ansible-collections / community.zabbix

Zabbix Ansible modules
http://galaxy.ansible.com/community/zabbix
Other
321 stars 280 forks source link

Cannot talk to SSL enabled Zabbix Server #982

Closed Thulium-Drake closed 1 year ago

Thulium-Drake commented 1 year ago
SUMMARY

When configuring the new vars with a Zabbix server that uses HTTPS, the module complains that it's HTTP request is sent to an HTTPS server:

TASK [community.zabbix.zabbix_agent : API | Create host groups] ******************************************************
FAILED - RETRYING: [config.zm1.element-networks.nl -> monitoring.zm1.element-networks.nl]: API | Create host groups (3 retries left).
FAILED - RETRYING: [config.zm1.element-networks.nl -> monitoring.zm1.element-networks.nl]: API | Create host groups (2 retries left).
FAILED - RETRYING: [config.zm1.element-networks.nl -> monitoring.zm1.element-networks.nl]: API | Create host groups (1 retries left).
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: </body></html>
fatal: [config.zm1.element-networks.nl -> monitoring.zm1.element-networks.nl]: FAILED! => changed=false 
  attempts: 3
  module_stderr: |-
    Traceback (most recent call last):
      File "/home/ansible/.ansible/tmp/ansible-local-686273ghf3awe/ansible-tmp-1683674583.372596-74913-116944593910708/AnsiballZ_zabbix_group.py", line 107, in <module>
        _ansiballz_main()
      File "/home/ansible/.ansible/tmp/ansible-local-686273ghf3awe/ansible-tmp-1683674583.372596-74913-116944593910708/AnsiballZ_zabbix_group.py", line 99, in _ansiballz_main
        invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
      File "/home/ansible/.ansible/tmp/ansible-local-686273ghf3awe/ansible-tmp-1683674583.372596-74913-116944593910708/AnsiballZ_zabbix_group.py", line 47, in invoke_module
        runpy.run_module(mod_name='ansible_collections.community.zabbix.plugins.modules.zabbix_group', init_globals=dict(_module_fqn='ansible_collections.community.zabbix.plugins.modules.zabbix_group', _modlib_path=modlib_path),
      File "/usr/lib/python3.9/runpy.py", line 210, in run_module
        return _run_module_code(code, init_globals, run_name, mod_spec)
      File "/usr/lib/python3.9/runpy.py", line 97, in _run_module_code
        _run_code(code, mod_globals, init_globals,
      File "/usr/lib/python3.9/runpy.py", line 87, in _run_code
        exec(code, run_globals)
      File "/tmp/ansible_community.zabbix.zabbix_group_payload_k8b7at2x/ansible_community.zabbix.zabbix_group_payload.zip/ansible_collections/community/zabbix/plugins/modules/zabbix_group.py", line 181, in <module>
      File "/tmp/ansible_community.zabbix.zabbix_group_payload_k8b7at2x/ansible_community.zabbix.zabbix_group_payload.zip/ansible_collections/community/zabbix/plugins/modules/zabbix_group.py", line 153, in main
      File "/tmp/ansible_community.zabbix.zabbix_group_payload_k8b7at2x/ansible_community.zabbix.zabbix_group_payload.zip/ansible_collections/community/zabbix/plugins/module_utils/base.py", line 20, in __init__
      File "/tmp/ansible_community.zabbix.zabbix_group_payload_k8b7at2x/ansible_community.zabbix.zabbix_group_payload.zip/ansible_collections/community/zabbix/plugins/module_utils/api_request.py", line 53, in api_version
      File "/tmp/ansible_community.zabbix.zabbix_group_payload_k8b7at2x/ansible_community.zabbix.zabbix_group_payload.zip/ansible/module_utils/connection.py", line 200, in __rpc__
    ansible.module_utils.connection.ConnectionError: Invalid JSON response: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
    <html><head>
    <title>400 Bad Request</title>
    </head><body>
    <h1>Bad Request</h1>
    <p>Your browser sent a request that this server could not understand.<br />
    Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
     Instead use the HTTPS scheme to access this URL, please.<br />
    </p>
    </body></html>
  module_stdout: ''
  msg: |-
    MODULE FAILURE
    See stdout/stderr for the exact error
  rc: 1
ISSUE TYPE
COMPONENT NAME

zabbix_group

ANSIBLE VERSION
ansible [core 2.12.10]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/ansible/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/ansible/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
  jinja version = 2.11.3
  libyaml = True
CONFIGURATION
n/a
OS / ENVIRONMENT / Zabbix Version

6.0 on Debian

STEPS TO REPRODUCE

Run the role with the settings below

###
# Zabbix agent configuration
###
zabbix_version: '6.0'
zabbix_agent_version: "{{ zabbix_version }}"
zabbix_server_version: "{{ zabbix_version }}"
zabbix_repo: 'zabbix'

zabbix_agent_server: 'monitoring.zm1.element-networks.nl
zabbix_agent_serveractive: "{{ zabbix_agent_server }}"

zabbix_api_server_host: 'monitoring.zm1.element-networks.nl'
zabbix_api_server_port: 443
zabbix_api_use_ssl: true
zabbix_api_login_user: 'zabbix-cli'
zabbix_api_validate_certs: true
zabbix_api_login_pass: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          blabla

zabbix_api_create_hosts: true
zabbix_api_create_hostgroup: true
zabbix_agent_tlspsk_auto: true

zabbix_agent_link_templates:
  - 'Template OS Linux'
EXPECTED RESULTS

Not to break

ACTUAL RESULTS

See above, the error is quite clear

POSSIBLE FIX

Add ansible_httpapi_use_ssl to this task:

- name: "Run the API calls to Zabbix Server"
  vars:
    gather_facts: false
    ansible_user: "{{ zabbix_api_login_user }}"
    ansible_network_os: community.zabbix.zabbix
    ansible_connection: httpapi
    ansible_httpapi_use_ssl: "{{ zabbix_api_use_ssl }}"
    # Can't think of a way to make http_login_* vars be undefined -(
    http_login_user: "{{ zabbix_api_http_user | default(-42) }}"
    http_login_password: "{{ zabbix_api_http_password | default(-42) }}"
  include_tasks: api.yml
  when:
    - (zabbix_api_create_hostgroup | bool) or (zabbix_api_create_hosts | bool)
  tags:
    - api

However, this opens up a new 401 Unauthorized error when using HTTP Basic Auth... Which reminds me of #565

justintaylor9 commented 1 year ago

Bump.