Ansible 可以從 localhost 連接到 windows 機器，但不能從 docker 容器連接

Question

我可以從我的本地主機終端使用 Ansible 成功 ping windows 主機，但是當通過 docker 容器嘗試此操作時，它失敗並顯示以下消息：

flask    | fatal: [eudc2.dea.com]: UNREACHABLE! => {"changed": false, "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7fbc16d50550>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))", "unreachable": true}

但是，當通過 localhost ping 時：

~/Documents/Projects/user oam !5 ?6 ❯ ansible dc -m win_ping                                                                                                     
eudc2.dea.com | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

我會說這意味着問題出在 docker 容器中，所以這就是 dockerfile：

FROM python
WORKDIR /app
ADD . /app
RUN pip3 install --upgrade pip
RUN pip3 install flask uwsgi requests ansible ansible_runner pywinrm
RUN apt-get update -y && \
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
    sshpass

CMD ["uwsgi","app.ini"]

這是主機變量：

[dc]
eudc2.dea.com 

[dc:vars]
ansible_user='username'
ansible_password='pass'
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
ansible_winrm_port=5985
ansible_winrm_transport=basic

來自 docker 容器的 win_ping 的詳細輸出：

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask ansible -i /app/ansible/inventory/hosts dc -m win_ping -vvvv                        ✘ INT
ansible 2.10.2
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.9/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.9.0 (default, Oct 13 2020, 20:14:06) [GCC 8.3.0]
No config file found; using defaults
setting up inventory plugins
host_list declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
script declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
auto declined parsing /app/ansible/inventory/hosts as it did not pass its verify_file() method
Set default localhost to localhost
Parsed /app/ansible/inventory/hosts inventory source with ini plugin
Loading callback plugin minimal of type stdout, v2.0 from /usr/local/lib/python3.9/site-packages/ansible/plugins/callback/minimal.py
META: ran handlers
redirecting (type: modules) ansible.builtin.win_ping to ansible.windows.win_ping
Loading collection ansible.windows from /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows
Using module file /usr/local/lib/python3.9/site-packages/ansible_collections/ansible/windows/plugins/modules/win_ping.ps1
Pipelining is enabled.
<eudc2.dea.com> ESTABLISH WINRM CONNECTION FOR USER: <username_truncated> on PORT 5985 TO eudc2.dea.com
eudc2.ictv.com | UNREACHABLE! => {
    "changed": false,
    "msg": "basic: HTTPConnectionPool(host='eudc2.dea.com', port=5985): Max retries exceeded with url: /wsman (Caused by ConnectTimeoutError(<urllib3.connection.HTTPConnection object at 0x7f628ecd08e0>, 'Connection to eudc2.dea.com timed out. (connect timeout=30)'))",
    "unreachable": true
}

~/Documents/Projects/user oam !5 ?7 ❯ docker exec flask curl eudc2.dea.com                                                                 ✘ INT
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:16 --:--:--     0

Answer 1

有趣的是，從容器內運行curl需要 16 秒才能完成。 這看起來很長一段時間。

Ansible 的 WinRM 超時操作為 20 秒：

https://docs.ansible.com/ansible/latest/user_guide/windows_winrm.html

一些建議：

• 從容器內部和外部運行一些curl請求（我正在考慮容器與您調用的 localhost 在同一台機器上運行）； 比較時間，看看它們有很大的不同
• 從容器和本地主機多次運行win_ping ； 容器是否曾經工作或本地主機曾經失敗？; 運行time ansible dc -m win_ping （ time ansible dc -m win_ping ）
• 更改上面鏈接中提到的ansible_winrm_operation_timeout_sec和ansible_winrm_read_timeout_sec配置，看看是否有幫助