Ansible 可以从 localhost 连接到 windows 机器，但不能从 docker 容器连接

Question

我可以从我的本地主机终端使用 Ansible 成功 ping windows 主机，但是当通过 docker 容器尝试此操作时，它失败并显示以下消息：

flask    | fatal: [eudc2.dea.com]: UNREACHABLE! => {"changed": false, "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fbc16d50550>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))", "unreachable": true}

但是，当通过 localhost ping 时：

~/Documents/Projects/user oam !5 ?6 ❯ ansible dc -m win_ping                                                                                                     
eudc2.dea.com | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

我会说这意味着问题出在 docker 容器中，所以这就是 dockerfile：

FROM python
WORKDIR /app
ADD . /app
RUN pip3 install --upgrade pip
RUN pip3 install flask uwsgi requests ansible ansible_runner pywinrm
RUN apt-get update -y && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    sshpass

CMD ["uwsgi","app.ini"]

这是主机变量：

[dc]
eudc2.dea.com 

[dc:vars]
ansible_user='username'
ansible_password='pass'
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_winrm_port=5985
ansible_winrm_transport=basic

来自 docker 容器的 win_ping 的详细输出：

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask ansible -i /app/ansible/inventory/hosts dc -m win_ping -vvvv                        ✘ INT
ansible 2.10.2
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.9.0 (default, Oct 13 2020, 20:14:06) [GCC 8.3.0]
No config file found; using defaults
setting up inventory plugins
host_list declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
script declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
auto declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
Set default localhost to localhost
Parsed /app/ansible/inventory/hosts inventory source with ini plugin
Loading callback plugin minimal of type stdout, v2.0 from /usr/local/lib/python3.9/site-packages/ansible/plugins/callback/minimal.py
META: ran handlers
redirecting (type: modules) ansible.builtin.win_ping to ansible.windows.win_ping
Loading collection ansible.windows from /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows
Using module file /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows/plugins/modules/win_ping.ps1
Pipelining is enabled.
<eudc2.dea.com> ESTABLISH WINRM CONNECTION FOR USER: <username_truncated> on PORT 5985 TO eudc2.dea.com
eudc2.ictv.com | UNREACHABLE! => {
    "changed": false,
    "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f628ecd08e0>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))",
    "unreachable": true
}

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask curl eudc2.dea.com                                                                 ✘ INT
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:16 --:--:--     0

Answer 1

有趣的是，从容器内运行curl需要 16 秒才能完成。 这看起来很长一段时间。

Ansible 的 WinRM 超时操作为 20 秒：

https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html

一些建议：

• 从容器内部和外部运行一些curl请求（我正在考虑容器与您调用的 localhost 在同一台机器上运行）； 比较时间，看看它们有很大的不同
• 从容器和本地主机多次运行win_ping ； 容器是否曾经工作或本地主机曾经失败？; 运行time ansible dc -m win_ping （ time ansible dc -m win_ping ）
• 更改上面链接中提到的ansible_winrm_operation_timeout_sec和ansible_winrm_read_timeout_sec配置，看看是否有帮助