From 2ccc0aca17de17c832dadf45bdace4e874390d66 Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Fri, 16 Aug 2019 15:20:12 +0200 Subject: [PATCH 1/6] routines for building agent-vm ami --- .../molecule/vms/files/agent/Makefile | 2 + .../molecule/vms/files/agent/Readme.md | 6 + .../files/agent/connection_plugins/packer.py | 218 ++++++++++++++++++ .../files/agent/packer-molecule-windows.json | 38 +++ .../molecule/vms/files/agent/playbook.yml | 6 + .../vms/files/agent/winrm_advanced.txt | 3 + .../molecule/vms/files/agent/winrm_simple.txt | 3 + test/molecule-role/molecule/vms/molecule.yml | 2 +- 8 files changed, 277 insertions(+), 1 deletion(-) create mode 100644 test/molecule-role/molecule/vms/files/agent/Makefile create mode 100644 test/molecule-role/molecule/vms/files/agent/Readme.md create mode 100644 test/molecule-role/molecule/vms/files/agent/connection_plugins/packer.py create mode 100644 test/molecule-role/molecule/vms/files/agent/packer-molecule-windows.json create mode 100644 test/molecule-role/molecule/vms/files/agent/playbook.yml diff --git a/test/molecule-role/molecule/vms/files/agent/Makefile b/test/molecule-role/molecule/vms/files/agent/Makefile new file mode 100644 index 000000000000..a3a1c9e97076 --- /dev/null +++ b/test/molecule-role/molecule/vms/files/agent/Makefile @@ -0,0 +1,2 @@ +build: + packer build packer-molecule-windows.json diff --git a/test/molecule-role/molecule/vms/files/agent/Readme.md b/test/molecule-role/molecule/vms/files/agent/Readme.md new file mode 100644 index 000000000000..2672c7501415 --- /dev/null +++ b/test/molecule-role/molecule/vms/files/agent/Readme.md @@ -0,0 +1,6 @@ +Connecting ansible: + +https://www.packer.io/docs/provisioners/ansible.html + +https://github.com/hashicorp/packer/tree/master/examples/ansible/connection-plugin + diff --git a/test/molecule-role/molecule/vms/files/agent/connection_plugins/packer.py b/test/molecule-role/molecule/vms/files/agent/connection_plugins/packer.py new file mode 100644 index 000000000000..f22e9a51e9d6 --- /dev/null +++ b/test/molecule-role/molecule/vms/files/agent/connection_plugins/packer.py @@ -0,0 +1,218 @@ +from __future__ import (absolute_import, division, print_function) +__metaclass__ = type + +from ansible.plugins.connection.ssh import Connection as SSHConnection + +DOCUMENTATION = ''' + connection: packer + short_description: ssh based connections for powershell via packer + description: + - This connection plugin allows ansible to communicate to the target packer machines via ssh based connections for powershell. + author: Packer Community + version_added: na + options: + host: + description: Hostname/ip to connect to. + default: inventory_hostname + vars: + - name: ansible_host + - name: ansible_ssh_host + host_key_checking: + description: Determines if ssh should check host keys + type: boolean + ini: + - section: defaults + key: 'host_key_checking' + - section: ssh_connection + key: 'host_key_checking' + version_added: '2.5' + env: + - name: ANSIBLE_HOST_KEY_CHECKING + - name: ANSIBLE_SSH_HOST_KEY_CHECKING + version_added: '2.5' + vars: + - name: ansible_host_key_checking + version_added: '2.5' + - name: ansible_ssh_host_key_checking + version_added: '2.5' + password: + description: Authentication password for the C(remote_user). Can be supplied as CLI option. + vars: + - name: ansible_password + - name: ansible_ssh_pass + ssh_args: + description: Arguments to pass to all ssh cli tools + default: '-C -o ControlMaster=auto -o ControlPersist=60s' + ini: + - section: 'ssh_connection' + key: 'ssh_args' + env: + - name: ANSIBLE_SSH_ARGS + ssh_common_args: + description: Common extra args for all ssh CLI tools + vars: + - name: ansible_ssh_common_args + ssh_executable: + default: ssh + description: + - This defines the location of the ssh binary. It defaults to ``ssh`` which will use the first ssh binary available in $PATH. + - This option is usually not required, it might be useful when access