Shared Connection to host Closed on running Ansible playbook as unprivileged user? - ansible

I am using ansible v2.9.2 and recently I am facing issues using the npm ansible module as it is giving me shared connection to host closed errors. I have tried using both python2 and 3 and the results were the same. Below is the doc containing my error and playbook as well please have a look.
link: https://docs.google.com/document/d/1iaNMIjR3EVFYVvSoJEPTmjhSrDsnfZc5VCvUUamdKps/edit?usp=sharing
fatal: [1.0.3.99]: FAILED! => {"changed": false, "module_stderr": "Shared connection to 1.0.3.99 closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n File \"/var/tmp/ansible-tmp-1577345183.7290096-173113890020428/AnsiballZ_npm.py\", line 114, in \r\n _ansiballz_main()\r\n File \"/var/tmp/ansible-tmp-1577345183.7290096-173113890020428/AnsiballZ_npm.py\", line 106, in _ansiballz_main\r\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\r\n File \"/var/tmp/ansible-tmp-1577345183.7290096-173113890020428/AnsiballZ_npm.py\", line 49, in invoke_module\r\n imp.load_module('main', mod, module, MOD_DESC)\r\n File \"/tmp/ansible_npm_payload_6EJdAk/main.py\", line 310, in \r\n File \"/tmp/ansible_npm_payload_6EJdAk/main.py\", line 287, in main\r\n File \"/tmp/ansible_npm_payload_6EJdAk/main.py\", line 200, in list\r\n File \"/usr/lib/python2.7/json/init.py\", line 339, in loads\r\n return _default_decoder.decode(s)\r\n File \"/usr/lib…
Ansible Playbook: 
- hosts: all
  remote_user: abhinav
  become: yes
  tasks:
   - name: npm command
     npm:
     path: /data/codebase/test/api
     executable: /home/test/.nvm/versions/node/v8.15.0/bin/npm
     state: present
     become_user: test
     become: yes

The problem is becoming an unprivileged user
When both the connection user and the become_user are unprivileged, the module file is written as the user that Ansible connects as, but the file needs to be readable by the user Ansible is set to become. In this case, Ansible makes the module file world-readable ... Starting in Ansible 2.1, Ansible defaults to issuing an error if it cannot execute securely with become."
See Ways to resolve this include:
Use pipelining pipelining = true
Install POSIX.1e filesystem acl support on the managed host.
Avoid becoming an unprivileged user.

Related

After upgrading Ansible to 2.9.9 cannot connect to Windows Hosts, hostname has disappeared from Ansible logs

I recently upgraded Ansible from 2.5.3 to 2.9.9. OS is RHEL 7.5, Python 2.7.
Windows module setup.ps1 cannot fetch the host name of target windows host and hence the playbook unable to connect windows VM, after upgrading to Ansible 2.9.9.
before ESTABLISH WINRM connection log statement you can see that
<> is empty. Hence ansible windows connection has stopped working.
Using module file /usr/lib/python2.7/site-packages/ansible/modules/windows/setup.ps1
Pipelining is enabled.
**<>** ESTABLISH WINRM CONNECTION FOR USER: 7771234s_tskSV on PORT 5985 TO
creating Kerberos CC at /tmp/tmpn5jvwl
calling kinit with subprocess for principal 7771234s_tskSV
Using module file /usr/lib/python2.7/site-packages/ansible/modules/windows/setup.ps1
Pipelining is enabled.
<> ESTABLISH WINRM CONNECTION FOR USER: 7771234s_tskSV on PORT 5985 TO
creating Kerberos CC at /tmp/tmp0hJgs1
calling kinit with subprocess for principal 7771234s_tskSV
kinit succeeded for principal 7771234s_tskSV
**<> WINRM CONNECT: transport=kerberos endpoint=http://:5985/wsman
<> WINRM CONNECTION ERROR: Invalid URL u'http://:5985/wsman': No host supplied what to do**
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py", line 415, in _winrm_connect
self.shell_id = protocol.open_shell(codepage=65001) # UTF-8
File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 157, in open_shell
res = self.send_message(xmltodict.unparse(req))
File "/usr/lib/python2.7/site-packages/winrm/protocol.py", line 234, in send_message
resp = self.transport.send_message(message)
File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 243, in send_message
self.build_session()
File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 232, in build_session
self.setup_encryption()
File "/usr/lib/python2.7/site-packages/winrm/transport.py", line 237, in setup_encryption
prepared_request = self.session.prepare_request(request)
File "/usr/lib/python2.7/site-packages/requests/sessions.py", line 437, in prepare_request
hooks=merge_hooks(request.hooks, self.hooks),
File "/usr/lib/python2.7/site-packages/requests/models.py", line 305, in prepare
self.prepare_url(url, params)
File "/usr/lib/python2.7/site-packages/requests/models.py", line 382, in prepare_url
raise InvalidURL("Invalid URL %r: No host supplied what to do" % url)
InvalidURL: Invalid URL u'http://:5985/wsman': No host supplied what to do
Can you please suggest if the setup.ps1 is not up to date?

