Ansible 可以从 localhost 连接到 windows 机器，但不能从 docker 容器连接

Question

I can successfully ping windows host using Ansible from my localhost terminal but when trying this via a docker container, it fails with the following message:

flask    | fatal: [eudc2.dea.com]: UNREACHABLE! => {"changed": false, "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fbc16d50550>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))", "unreachable": true}

However, when pinged via localhost:

~/Documents/Projects/user oam !5 ?6 ❯ ansible dc -m win_ping                                                                                                     
eudc2.dea.com | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

I would say this means the problem is in the docker container so that's the dockerfile:

FROM python
WORKDIR /app
ADD . /app
RUN pip3 install --upgrade pip
RUN pip3 install flask uwsgi requests ansible ansible_runner pywinrm
RUN apt-get update -y && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    sshpass

CMD ["uwsgi","app.ini"]

This is the hostvars:

[dc]
eudc2.dea.com 

[dc:vars]
ansible_user='username'
ansible_password='pass'
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_winrm_port=5985
ansible_winrm_transport=basic

Detailed output of win_ping from docker container:

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask ansible -i /app/ansible/inventory/hosts dc -m win_ping -vvvv                        ✘ INT
ansible 2.10.2
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.9.0 (default, Oct 13 2020, 20:14:06) [GCC 8.3.0]
No config file found; using defaults
setting up inventory plugins
host_list declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
script declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
auto declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
Set default localhost to localhost
Parsed /app/ansible/inventory/hosts inventory source with ini plugin
Loading callback plugin minimal of type stdout, v2.0 from /usr/local/lib/python3.9/site-packages/ansible/plugins/callback/minimal.py
META: ran handlers
redirecting (type: modules) ansible.builtin.win_ping to ansible.windows.win_ping
Loading collection ansible.windows from /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows
Using module file /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows/plugins/modules/win_ping.ps1
Pipelining is enabled.
<eudc2.dea.com> ESTABLISH WINRM CONNECTION FOR USER: <username_truncated> on PORT 5985 TO eudc2.dea.com
eudc2.ictv.com | UNREACHABLE! => {
    "changed": false,
    "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f628ecd08e0>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))",
    "unreachable": true
}

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask curl eudc2.dea.com                                                                 ✘ INT
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:16 --:--:--     0

Answer 1

It's interesting that the curl run from within the container took 16 seconds to complete. That looks a long time.

Ansible's WinRM timeout is 20 seconds for operations:

https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html

Some suggestions:

• Run a few curl request from within and outside the container (I'm considering the container is running on the same box as what you're calling localhost); compare the times to see they differ substantially
• Run win_ping multiple times from both container and localhost; does container ever work or localhost ever fails?; time the runs ( time ansible dc -m win_ping )
• Change the configurations ansible_winrm_operation_timeout_sec and ansible_winrm_read_timeout_sec mentioned on the link above, and see if that helps