name: IN-SSH (rule 2) source: any service: SSH direction: inbound access: Allow - name: IN-SSH-IP (rule 3) source: 33.33.33.1-33.33.33.250 protocol: TCP ports: 223 direction: inbound access: Allow - name: IPv-6-ANY-SOURCE (rule 4) source: '::/0' protocol: TCP ports: 223 direction: inbound access: Allow - name: IN-SSH-IP (rule 5) source: 44.44.44.1/24 protocol: UDP ports: 22-25 direction: inbound access: Allow - name: IN-EXISTING-SG (rule 6) source: '${resource["DEMO_ESG"].id}' protocol: ICMPv6 direction: inbound access: Allow - name: OUT-ANY (rule 7) destination: any service: any direction: outbound access: Deny - name: OUT-TCP-IPv6 (rule 8) destination: '2001:0db8:85a3::8a2e:0370:7334/64' protocol: TCP ports: 22 direction: outbound access: Allow - name: IPv6-ANY-DESTINATION (rule 9) destination: '::/0' protocol: UDP ports: 23 direction: outbound access: Allow - name: OUT-UDP-SERVICE (rule 10) destination: any service: NTP direction: outbound access: Allow securityGroupType: new (designation of on-demand for security group 2) DEMO_VC_MACHINE: (machine resource) type: Cloud.vSphere.Machine properties: image: PHOTON cpuCount: 1 totalMemoryMB: 1024 networks: (Machine network NICs) - network: '${resource.DEMO_NW.id}' securityGroups: - '${resource.DEMO_ODSG.id}' - '${resource.DEMO_ESG.id}' DEMO_NETWORK: (network resource) type: Cloud.vSphere.Network properties: networkType: existing constraints: - tag: nsx62

已將限制標籤套用至機器 NIC 的現有安全群組。

若要使用現有的安全群組，請為 securityGroupType 內容輸入 existing。

您可以使用標籤限制將標籤指派給 Cloud.SecurityGroup 資源，以配置現有的安全群組。不含標籤的安全群組無法在雲端範本設計中使用。

必須為 securityGroupType: existing 安全群組資源設定限制標籤。這些限制必須與現有安全群組上設定的標籤相符。無法為 securityGroupType: new 安全群組資源設定限制標籤。

formatVersion: 1
inputs: {}
resources:
  allowSsh_sg:
    type: Cloud.SecurityGroup
    properties:
      securityGroupType: existing
      constraints:
        - tag: allowSsh
  compute:
    type: Cloud.Machine
    properties:
      image: centos
      flavor: small
      networks:
        - network: '${resource.prod-net.id}'
          securityGroups:
            - '${resource.allowSsh_sg.id}'
  prod-net:
    type: Cloud.Network
    properties:
      networkType: existing

具有兩個防火牆規則的隨選安全群組，用於說明 Allow 和 Deny 存取選項。

resources:
  Cloud_SecurityGroup_1:
    type: Cloud.SecurityGroup
    properties:
      securityGroupType: new
      rules:
        - ports: 5000
          source: 'fc00:10:000:000:000:56ff:fe89:48b4'
          access: Allow
          direction: inbound
          name: allow_5000
          protocol: TCP
        - ports: 7000
          source: 'fc00:10:000:000:000:56ff:fe89:48b4'
          access: Deny
          direction: inbound
          name: deny_7000
          protocol: TCP
  Cloud_vSphere_Machine_1:
    type: Cloud.vSphere.Machine
    properties:
      image: photon
      cpuCount: 1
      totalMemoryMB: 256
      networks:
        - network: '${resource.Cloud_Network_1.id}'
          assignIPv6Address: true
          assignment: static
          securityGroups:
            - '${resource.Cloud_SecurityGroup_1.id}'
  Cloud_Network_1:
    type: Cloud.Network
    properties:
      networkType: existing

具有 2 個安全群組的複雜雲端範本，其中包括：

1 個現有安全群組
1 個隨選安全群組 (包含多個防火牆規則範例)
1 部 vSphere 機器
1 個現有網路

此範例說明了以下內容的各種不同組合：通訊協定和連接埠、服務、IP CIDR (作為來源和目的地)、IP 範圍 (作為來源或目的地)，以及任何、IPv6 和 (::/0) 選項。

對於機器 NIC，您可以指定已連線的網路和安全群組。您也可以指定 NIC 索引或 IP 位址。

formatVersion: 1
inputs: {}
resources:
  DEMO_ESG : existing security group - security group 1)
    type: Cloud.SecurityGroup
    properties:
      constraints:
        - tag: BlockAll
      securityGroupType: existing (designation of existing for security group 1) 
  DEMO_ODSG: (on-demand security group - security group 2))
    type: Cloud.SecurityGroup
    properties:
      rules: (multiple firewall rules in this section)
        - name: IN-ANY (rule 1)
          source: any
          service: any
          direction: inbound
          access: Deny
        - name: IN-SSH (rule 2)
          source: any
          service: SSH
          direction: inbound
          access: Allow
        - name: IN-SSH-IP (rule 3)
          source: 33.33.33.1-33.33.33.250
          protocol: TCP
          ports: 223
          direction: inbound
          access: Allow
        - name: IPv-6-ANY-SOURCE (rule 4)
          source: '::/0'
          protocol: TCP
          ports: 223
          direction: inbound
          access: Allow
        - name: IN-SSH-IP (rule 5)
          source: 44.44.44.1/24
          protocol: UDP
          ports: 22-25
          direction: inbound
          access: Allow
        - name: IN-EXISTING-SG (rule 6)
          source: '${resource["DEMO_ESG"].id}'
          protocol: ICMPv6
          direction: inbound
          access: Allow
        - name: OUT-ANY (rule 7)
          destination: any
          service: any
          direction: outbound
          access: Deny
        - name: OUT-TCP-IPv6 (rule 8)
          destination: '2001:0db8:85a3::8a2e:0370:7334/64'
          protocol: TCP
          ports: 22
          direction: outbound
          access: Allow
        - name: IPv6-ANY-DESTINATION (rule 9)
          destination: '::/0'
          protocol: UDP
          ports: 23
          direction: outbound
          access: Allow
        - name: OUT-UDP-SERVICE (rule 10)
          destination: any
          service: NTP
          direction: outbound
          access: Allow
      securityGroupType: new (designation of on-demand for security group 2)
  DEMO_VC_MACHINE: (machine resource)
    type: Cloud.vSphere.Machine 
    properties:
      image: PHOTON
      cpuCount: 1
      totalMemoryMB: 1024
      networks: (Machine network NICs)
        - network: '${resource.DEMO_NW.id}'
          securityGroups:
            - '${resource.DEMO_ODSG.id}'
            - '${resource.DEMO_ESG.id}'
  DEMO_NETWORK: (network resource)
    type: Cloud.vSphere.Network
    properties:
      networkType: existing
      constraints:
        - tag: nsx62