Using command/shell modules causes: ValueError: Key name may not begin with an underscore on multiple runs

Ansible throws an error on every task which uses the shell or command modules, but not when running for the first time on a new machine.
The process I use is to image a new raspberry pi, and then use ansible to set up the services that I need. Running ansible for the first time works fine, but if I run it again (without changing anything) it fails, saying ValueError: Key name may not begin with an underscore
Here is an example of a task that throws an error. Running /usr/local/bin/pigpiod -v on the remote machine works as expected/
- name: see if pigpiod is the correct version
command: "/usr/local/bin/pigpiod -v"
register: pigpiod_version
Here is the error:
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: Key name may not begin with an underscore
fatal: [issacs_box]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n File \"<stdin>\", line 113, in <module>\n File \"<stdin>\", line 105, in _ansiballz_main\n File \"<stdin>\", line 48, in invoke_module\n File \"/usr/lib/python3.5/imp.py\", line 234, in load_module\n return load_source(name, filename, file)\n File \"/usr/lib/python3.5/imp.py\", line 170, in load_source\n module = _exec(spec, sys.modules[name])\n File \"<frozen importlib._bootstrap>\", line 626, in _exec\n File \"<frozen importlib._bootstrap_external>\", line 673, in exec_module\n File \"<frozen importlib._bootstrap>\", line 222, in _call_with_frames_removed\n File \"/tmp/ansible_command_payload_hc3z4iej/__main__.py\", line 292, in <module>\n File \"/tmp/ansible_command_payload_hc3z4iej/__main__.py\", line 199, in main\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 901, in __init__\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 2243, in _log_invocation\n File \"/tmp/ansible_command_payload_hc3z4iej/ansible_command_payload.zip/ansible/module_utils/basic.py\", line 2201, in log\n File \"systemd/_journal.pyx\", line 68, in systemd._journal.send\n File \"systemd/_journal.pyx\", line 32, in systemd._journal._send\nValueError: Key name may not begin with an underscore\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}
I had the wrong PYPI package installed. Coincidentally, there is a package called systemd (version 0.16.1) which is different from the official systemd-python (version 234) package. Running pip3 uninstall systemd and then pip3 install systemd-python --user solved the problem.
Seems like a weird Ansible bug. What version are you using? Can you try to downgrade and/or upgrade a version. If that would fix this error, please notify the Ansible developers and create an issue at their repo.
Else, try to update and/or downgrade your Python version. It could be that something is wrong with this file /usr/lib/python3.5/imp.py

Ansible: error when deploying playbooks in parallel

i am setting up a kubernetes cluster with ansible.
This is running fine.
Now i usually have 2 or 3 clusters i can test different things with.
Often it happens at some point in time that the cluster/server gots broken. If that happens, i usually recreate the servers and start the playbook again. because this takes some time, i want to be able to run 2 or more playbooks in parallel.
But every time i do this, i get the following error:
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: FileNotFoundError: [Errno 2] No such file or directory
I run my playbook like this:
"$ansible_playbook"
-i "${ANSIBLE_HOSTS}"
"${ANSIBLE_YML}"
--flush-cache
--user root
--become
--become-user root
--ask-sudo-pass
What could be the reason for the error?
I can imagine, that ansible creates some files in the background, used by the different playbooks. But which files could that be?
thx in advance!
Update more detailed error log (-vvv)
ansible-playbook 2.7.8
config file = /home/mod/cod/wo/thingylabs/kubernetes-provisioning/playbooks/test1/ansible.cfg
configured module search path = ['/home/mod/cod/wo/thingylabs/kubernetes-provisioning/vendors/kubespray/library']
ansible python module location = /usr/lib/python3.7/site-packages/ansible
executable location = /usr/bin/ansible-playbook
python version = 3.7.2 (default, Jan 10 2019, 23:51:51) [GCC 8.2.1 20181127]
Using /home/mod/cod/wo/thingylabs/kubernetes-provisioning/playbooks/test1/ansible.cfg as config file
SUDO password:
ERROR! Unexpected Exception, this is probably a bug: [Errno 2] No such file or directory
the full traceback was:
Traceback (most recent call last):
File "/usr/bin/ansible-playbook",
exit_code = cli.run()
File "/usr/lib/python3.7/site-packages/ansible/cli/playbook.py", line 104, in run
loader, inventory, variable_manager = self._play_prereqs(self.options)
File "/usr/lib/python3.7/site-packages/ansible/cli/__init__.py", line 786, in _play_prereqs
inventory = InventoryManager(loader=loader, sources=options.inventory)
File "/usr/lib/python3.7/site-packages/ansible/inventory/manager.py", line 148, in __init__
self.parse_sources(cache=True)
File "/usr/lib/python3.7/site-packages/ansible/inventory/manager.py", line 207, in parse_sources
source = unfrackpath(source, follow=False)
File "/usr/lib/python3.7/site-packages/ansible/utils/path.py", line 47, in unfrackpath
basedir = op.getcwd()
FileNotFoundError: [Errno 2] No such file or directory

