ansible 剧本有时会失败，但并非总是在 aws ubuntu 20.04 上安装 jre

Question

I have an annoying problem. Sometimes, but not always, this playbook fails. I am using this against an ec2 with ubuntu 20.04.

tasks:
  - name: Update system
    apt:
      update_cache: yes
      force_apt_get: yes
      cache_valid_time: 3600

  - name: Upgrade all apt packages
    apt:
      upgrade: dist
      force_apt_get: yes

    # this failes every now and then
  - name: Ensure jre is installed
    apt:
      name: openjdk-17-jre-headless
      state: present

When it fails, it throws this error.

 fatal: [default]: FAILED! => {"cache_update_time": 1640556142, "cache_updated": false, "changed": false, "msg": "'/usr/bin/apt-get -y -o \"Dpkg::Options::=--force-confdef\" -o \"Dpkg::Options::=--force-confold\"       install 'openjdk-17-jre-headless'' failed: E: Unable to correct problems, you have held broken packages.\n", "rc": 100, "stderr": "E: Unable to correct problems, you have held broken packages.\n", "stderr_lines": ["E: Unable to correct problems, you have held broken packages."], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nSome packages could not be installed. This may mean that you have\nrequested an impossible situation or if you are using the unstable\ndistribution that some required packages have not yet been created\nor been moved out of Incoming.\nThe following information may help to resolve the situation:\n\nThe following packages have unmet dependencies:\n openjdk-17-jre-headless : Depends: ca-certificates-java (>= 20190405~) but it is not installable\n                           Depends: java-common (>= 0.28) but it is not installable\n                           Depends: liblcms2-2 (>= 2.2+git20110628) but it is not installable\n                           Depends: libjpeg8 (>= 8c) but it is not installable\n                           Depends: libfontconfig1 but it is not installable\n                           Depends: libharfbuzz0b (>= 1.2.6) but it is not installable\n                           Depends: libpcsclite1 (>= 1.3.0) but it is not installable\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "Some packages could not be installed. This may mean that you have", "requested an impossible situation or if you are using the unstable", "distribution that some required packages have not yet been created", "or been moved out of Incoming.", "The following information may help to resolve the situation:", "", "The following packages have unmet dependencies:", " openjdk-17-jre-headless : Depends: ca-certificates-java (>= 20190405~) but it is not installable", "                           Depends: java-common (>= 0.28) but it is not installable", "                           Depends: liblcms2-2 (>= 2.2+git20110628) but it is not installable", "                           Depends: libjpeg8 (>= 8c) but it is not installable", "                           Depends: libfontconfig1 but it is not installable", "                           Depends: libharfbuzz0b (>= 1.2.6) but it is not installable", "                           Depends: libpcsclite1 (>= 1.3.0) but it is not installable"]}

I would understand if it always fails, but why just sometimes?

Answer 1

This doesn't look like an Ansible problem, since Ansible simply invokes apt on the system. This situation would also occur when you would execute the same action on the same system, at that time.

When looking at the error:

you have held broken packages

You can google around yourself and look for a fitting solution. When I read further, the error describes:

Building dependency tree...
Reading state information...
Some packages could not be installed. 
This may mean that you have requested an impossible situation 
or if you are using the unstable distribution that some 
required packages have not yet been created or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
openjdk-17-jre-headless : Depends: ca-certificates-java (>= 20190405~) but it is not installable

I would understand if it always fails, but why just sometimes?

It could mean that your previous task, which updates the system, causes a collision with updating other packages due to dependencies.

Why it would fail sometimes is unclear to us. Does it fail on a single system? How often does it fail? Did it fail only after Ansible has run?

What you could do is edit your playbook to first verify whether 'apt-get update' works as it should, without any errors/complaints. Once that is the case, proceed to the next task.