to system ssh is restricted, + or when using ssh wrappers to connect to remote hosts. + env: [{name: ANSIBLE_SSH_EXECUTABLE}] + ini: + - {key: ssh_executable, section: ssh_connection} + #const: ANSIBLE_SSH_EXECUTABLE + version_added: "2.2" + sftp_executable: + default: sftp + description: + - This defines the location of the sftp binary. It defaults to ``sftp`` which will use the first binary available in $PATH. + env: [{name: ANSIBLE_SFTP_EXECUTABLE}] + ini: + - {key: sftp_executable, section: ssh_connection} + version_added: "2.6" + scp_executable: + default: scp + description: + - This defines the location of the scp binary. It defaults to `scp` which will use the first binary available in $PATH. + env: [{name: ANSIBLE_SCP_EXECUTABLE}] + ini: + - {key: scp_executable, section: ssh_connection} + version_added: "2.6" + scp_extra_args: + description: Extra exclusive to the ``scp`` CLI + vars: + - name: ansible_scp_extra_args + sftp_extra_args: + description: Extra exclusive to the ``sftp`` CLI + vars: + - name: ansible_sftp_extra_args + ssh_extra_args: + description: Extra exclusive to the 'ssh' CLI + vars: + - name: ansible_ssh_extra_args + retries: + # constant: ANSIBLE_SSH_RETRIES + description: Number of attempts to connect. + default: 3 + type: integer + env: + - name: ANSIBLE_SSH_RETRIES + ini: + - section: connection + key: retries + - section: ssh_connection + key: retries + port: + description: Remote port to connect to. + type: int + default: 22 + ini: + - section: defaults + key: remote_port + env: + - name: ANSIBLE_REMOTE_PORT + vars: + - name: ansible_port + - name: ansible_ssh_port + remote_user: + description: + - User name with which to login to the remote server, normally set by the remote_user keyword. + - If no user is supplied, Ansible will let the ssh client binary choose the user as it normally + ini: + - section: defaults + key: remote_user + env: + - name: ANSIBLE_REMOTE_USER + vars: + - name: ansible_user + - name: ansible_ssh_user + pipelining: + default: ANSIBLE_PIPELINING + description: + - Pipelining reduces the number of SSH operations required to execute a module on the remote server, + by executing many Ansible modules without actual file transfer. + - This can result in a very significant performance improvement when enabled. + - However this conflicts with privilege escalation (become). + For example, when using sudo operations you must first disable 'requiretty' in the sudoers file for the target hosts, + which is why this feature is disabled by default. + env: + - name: ANSIBLE_PIPELINING + #- name: ANSIBLE_SSH_PIPELINING + ini: + - section: defaults + key: pipelining + #- section: ssh_connection + # key: pipelining + type: boolean + vars: + - name: ansible_pipelining + - name: ansible_ssh_pipelining + private_key_file: + description: + - Path to private key file to use for authentication + ini: + - section: defaults + key: private_key_file + env: + - name: ANSIBLE_PRIVATE_KEY_FILE + vars: + - name: ansible_private_key_file + - name: ansible_ssh_private_key_file + control_path: + description: + - This is the location to save ssh's ControlPath sockets, it uses ssh's variable substitution. + - Since 2.3, if null, ansible will generate a unique hash. Use `%(directory)s` to indicate where to use the control dir path setting. + env: + - name: ANSIBLE_SSH_CONTROL_PATH + ini: + - key: control_path + section: ssh_connection + control_path_dir: + default: ~/.ansible/cp + description: + - This sets the directory to use for ssh control path if the control path setting is null. + - Also, provides the `%(directory)s` variable for the control path setting. + env: + - name: ANSIBLE_SSH_CONTROL_PATH_DIR + ini: + - section: ssh_connection + key: control_path_dir + sftp_batch_mode: + default: 'yes' + description: 'TODO: write it' + env: [{name: ANSIBLE_SFTP_BATCH_MODE}] + ini: + - {key: sftp_batch_mode, section: ssh_connection} + type: bool + scp_if_ssh: + default: smart + description: + - "Prefered method to use when transfering files over ssh" + - When set to smart, Ansible will try them until one succeeds or they all fail + - If set to True, it will force 'scp', if False it will use 'sftp' + env: [{name: ANSIBLE_SCP_IF_SSH}] + ini: + - {key: scp_if_ssh, section: ssh_connection} + use_tty: + version_added: '2.5' + default: 'yes' + description: add -tt to ssh commands to force tty allocation + env: [{name: ANSIBLE_SSH_USETTY}] + ini: + - {key: usetty, section: ssh_connection} + type: bool + yaml: {key: connection.usetty} +''' + +class Connection(SSHConnection): + ''' ssh based connections for powershell via packer''' + + transport = 'packer' + has_pipelining = True + become_methods = [] + allow_executable = False + module_implementation_preferences = ('.ps1', '') + + def __init__(self, *args, **kwargs): + super(Connection, self).__init__(*args, **kwargs) diff --git a/test/molecule-role/molecule/vms/files/agent/packer-molecule-windows.json b/test/molecule-role/molecule/vms/files/agent/packer-molecule-windows.json new file mode 100644 index 000000000000..a8ed1c0928d0 --- /dev/null +++ b/test/molecule-role/molecule/vms/files/agent/packer-molecule-windows.json @@ -0,0 +1,38 @@ +{ + "builders": [ + { + "type": "amazon-ebs", + "region": "eu-west-1", + "instance_type": "m3.medium", + "source_ami": "ami-09c6f606506004483", + "ami_name": "molecule-windows-{{timestamp}}", + "user_data_file": "winrm_advanced.txt", + "communicator": "winrm", + "winrm_username": "Administrator", + "winrm_password": "Bionic!", + "winrm_insecure": true, + "winrm_port": "5986", + "winrm_use_ssl": true, + "tags": { + "OS_Version": "Windows 2016", + "Team": "Lupulus", + "Product": "stackstate-agent-2", + "Base_AMI_Name": "{{ .SourceAMIName }}", + "Extra": "{{ .SourceAMITags.TagName }}" + } + } + ], + "provisioners": [ + { + "type": "ansible", + "playbook_file": "./playbook.yml", + "extra_arguments": [ + "--connection", + "packer", + "-vvv", + "--extra-vars", + "ansible_shell_type=powershell ansible_shell_executable=None" + ] + } + ] +} diff --git a/test/molecule-role/molecule/vms/files/agent/playbook.yml b/test/molecule-role/molecule/vms/files/agent/playbook.yml new file mode 100644 index 000000000000..82f9dfd0254a --- /dev/null +++ b/test/molecule-role/molecule/vms/files/agent/playbook.yml @@ -0,0 +1,6 @@ +--- + +- hosts: all + + tasks: + - win_ping: diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt index 22e2e18afd3d..46130b66a565 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt @@ -14,6 +14,9 @@ $admin.PSBase.Invoke("SetPassword", "Bionic!") net user test 'Bionic!' /add /y net localgroup administrators test /add +Set-LocalUser -Name "administrator" -PasswordNeverExpires 1 +Set-LocalUser -Name "test" -PasswordNeverExpires 1 + # Disable Internet Explorer Security # http://stackoverflow.com/a/9368555/2067999 $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt index 417c7b451c41..b348c57a601b 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt @@ -5,5 +5,8 @@ $admin.PSBase.Invoke("SetPassword", "Bionic!") net user test 'Bionic!' /add /y net localgroup administrators test /add +Set-LocalUser -Name "administrator" -PasswordNeverExpires 1 +Set-LocalUser -Name "test" -PasswordNeverExpires 1 + Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1')) diff --git a/test/molecule-role/molecule/vms/molecule.yml b/test/molecule-role/molecule/vms/molecule.yml index 3dae5bb3cfc1..4668aaf158e3 100644 --- a/test/molecule-role/molecule/vms/molecule.yml +++ b/test/molecule-role/molecule/vms/molecule.yml @@ -39,7 +39,7 @@ platforms: user_data: files/agent/none.txt - name: agent-win - image: ami-0a51db045a1b55840 # Windows Server 2016 preconfigured for ansible (EBS-Backed) + image: ami-0f59e8df9546f01ba # Windows Server 2016 preconfigured for ansible (EBS-Backed) instance_type: t3.small vpc_subnet_id: subnet-41c8f224 # eu-west-1a region: eu-west-1 From ed5cd1122ab5fe3c8b717593ad61ee1910e58a74 Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Fri, 16 Aug 2019 18:06:59 +0200 Subject: [PATCH 2/6] routines for building agent-vm ami --- test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt | 3 --- test/molecule-role/molecule/vms/files/agent/winrm_simple.txt | 3 --- test/molecule-role/molecule/vms/molecule.yml | 2 +- 3 files changed, 1 insertion(+), 7 deletions(-) diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt index 46130b66a565..22e2e18afd3d 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt @@ -14,9 +14,6 @@ $admin.PSBase.Invoke("SetPassword", "Bionic!") net user test 'Bionic!' /add /y net localgroup administrators test /add -Set-LocalUser -Name "administrator" -PasswordNeverExpires 1 -Set-LocalUser -Name "test" -PasswordNeverExpires 1 - # Disable Internet Explorer Security # http://stackoverflow.com/a/9368555/2067999 $AdminKey = "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt index b348c57a601b..417c7b451c41 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt @@ -5,8 +5,5 @@ $admin.PSBase.Invoke("SetPassword", "Bionic!") net user test 'Bionic!' /add /y net localgroup administrators test /add -Set-LocalUser -Name "administrator" -PasswordNeverExpires 1 -Set-LocalUser -Name "test" -PasswordNeverExpires 1 - Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1')) diff --git a/test/molecule-role/molecule/vms/molecule.yml b/test/molecule-role/molecule/vms/molecule.yml index 4668aaf158e3..906ab21c25d6 100644 --- a/test/molecule-role/molecule/vms/molecule.yml +++ b/test/molecule-role/molecule/vms/molecule.yml @@ -39,7 +39,7 @@ platforms: user_data: files/agent/none.txt - name: agent-win - image: ami-0f59e8df9546f01ba # Windows Server 2016 preconfigured for ansible (EBS-Backed) + image: ami-0ae4dcbfba13d5cc8 # Windows Server 2016 preconfigured for ansible (EBS-Backed) instance_type: t3.small vpc_subnet_id: subnet-41c8f224 # eu-west-1a region: eu-west-1 From 68ca184086c86e7879ed7c6df04ae35b7a800f52 Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Sat, 17 Aug 2019 20:25:55 +0200 Subject: [PATCH 3/6] routines for building agent-vm ami --- test/molecule-role/molecule/vms/files/agent/playbook.yml | 8 ++++++++ .../molecule/vms/files/agent/winrm_advanced.txt | 2 ++ .../molecule/vms/files/agent/winrm_simple.txt | 2 ++ test/molecule-role/molecule/vms/molecule.yml | 2 +- 4 files changed, 13 insertions(+), 1 deletion(-) diff --git a/test/molecule-role/molecule/vms/files/agent/playbook.yml b/test/molecule-role/molecule/vms/files/agent/playbook.yml index 82f9dfd0254a..c24002c3e5d5 100644 --- a/test/molecule-role/molecule/vms/files/agent/playbook.yml +++ b/test/molecule-role/molecule/vms/files/agent/playbook.yml @@ -3,4 +3,12 @@ - hosts: all tasks: + + # - name: Wait until the file provisioned.txt is present before continuing + # wait_for: + # path: c:\provisioned.txt + + - pause: + minutes: 10 + - win_ping: diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt index 22e2e18afd3d..d3a42ebd0b50 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_advanced.txt @@ -24,4 +24,6 @@ Set-ItemProperty -Path $UserKey -Name "IsInstalled" -Value 0 Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/softasap/sa-win/master/bootstrap.ps1')) +New-Item c:\provisioned.txt -type file + diff --git a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt index 417c7b451c41..a98a6f1b7447 100644 --- a/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt +++ b/test/molecule-role/molecule/vms/files/agent/winrm_simple.txt @@ -6,4 +6,6 @@ net user test 'Bionic!' /add /y net localgroup administrators test /add Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1')) + +New-Item c:\provisioned.txt -type file diff --git a/test/molecule-role/molecule/vms/molecule.yml b/test/molecule-role/molecule/vms/molecule.yml index 906ab21c25d6..63d41410e2e1 100644 --- a/test/molecule-role/molecule/vms/molecule.yml +++ b/test/molecule-role/molecule/vms/molecule.yml @@ -39,7 +39,7 @@ platforms: user_data: files/agent/none.txt - name: agent-win - image: ami-0ae4dcbfba13d5cc8 # Windows Server 2016 preconfigured for ansible (EBS-Backed) + image: ami-06992baf7dbb5c7dd # Windows Server 2016 preconfigured for ansible (EBS-Backed) instance_type: t3.small vpc_subnet_id: subnet-41c8f224 # eu-west-1a region: eu-west-1 From 3ab2b2897f7c516ddc132db8143b551832482020 Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Sat, 17 Aug 2019 21:11:29 +0200 Subject: [PATCH 4/6] routines for building agent-vm ami --- test/molecule-role/molecule/compose/prepare.yml | 2 +- test/molecule-role/molecule/vms/prepare.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/test/molecule-role/molecule/compose/prepare.yml b/test/molecule-role/molecule/compose/prepare.yml index 7f40e0b7ffa6..8f397decb093 100644 --- a/test/molecule-role/molecule/compose/prepare.yml +++ b/test/molecule-role/molecule/compose/prepare.yml @@ -16,7 +16,7 @@ state: present update_cache: yes retries: 20 - delay: 10 + delay: 30 register: pip_result until: pip_result is not failed - name: Installing python boto packages diff --git a/test/molecule-role/molecule/vms/prepare.yml b/test/molecule-role/molecule/vms/prepare.yml index 8ebdfb4eeb47..11764302d7b9 100644 --- a/test/molecule-role/molecule/vms/prepare.yml +++ b/test/molecule-role/molecule/vms/prepare.yml @@ -15,8 +15,8 @@ name: [python-pip, virtualenv, libyajl2] # venv and yajl2 if you wanna run the simulator state: present update_cache: yes - retries: 5 - delay: 5 + retries: 20 + delay: 30 register: pip_result until: pip_result is not failed - name: Installing python boto packages From 5df2e525c1330c67ce08cb8f654056c479a37b4b Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Mon, 19 Aug 2019 16:04:31 +0200 Subject: [PATCH 5/6] debug output --- test/molecule-role/molecule/vms/prepare.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/molecule-role/molecule/vms/prepare.yml b/test/molecule-role/molecule/vms/prepare.yml index 11764302d7b9..2d582bb841e4 100644 --- a/test/molecule-role/molecule/vms/prepare.yml +++ b/test/molecule-role/molecule/vms/prepare.yml @@ -212,6 +212,7 @@ - common_vars.yml tasks: # We use ncat to keep a listening port open and get a direction + - debug: msg="Starting listening for fedora and windows" - name: Open listening port for fedora {{ connection_port_before_start_fedora }} shell: "nohup ncat --broker --listen -p {{ connection_port_before_start_fedora }} &" become: true @@ -291,7 +292,7 @@ - name: Open listening port for fedora {{ connection_port_after_start_fedora }} shell: "nohup ncat --broker --listen -p {{ connection_port_after_start_fedora }} &" become: true - - name: Open listening port for windows {{ connection_port_after_start_windows }} + - name: {{ connection_port_after_start_windows }} shell: "nohup ncat --broker --listen -p {{ connection_port_after_start_windows }} &" become: true - name: Forward DNAT port {{ dnat_service_port }} to {{ dnat_server_port }} From f3b380c7ac66d98b1e02e86aa4bd8ff9bbd69f83 Mon Sep 17 00:00:00 2001 From: Vyacheslav Voronenko Date: Mon, 19 Aug 2019 18:26:52 +0200 Subject: [PATCH 6/6] debug output --- test/molecule-role/molecule/vms/prepare.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/molecule-role/molecule/vms/prepare.yml b/test/molecule-role/molecule/vms/prepare.yml index 2d582bb841e4..65e1e23a9893 100644 --- a/test/molecule-role/molecule/vms/prepare.yml +++ b/test/molecule-role/molecule/vms/prepare.yml @@ -292,7 +292,7 @@ - name: Open listening port for fedora {{ connection_port_after_start_fedora }} shell: "nohup ncat --broker --listen -p {{ connection_port_after_start_fedora }} &" become: true - - name: {{ connection_port_after_start_windows }} + - name: Open listening port for windows {{ connection_port_after_start_windows }} shell: "nohup ncat --broker --listen -p {{ connection_port_after_start_windows }} &" become: true - name: Forward DNAT port {{ dnat_service_port }} to {{ dnat_server_port }}