Adding a PPA using Ansible fails

I'm using Ansible 2.2.0 to provision a Ubuntu 16.04 server, but it keeps failing at the step where I'm adding a new apt repository:
fatal: [the.server.ip.address]: FAILED! => {"changed": false, "failed": true, "module_stderr": "", "module_stdout": "Traceback (most recent call last):\r\n File \"/tmp/ansible_pctla3gj/ansible_module_apt_repository.py\", line 528, in <module>\r\n main()\r\n File \"/tmp/ansible_pctla3gj/ansible_module_apt_repository.py\", line 492, in main\r\n sourceslist.add_source(repo)\r\n File \"/tmp/ansible_pctla3gj/ansible_module_apt_repository.py\", line 403, in add_source\r\n info = self._get_ppa_info(ppa_owner, ppa_name)\r\n File \"/tmp/ansible_pctla3gj/ansible_module_apt_repository.py\", line 377, in _get_ppa_info\r\n return json.load(response)\r\n File \"/usr/lib/python3.5/json/__init__.py\", line 268, in load\r\n parse_constant=parse_constant, object_pairs_hook=object_pairs_hook, **kw)\r\n File \"/usr/lib/python3.5/json/__init__.py\", line 312, in loads\r\n s.__class__.__name__))\r\nTypeError: the JSON object must be str, not 'bytes'\r\n", "msg": "MODULE FAILURE"}
I have the following in my playbook:
- name: add the ffmpeg PPA
apt_repository:
repo: 'ppa:jonathonf/ffmpeg-3'
The docs seemed pretty straightforward, so I'm not sure what the problem is here. I tried adding it manually (sudo add-apt-repository ppa:jonathonf/ffmpeg-3) and it worked just fine.
Found this answer which had a different error, but the answer worked; add become: yes to the task and it will work.

Ansible ldap_entry module failing with "Bad parameter to an ldap routine"

I've been successfully using the custom psagers/ansible-ldap module for a while now. Just recently, though, I started running into a problem with it that I can't seem to get past. Anyone know what might cause the following error?
TASK [ldap-server : ldap_entry] ************************************************
fatal: [52.90.82.65]: FAILED! => {"changed": false, "exc": "Traceback (most recent call last):\n File \"/tmp/ansible_arqhOa/ansible_module_ldap_entry.py\", line 133, in main\n LdapEntry(module).main()\n File \"/tmp/ansible_arqhOa/ansible_module_ldap_entry.py\", line 194, in main\n action()\n File \"/tmp/ansible_arqhOa/ansible_module_ldap_entry.py\", line 206, in \n action = lambda: self.connection.add_s(self.dn, modlist)\n File \"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py\", line 194, in add_s\n msgid = self.add(dn,modlist)\n File \"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py\", line 191, in add\n return self.add_ext(dn,modlist,None,None)\n File \"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py\", line 176, in add_ext\n return self._ldap_call(self._l.add_ext,dn,modlist,RequestControlTuples(serverctrls),RequestControlTuples(clientctrls))\n File \"/usr/lib/python2.7/dist-packages/ldap/ldapobject.py\", line 99, in _ldap_call\n result = func(*args,**kwargs)\nPARAM_ERROR: {'matched': 'dc=hhsdevcloud,dc=us', 'desc': 'Bad parameter to an ldap routine'}\n", "failed": true, "msg": "{'matched': 'dc=hhsdevcloud,dc=us', 'desc': 'Bad parameter to an ldap routine'}"}
Seems to be related to moving from Ansible 2.0.1.0 to 2.2.0.0. It's coming from this Ansible task, which hasn't changed (and was working before the Ansible version bump):
- ldap_entry:
bind_dn: 'cn=admin,dc=hhsdevcloud,dc=us'
bind_pw: "{{ ldap_root_password }}"
dn: 'ou=people,dc=hhsdevcloud,dc=us'
objectClass: ['organizationalUnit']
If I had to guess, it's related to how this module handles args (e.g. objectClass isn't defined as a module arg, yet the module is designed to find it and use it). Did Ansible change how module args are handled recently?
Figured it out and fixed it -- it was just a bug with the Ansible module. The module was passing some objects of the wrong type to the python-ldap library that does most of the heavy lifting (but only with Ansible 2.2, for some reason).
I fixed it in my fork of the library here: https://github.com/karlmdavis/ansible-role-ldap.
As an added bonus, that fork now has actual test coverage for the module (courtesy Travis CI).

Resources