負載平衡器


資源案例	範例雲端範本設計代碼
指定負載平衡器記錄層級、演算法和大小。	顯示使用記錄層級、演算法和大小的 NSX 負載平衡器範例： resources: Cloud_LoadBalancer_1: type: Cloud.NSX.LoadBalancer properties: name: myapp-lb network: '${appnet-public.name}' instances: '${wordpress.id}' routes: - protocol: HTTP port: '80' loggingLevel: CRITICAL algorithm: LEAST_CONNECTION type: MEDIUM
將負載平衡器與具名機器或具名機器 NIC 相關聯。您可以指定 `machine ID` 或 `machine network ID`，以將機器新增至負載平衡器集區。執行個體內容同時支援機器 (`machine by ID`) 和 NIC (`machine by network ID`)。在第一個範例中，在任何網路上部署機器時，部署會使用 `machine by ID` 設定對該機器進行負載平衡。在第二個範例中，只有在具名機器 NIC 上部署機器時，部署才會使用 `machine by network ID` 設定對該機器進行負載平衡。第三個範例顯示了相同 `instances` 選項中使用的兩個設定。	您可以使用 `instances` 內容來定義機器識別碼或機器網路識別碼：機器識別碼 Cloud_LoadBalancer_1: type: Cloud.LoadBalancer properties: network: '${resource.Cloud_Network_1.id}' instances: '${resource.Cloud_Machine_1.id}' 機器網路識別碼 Cloud_LoadBalancer_1: type: Cloud.LoadBalancer properties: network: '${resource.Cloud_Network_1.id}' instances: '${resource.Cloud_Machine_1.networks[0].id}' 為負載平衡器包含指定一個機器，以及為負載平衡器包含指定另一個機器 NIC： instances: - resource.Cloud_Machine_1.id - resource.Cloud_Machine_2.networks[2].id
將健全狀況檢查設定新增至 NSX 負載平衡器。其他選項包括 `httpMethod`、`requestBody` 和 `responseBody`。	myapp-lb: type: Cloud.NSX.LoadBalancer properties: name: myapp-lb network: '${appnet-public.name}' instances: '${wordpress.id}' routes: - protocol: HTTP port: '80' algorithm: ROUND_ROBIN instanceProtocol: HTTP instancePort: '80' healthCheckConfiguration: protocol: HTTP port: '80' urlPath: /mywordpresssite/wp-admin/install.php intervalSeconds: 60 timeoutSeconds: 10 unhealthyThreshold: 10 healthyThreshold: 2 connectionLimit: '50' connectionRateLimit: '50' maxConnections: '500' minConnections: '' internetFacing: true{code}
具有單肩負載平衡器的隨選網路。	inputs: {} resources: mp-existing: type: Cloud.Network properties: name: mp-existing networkType: existing mp-wordpress: type: Cloud.vSphere.Machine properties: name: wordpress count: 2 flavor: small image: tiny customizationSpec: Linux networks: - network: '${resource["mp-private"].id}' mp-private: type: Cloud.NSX.Network properties: name: mp-private networkType: private constraints: - tag: nsxt mp-wordpress-lb: type: Cloud.LoadBalancer properties: name: wordpress-lb internetFacing: false network: '${resource.mp-existing.id}' instances: '${resource["mp-wordpress"].id}' routes: - protocol: HTTP port: '80' instanceProtocol: HTTP instancePort: '80' healthCheckConfiguration: protocol: HTTP port: '80' urlPath: /index.pl intervalSeconds: 60 timeoutSeconds: 30 unhealthyThreshold: 5 healthyThreshold: 2
具有負載平衡器的現有網路。	formatVersion: 1 inputs: count: type: integer default: 1 resources: ubuntu-vm: type: Cloud.Machine properties: name: ubuntu flavor: small image: tiny count: '${input.count}' networks: - network: '${resource.Cloud_NSX_Network_1.id}' Provider_LoadBalancer_1: type: Cloud.LoadBalancer properties: name: OC-LB routes: - protocol: HTTP port: '80' instanceProtocol: HTTP instancePort: '80' healthCheckConfiguration: protocol: HTTP port: '80' urlPath: /index.html intervalSeconds: 60 timeoutSeconds: 5 unhealthyThreshold: 5 healthyThreshold: 2 network: '${resource.Cloud_NSX_Network_1.id}' internetFacing: false instances: '${resource["ubuntu-vm"].id}' Cloud_NSX_Network_1: type: Cloud.NSX.Network properties: networkType: existing constraints: - tag: nsxt24prod

深入瞭解

如需相關資訊，請參閱以下 VMware 部落格：

負載平衡器與 NSX-T 搭配使用深入探究
使用 NSX 實現網路自動化 – 第 1 部分 (包括使用 NSX-T 和 vCenter 雲端帳戶與網路 CIDR)
使用 NSX 實現網路自動化 – 第 2 部分 (包括使用現有和輸出網路類型)
使用 NSX 實現網路自動化 – 第 3 部分 (包括使用現有和隨選安全群組)
使用 NSX 實現網路自動化 – 第 4 部分 (包括使用現有和隨選負載平衡器)