我正在编写一部剧本，以通过互联网网关部署VPC。由于某些原因，Ansible模块无法找到网关。此模块上的documentation稀疏，示例不完整。
可疑位：
- name: Create default VPC
ec2_vpc_net:
name: acme_baseline
cidr_block: 10.11.0.0/16
region: us-east-1
state: present
tags:
Owner: "someuser"
register: baseline_vpc
- name: Create internet gateway
ec2_vpc_igw:
vpc_id: "{{ baseline_vpc.vpc.id }}"
region: us-east-1
state: present
tags:
Name: "acme_baseline"
Owner: "someuser"
register: baseline_igw
直接AWS CLI找不到VPC的问题：
# aws ec2 describe-vpcs --vpc-ids vpc-0123546897 --region us-east-1
{
"Vpcs": [
{
"IsDefault": false,
"Tags": [
{
"Value": "acme_baseline",
"Key": "Name"
},
{
"Value": "someuser",
"Key": "Owner"
}
],
"CidrBlockAssociationSet": [
{
"CidrBlock": "10.11.0.0/16",
"CidrBlockState": {
"State": "associated"
},
"AssociationId": "vpc-cidr-assoc-00001444444"
}
],
"VpcId": "vpc-0123546897",
"CidrBlock": "10.11.0.0/16",
"State": "available",
"DhcpOptionsId": "dopt-aaaaaaa",
"OwnerId": "000000000000",
"InstanceTenancy": "default"
}
]
}
两个Ansible块的输出（详细模式x3）：
ansible-playbook 2.7.9
config file = None
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible-playbook
python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
TASK [aws-baseline : Create default VPC] ***************************************************************************************************************************************
task path: /root/foo/roles/aws-baseline/tasks/main.yml:26
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: root
<localhost> EXEC /bin/sh -c 'echo ~root && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz `" && echo ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz="` echo /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz `" ) && sleep 0'
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/ec2_vpc_net.py
<localhost> PUT /root/.ansible/tmp/ansible-local-14593RSX_GI/tmpMcth9v TO /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py
<localhost> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/ /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/ > /dev/null 2>&1 && sleep 0'
ok: [localhost] => {
"changed": false,
"invocation": {
"module_args": {
"aws_access_key": null,
"aws_secret_key": null,
"cidr_block": [
"10.11.0.0/16"
],
"dhcp_opts_id": null,
"dns_hostnames": true,
"dns_support": true,
"ec2_url": null,
"multi_ok": false,
"name": "acme_baseline",
"profile": null,
"purge_cidrs": false,
"region": "us-east-1",
"security_token": null,
"state": "present",
"tags": {
"Name": "acme_baseline",
"Owner": "someuser"
},
"tenancy": "default",
"validate_certs": true
}
},
"vpc": {
"cidr_block": "10.11.0.0/16",
"cidr_block_association_set": [
{
"association_id": "vpc-cidr-assoc-00001444444",
"cidr_block": "10.11.0.0/16",
"cidr_block_state": {
"state": "associated"
}
}
],
"classic_link_enabled": false,
"dhcp_options_id": "dopt-aaaaaaa",
"id": "vpc-0123546897",
"instance_tenancy": "default",
"is_default": false,
"owner_id": "000000000000",
"state": "available",
"tags": {
"Name": "acme_baseline",
"Owner": "someuser"
}
}
}
TASK [aws-baseline : Create internet gateway] **********************************************************************************************************************************
task path: /root/foo/roles/aws-baseline/tasks/main.yml:37
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: root
<localhost> EXEC /bin/sh -c 'echo ~root && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx `" && echo ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx="` echo /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx `" ) && sleep 0'
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/ec2_vpc_igw.py
<localhost> PUT /root/.ansible/tmp/ansible-local-14593RSX_GI/tmp1Ttirp TO /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py
<localhost> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/ /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
WARNING: The below traceback may *not* be related to the actual failure.
File "/tmp/ansible_ec2_vpc_igw_payload_o6xIsP/__main__.py", line 244, in main
result = ensure_igw_present(connection, vpc_id, tags, check_mode=module.check_mode)
File "/tmp/ansible_ec2_vpc_igw_payload_o6xIsP/__main__.py", line 184, in ensure_igw_present
'Unable to create Internet Gateway, error: {0}'.format(e))
fatal: [localhost]: FAILED! => {
"changed": false,
"invocation": {
"module_args": {
"aws_access_key": null,
"aws_secret_key": null,
"ec2_url": null,
"profile": null,
"region": "us-east-1",
"security_token": null,
"state": "present",
"tags": {
"Name": "acme_baseline",
"Owner": "someuser"
},
"validate_certs": true,
"vpc_id": "vpc-0123546897"
}
},
"msg": "Unable to create Internet Gateway, error: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidVpcID.NotFound</Code><Message>The vpc ID 'vpc-0123546897' does not exist</Message></Error></Errors><RequestID>111111111-22222222-33333</RequestID></Response>"
}
答案 0 :(得分：0)
I copy pasted your code, and it worked for me (Ansible 2.7.10)
Judging by the error, you were a victim of eventual consistency on the AWS side.
The solution would be to wait a bit between each step.
However, I strongly advise not to use Ansible for this. Use any infrastructure-as-code tool for the bare-bones infra provisioning in AWS. Tools like CloudFormation, Terraform, or the new CDK from AWS (still in development).
I speak from personal experience. You want the core cloud infra to be deployed with IaC, and more dynamic things (instances, etc) with some other configuration management tool like Ansible.
答案 1 :(得分：0)
我升级到Ansible 2.7.10，以查看它是否适用于Kaurin。不幸的是，我仍然遇到同样的问题。但是我确实偶然发现了一个错误。
在我的场景中，我使用的是存储在〜/ .aws / credentials中的凭据。我有几个配置文件设置，并且我使用sts-assume-role在子帐户之间跳转。到目前为止，这对于所有Ansible AWS模块都没有问题，但是ec2_vpc_igw模块无法识别这一点。它在源帐户而不是子帐户中配置Internet网关（IGW）。一旦部署了IGW，它就无法将其与确定的VPC相关联，因为它不在子帐户中。
我要向维护者提交错误报告。
更新-这是already documented。 底线-这个Ansible模块使用boto，而不是boto3。因此，它不尊重与其他模块一起使用的配置文件。