Question

我在我的Linux（14.04）工作站上安装了Ansible，以及Python（2.7.6），ansible（2.3.0），pywinrm（0.2.1）。我想使用Ansible来配置我的Windows VM。我在Azure中有一个Windows VM（Win2k12r2）。我已打开Azure网络安全组中的所有端口，并且已在Windows防火墙中为WinRM（5985和5986）打开了端口。

我还在我的Windows VM中运行位于https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1的脚本，以确保启用WinRM。

我能够将RDP引入Windows VM，因此我知道它的公共网络接口正在运行。

根据ansible docs（http://docs.ansible.com/ansible/intro_windows.html）我有一个库存文件inventoryories / test1

[windows]
<azure_ip_address>

我有一个文件group_vars / windows.yml

ansible_user: <my_user_id>
ansible_password: <azure_vm_password>
ansible_port: 5986
ansible_connection: winrm
# The following is necessary for Python 2.7.9+ when using default WinRM self-signed certificates:
ansible_winrm_server_cert_validation: ignore
ansible_winrm_scheme: https

当我运行命令时：

ansible windows -i inventories/test1 -m win_ping --ask-vault-pass -vvvvv

我收到以下回复：

No config file found; using defaults
Vault password:
Loading callback plugin minimal of type stdout, v2.0 from /home/jgodse/ansible/lib/ansible/plugins/callback/__init__.pyc
Using module file /home/jgodse/ansible/lib/ansible/modules/core/windows/win_ping.ps1
<azure_vm_ip_address> ESTABLISH SSH CONNECTION FOR USER: None
<azure_vm_ip_address> SSH: ansible.cfg set ssh_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=60s)
<azure_vm_ip_address> SSH: ansible_password/ansible_ssh_pass not set: (-o) (KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)
<azure_vm_ip_address> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)
<azure_vm_ip_address> SSH: PlayContext set ssh_common_args: ()
<azure_vm_ip_address> SSH: PlayContext set ssh_extra_args: ()
<azure_vm_ip_address> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/jgodse/.ansible/cp/ansible-ssh-%h-%p-%r)
<azure_vm_ip_address> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/jgodse/.ansible/cp/ansible-ssh-%h-%p-%r <azure_vm_ip_address> '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477490434.84-228998637685624 `" && echo ansible-tmp-1477490434.84-228998637685624="` echo $HOME/.ansible/tmp/ansible-tmp-1477490434.84-228998637685624 `" ) && sleep 0'"'"''
<azure_vm_ip_address> | UNREACHABLE! => {
    "changed": false,
    "msg": "Failed to connect to the host via ssh: OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: Control socket \"/home/jgodse/.ansible/cp/ansible-ssh-<azure_vm_ip_address>-22-jgodse\" does not exist\r\ndebug2: ssh_connect: needpriv 0\r\ndebug1: Connecting to <azure_vm_ip_address> [<azure_vm_ip_address>] port 22.\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug1: connect to address <azure_vm_ip_address> port 22: Connection timed out\r\nssh: connect to host <azure_vm_ip_address> port 22: Connection timed out\r\n",
    "unreachable": true
}

我尝试按如下方式远程登录到计算机：

$ telnet <azure_vm_ip_address> 5986
Trying <azure_vm_ip_address>...
Connected to <azure_vm_ip_address>.
Escape character is '^]'.

这告诉我telnet工作到5986，因此我的防火墙规则没问题。

我是否必须做一些事情来告诉Ansible我尝试使用WinRM连接到Windows VM？或者我错过了一些东西来帮助我的Ansible工作站通过WinRM连接到我的Windows VM？

Answer 1

事实证明，将连接变量放在group_vars / windows.yml中是行不通的。我完全摆脱了那个文件，编辑了inventoryories / test1，看起来像这样：

[windows]
<azure_ip_address>

[windows:vars]
ansible_user=<my_user_id>
ansible_password=<azure_vm_password>
ansible_port=5986
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore

运行该命令，并且运行win_ping成功运行。

然后我尝试加密库存/ test1，我得到了：

  [WARNING]: No hosts matched, nothing to do

并且win_ping没有运行。

我的猜测是，连接初始化所需的变量必须位于清单文件中，并在加密变量被解密和使用之前读取。

Ansible for Windows：无法通过WinRM

1 个答案: