Feature: allow Ansible provisioner to specify usage of WinRM instead of SSH

[Holmistr]

My usecase is to create Windows image using Ansible. The problem is that I need to connect to Windows image via WinRM. Ansible already has this capability, you only specify "ansible_connection: winrm" and other parameters in the inventory file.

However, Packer's Ansible provisioner doesn't allow to add this information to the inventory file. Packer create temporary inventory file which it uses further. As stated in the documentation: "It dynamically creates an Ansible inventory file configured to use SSH ... ". Also, when looking at the code of Ansible provisioner (https://github.com/mitchellh/packer/blob/master/provisioner/ansible/provisioner.go#L252), I see that there is no option to either specify ansible_connection properties, or provide custom inventory file.

This feature could be quite useful and I would say not very hard to implement. If you can confirm that this makes sense to implement and we agree on the way how to do it (either provide capability to specify custom inventory file or just add new properties like "ansible_connection", etc.), I would be happy to implement it (or at least try).

[rickard-von-essen]

@bhcleek do you know if this is already supported, maybe on master?

[Holmistr]

Hi @rickard-von-essen , thanks for your comment. As I linked the code, I think it's quite clear that this is not implemented, however maybe I'm overlooking something, so let's wait for the comment. Thanks for such a quick respose :)

[rickard-von-essen]

This is a bit complicated since ansible communicates with a ssh proxy that in turn forwards the connection to the VM. But it should now work on master for docker which also uses a special communicator, if I understand correctly.

[bhcleek]

Yes, this should work on master now.

[rickard-von-essen]

👍

[Holmistr]

Thanks for you responses @bhcleek . In that case, could you please provided any documentation/example, how to use this feature? Since it doesn't work for me even when I try to build fresh master, but I haven't configured anything.

My Packer JSON file looks like this: http://pastebin.com/qh9R00Qr
Corresponding Ansible file just does simple creation of a file via PowerShell. When I execute the Ansible manually (via ansible-playbook command) on a running instance, everything works fine. To make this working, I had to create Ansible group_vars/windows.yaml file with ansible_connection: winrm property and everything started working (manual execution of ansible). However, I don't understand how Packer would pick up that it should use WinRM, could you show me the code that should do this for Ansible?

Output of my image build: http://pastebin.com/sC8wRSrs

So question - if this feature is already implement, how to use it?

[bhcleek]

@Holmistr Packer communicates with the node, because the builder's communicator is set to to winrm. Ansible will not be communicating directly with the node; instead, it will use SSH to connect to the provisioner. The provisioner takes care of communicating with the node.

Your packer template looks fine to me; I'm working on some tests to verify that the provisioner works correctly in this configuration. In the meantime, have you tried using Ansible's raw module? Adding "ansible_extra_vars": ["-vvvv"] to your template and running packer with PACKER_LOG=1 will also help us analyze the provisioning of your windows node.

[Holmistr]

@bhcleek Yes, I tried the raw module.
After enabling more logging as you suggested, I got just a little more info:

openstack: <127.0.0.1> ESTABLISH WINRM CONNECTION FOR USER: jholusa on PORT 44902 TO 127.0.0.1
openstack: <127.0.0.1> ESTABLISH WINRM CONNECTION FOR USER: jholusa on PORT 44902 TO 127.0.0.1
2016/09/26 09:27:48 ui: openstack: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "ssl: auth method ssl requires a password", "unreachable": true}

I'm not very familiar with the process, but it looks like it's trying to establish WinRM connection to the local proxy, is that correct? I'm sorry, I'm still a bit confused here, hence I cannot diagnose it properly.

[chris-smith-zocdoc]

I've setup a simple test repo https://github.com/chris-smith-zocdoc/packer-windows-example for this issue. If I'm doing something wrong/dumb please let me know, the rest of this is based on the assumption that what I'm doing in the example repo is correct.

AFAIK its unlikely that the current implementation will work unless there is a way to have Ansible send windows commands over the ssh connection.

Here is my packer log

The interesting lines

2016/09/29 01:23:17 packerio: 2016/09/29 01:23:17 new exec request: /bin/sh -c '( umask 22 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1475112197.48-12092160621548 `" && echo "` echo $HOME/.ansible/tmp/ansible-tmp-1475112197.48-12092160621548 `" )'
2016/09/29 01:23:17 packerio: 2016/09/29 01:23:17 [INFO] starting remote command: /bin/sh -c '( umask 22 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1475112197.48-12092160621548 `" && echo "` echo $HOME/.ansible/tmp/ansible-tmp-1475112197.48-12092160621548 `" )'
2016/09/29 01:23:17 [INFO] 0 bytes written for 'stdout'
2016/09/29 01:23:17 [INFO] 44 bytes written for 'stderr'
2016/09/29 01:23:17 [INFO] RPC client: Communicator ended with: 1
2016/09/29 01:23:17 [INFO] RPC endpoint: Communicator ended with: 1
2016/09/29 01:23:17 [INFO] 0 bytes written for 'stdin'

Notice that its trying to issue a command to the windows host using /bin/sh, this obviously won't work on a windows machine.

If you take a look at the Ansible winrm connector, it does a bunch of things when executing winrm commands which doesn't happen over the ssh connection.

It looks like it might be possible to force the ssh connector to use the powershell shell type but I'm not familiar enough with the Ansible codebase to make that determination. I also wouldn't be surprised if that just brought on a new slew of bugs in Ansible because I imaging anyone who is doing windows management with Ansible is using winrm.

Running Ansible from outside of packer on the same host, you'll notice that the commands change to be more powershelly

I'm not familiar with either of these codebases, but from what I can tell we have the following options:

1. Force Ansible to send powershell commands over the ssh connection
   • This could expose a bunch of bugs on the Ansible side because most people doing Windows management are probably using winrm
2. Implement a Winrm proxy to forward from Ansible -> proxy -> target
   • Maybe there is a go implemenation already?
3. Expose the ip address from the packer connector to the Ansible provisioner, allowing Ansible to talk directly to the target machine
   • Mentioned previously in Provide host based Ansible provisioner #1555

[bhcleek]

@chris-smith-zocdoc My testing shows the same results that you're seeing, but I think there may be a way forward. ansible/ansible#14274, ansible/ansible#13490, and http://docs.ansible.com/ansible/intro_configuration.html#executable hint that it may be possible to force ansible to use the shell of our choice; I'll keep looking into it.

Regarding the other two alternatives that you provided, implementing a WinRM proxy may be possible. The last alternative, exposing the IP address from the communicator interface is unlikely to happen, because not all the builders communicate over TCP/IP.

[bhcleek]

https://github.com/ansible/ansible/blob/stable-2.1/lib/ansible/plugins/connection/__init__.py#L173-L221 and https://github.com/ansible/ansible/blob/600915aa97cd70dc3b6c5e5a3d1944f48c14597e/docsite/rst/intro_inventory.rst#list-of-behavioral-inventory-parameters give us details about the values that may need to be configured using extra_arguments and/or ansible_env_vars. I suspect that ansible_shell_type should be powershell and that ansible_shell_executable should also be set to something, but I'm not sure what. Maybe powershell?