Closed JasonN3 closed 1 year ago
Can you provide the log? I'd like to see the firewall section of the logs to see if it is installing packages and, if so, which packages were installed
Here's the log starting when it calls this role:
TASK [Open the TCP port 1433] ****************************************************************************************************************************************************
TASK [fedora.linux_system_roles.firewall : Setup firewalld] **********************************************************************************************************************
included: /usr/share/ansible/roles/fedora.linux_system_roles.firewall/tasks/firewalld.yml for localhost
TASK [fedora.linux_system_roles.firewall : Ensure ansible_facts used by role] ****************************************************************************************************
skipping: [localhost]
TASK [fedora.linux_system_roles.firewall : Install firewalld] ********************************************************************************************************************
ok: [localhost]
TASK [fedora.linux_system_roles.firewall : Collect service facts] ****************************************************************************************************************
skipping: [localhost]
TASK [fedora.linux_system_roles.firewall : Attempt to stop and disable conflicting services] *************************************************************************************
skipping: [localhost] => (item=nftables)
skipping: [localhost] => (item=iptables)
skipping: [localhost] => (item=ufw)
skipping: [localhost]
TASK [fedora.linux_system_roles.firewall : Unmask firewalld service] *************************************************************************************************************
ok: [localhost]
TASK [fedora.linux_system_roles.firewall : Enable and start firewalld service] ***************************************************************************************************
ok: [localhost]
TASK [fedora.linux_system_roles.firewall : Check if previous replaced is defined] ************************************************************************************************
ok: [localhost]
TASK [fedora.linux_system_roles.firewall : Get config files, checksums before and remove] ****************************************************************************************
skipping: [localhost]
TASK [fedora.linux_system_roles.firewall : Tell firewall module it is able to report changed] ************************************************************************************
skipping: [localhost]
TASK [fedora.linux_system_roles.firewall : Configure firewall] *******************************************************************************************************************
failed: [localhost] (item={'port': '1433/tcp', 'state': 'enabled', 'permanent': True, 'runtime': True}) => {"ansible_loop_var": "item", "changed": false, "item": {"permanent": true, "port": "1433/tcp", "runtime": true, "state": "enabled"}, "msg": "No firewall backend could be imported."}
ah - this is the "must use explicit -c local
against localhost or modules won't be found" - see https://access.redhat.com/solutions/6726561
That resolved it. I did an explicit inventory file that specified ansible_connection=local
for localhost and it was able to add the rule. Is it possible to add a warning to ansible itself to warn about that situation since the error message is not helpful and it sounds like it affects more than just this role? I can submit a BZ if you think it's worth it
That resolved it. I did an explicit inventory file that specified
ansible_connection=local
for localhost and it was able to add the rule. Is it possible to add a warning to ansible itself to warn about that situation since the error message is not helpful and it sounds like it affects more than just this role?
It affects every ansible module that uses a python library that isn't provided by the modular python used by the ansible
command.
I can submit a BZ if you think it's worth it
Sure - please submit a BZ
What happened: During the MSSQL role, it can optionally call this role to add port 1433/tcp. When adding, it returns the error: No firewall backend could be imported.
What you expected to happen: Successfully add the firewall port
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?: This was also tested using the version of rhel-system-roles.firewall that's included in the package rhel-system-roles.noarch I also tried setting SELinux to permissive, but it did not change the error message
Environment:
Full error message: