search

shiftrepo / OperationBreakingDawn

The Unlicense
0 stars 0 forks source link

直値とrootパスワードの対話対応とパスワードの暗号化 #37

Closed MITLabo closed 5 years ago

MITLabo commented 5 years ago

めんどくさいので混ぜたがバグ扱いで発行する。 Describe the bug

Expected behavior

Screenshots https://github.com/shiftrepo/OperationBreakingDawn/blob/2bb25143b1fdf9c7a899773490c0c3c26ce75bc6/OracleVM_edi/roles/install/tasks/main.yml#L8

MITLabo commented 5 years ago 
TASK [install : packstack answer configuration] ****************************************************
fatal: [master000.shift]: FAILED! => {"changed": false, "msg": "The pexpect python module is required"}

依存に入れておいてくれ。。。pythonあるあるライブラリのバージョン命だがメンテされない。 https://docs.ansible.com/ansible/latest/modules/expect_module.html#parameters

pythonインストールものは下記のwikiでまとめる。 https://github.com/shiftrepo/OperationBreakingDawn/wiki/06.AWX

MITLabo commented 5 years ago

pipでインストールしてあるが認識されていない。

[root@ntp001 OracleVM_edi]# ansible localhost -a "which pexpect"
localhost | FAILED | rc=1 >>
which: no pexpect in (/root/.pyenv/versions/2.7.15/bin:/root/.pyenv/libexec:/root/.pyenv/plugins/python-build/bin:/root/.pyenv/plugins/pyenv-virtualenv/bin:/root/.pyenv/plugins/pyenv-virtualenv/shims:/root/.pyenv/shims:/root/.pyenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)non-zero return code
MITLabo commented 5 years ago

送り先にないとダメなわけないんだが。一応調べる

[root@ntp001 OracleVM_edi]# ansible -i 10.0.2.6, all -a "which pip2"
10.0.2.6 | FAILED | rc=1 >>
which: no pip2 in (/sbin:/bin:/usr/sbin:/usr/bin)non-zero return code

[root@ntp001 OracleVM_edi]# ansible -i 10.0.2.6, all -a "which pip"
10.0.2.6 | FAILED | rc=1 >>
which: no pip in (/sbin:/bin:/usr/sbin:/usr/bin)non-zero return code

[root@ntp001 OracleVM_edi]# ansible -i 10.0.2.6, all -a "which pexpect"
10.0.2.6 | FAILED | rc=1 >>
which: no pexpect in (/sbin:/bin:/usr/sbin:/usr/bin)non-zero return code
MITLabo commented 5 years ago

絶対に入っているが認識されていない。同じvirtual環境にansibleは存在するのに。

(ansible) [root@localhost ~]# pip install pexpect
Requirement already satisfied: pexpect in ./.virtualenvs/ansible/lib/python3.6/site-packages (4.6.0)
Requirement already satisfied: ptyprocess>=0.5 in ./.virtualenvs/ansible/lib/python3.6/site-packages (from pexpect) (0.6.0)

無理やり入れてやるワ。

(ansible) [root@localhost ~]# ansible-playbook expect.yml -v -i ansihosts
No config file found; using defaults
/root/ansihosts did not meet host_list requirements, check plugin documentation if this is unexpected
/root/ansihosts did not meet script requirements, check plugin documentation if this is unexpected

PLAY [ntp] ********************************************************************************************

TASK [wget] *******************************************************************************************
fatal: [10.0.2.10]: FAILED! => {"changed": false, "msg": "The pexpect python module is required"}
        to retry, use: --limit @/root/expect.retry

PLAY RECAP ********************************************************************************************
10.0.2.10                  : ok=0    changed=0    unreachable=0    failed=1

(ansible) [root@localhost ~]# ansible -i 10.0.2.10, all -a "pip list"
10.0.2.10 | CHANGED | rc=0 >>
Package           Version
----------------- -------
pbr               5.1.2
pip               19.0.2
setuptools        39.0.1
six               1.12.0
stevedore         1.30.0
virtualenv        16.4.0
virtualenv-clone  0.5.1
virtualenvwrapper 4.8.4

(ansible) [root@localhost ~]# ansible -i 10.0.2.10, all -a "python -c 'import pexpect'"
10.0.2.10 | FAILED | rc=1 >>
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ImportError: No module named pexpectnon-zero return code

(ansible) [root@localhost ~]# ansible -i 10.0.2.10, all -a "pip install pexpect"
10.0.2.10 | CHANGED | rc=0 >>
Collecting pexpect
  Using cached https://files.pythonhosted.org/packages/89/e6/b5a1de8b0cc4e07ca1b305a4fcc3f9806025c1b651ea302646341222f88b/pexpect-4.6.0-py2.py3-none-any.whl
Collecting ptyprocess>=0.5 (from pexpect)
  Using cached https://files.pythonhosted.org/packages/d1/29/605c2cc68a9992d18dada28206eeada56ea4bd07a239669da41674648b6f/ptyprocess-0.6.0-py2.py3-none-any.whl
Installing collected packages: ptyprocess, pexpect
Successfully installed pexpect-4.6.0 ptyprocess-0.6.0

(ansible) [root@localhost ~]# ansible -i 10.0.2.10, all -a "pip list"
10.0.2.10 | CHANGED | rc=0 >>
Package           Version
----------------- -------
pbr               5.1.2
pexpect           4.6.0
pip               19.0.2
ptyprocess        0.6.0
setuptools        39.0.1
six               1.12.0
stevedore         1.30.0
virtualenv        16.4.0
virtualenv-clone  0.5.1
virtualenvwrapper 4.8.4
MITLabo commented 5 years ago

動かん。。。。。。。

https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html#list-of-behavioral-inventory-parameters

どうやらansibleはvirtualenvもpyenvも無視してデフォルトのpythonインタプリタライブラリを利用するらしい？ 外部ものは環境変数の指定が必要。ネットが嘘だらけ。。。pythonあるあるだが。
FIXME:この情けない指定は後で考える。

- name: set ansible_python_interpreter
  set_fact: ansible_python_interpreter="/root/.virtualenvs/ansible/bin/python3"

この状態でも無視してくるとは。さらに上記の通りansible実行時のlistでも無視される。わかるかっ？そんなの:angry:

(ansible) [root@localhost ~]# which ansible-playbook
/root/.virtualenvs/ansible/bin/ansible-playbook
MITLabo commented 5 years ago

同じ質問を複数回入力させるとエラーになる。正常に入力できているのにエラーとなる。わからん。とりあえず冗長だが、ノードごとにレスポンスを用意する。

fatal: [10.0.2.10]: FAILED! => {
    "changed": true,
    "cmd": "/root/taiwa.sh",
    "delta": "0:00:20.350468",
    "end": "2019-02-11 16:01:13.251115",
    "invocation": {
        "module_args": {
            "chdir": null,
            "command": "/root/taiwa.sh",
            "creates": null,
            "echo": false,
            "removes": null,
            "responses": {
                "^実行するコマンドを.*": "wawawa"
            },
            "timeout": 20
        }
    },
    "msg": "command exceeded timeout",
    "rc": null,
    "start": "2019-02-11 16:00:52.900647",
    "stdout": "実行するコマンドを入力してください\r\nwawawa を実行しました\r\n実行するコマンドを入力してく ださい",
    "stdout_lines": [
        "実行するコマンドを入力してください",
        "wawawa を実行しました",
        "実行するコマンドを入力してください"
    ]
MITLabo commented 5 years ago

結局リモートからpexpctを利用するためには、ライブラリをリモート先にインストールしないとダメっぽい。リモート先からの対応ではansibleで対応できない。当たり前か。。。

2019-02-11 18:07:42,901 p=14898 u=root |  fatal: [master000.shift]: FAILED! => 
{"changed": false, "module_stderr": 
"Shared connection to 10.0.2.6 closed.\r\n"
, "module_stdout": "/bin/sh: /root/.virtualenvs/ansible/bin/python3: No such file or directory\r\n",
 "msg": "The module failed to execute correctly, you probably need to set the interpreter.\n
 See stdout/stderr for the exact error", "rc": 127}

一旦手動でコントローラノードからsshkeyをコピーして事前にルートパスワードの問い合わせをなくす。

MITLabo commented 5 years ago

packstackの結果のみ抜粋だが、一応完成。

略
TASK [install : debug] ******************************************************************************
ok: [master000.shift] => {
    "answer.stdout_lines": [
        "Welcome to the Packstack setup utility",
        "",
        "The installation log file is available at: /var/tmp/packstack/20190211-184549-mk7xXn/openstack-setup.log",
        "",
        "Installing:",
        "Clean Up                                             [ \u001b[32mDONE\u001b[0m ]",
        "Discovering ip protocol version                      [ \u001b[32mDONE\u001b[0m ]",
        "Setting up ssh keys                                  [ \u001b[32mDONE\u001b[0m ]",
        "Preparing servers                                    [ \u001b[32mDONE\u001b[0m ]",
        "Pre installing Puppet and discovering hosts' details [ \u001b[32mDONE\u001b[0m ]",
        "Preparing pre-install entries                        [ \u001b[32mDONE\u001b[0m ]",
        "Installing time synchronization via NTP              [ \u001b[32mDONE\u001b[0m ]",
        "Setting up CACERT                                    [ \u001b[32mDONE\u001b[0m ]",
        "Preparing AMQP entries                               [ \u001b[32mDONE\u001b[0m ]",
        "Preparing MariaDB entries                            [ \u001b[32mDONE\u001b[0m ]",
        "Fixing Keystone LDAP config parameters to be undef if empty[ \u001b[32mDONE\u001b[0m ]",
        "Preparing Keystone entries                           [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Glance entries                             [ \u001b[32mDONE\u001b[0m ]",
        "Checking if the Cinder server has a cinder-volumes vg[ \u001b[32mDONE\u001b[0m ]",
        "Preparing Cinder entries                             [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Nova API entries                           [ \u001b[32mDONE\u001b[0m ]",
        "Creating ssh keys for Nova migration                 [ \u001b[32mDONE\u001b[0m ]",
        "Gathering ssh host keys for Nova migration           [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Nova Compute entries                       [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Nova Scheduler entries                     [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Nova VNC Proxy entries                     [ \u001b[32mDONE\u001b[0m ]",
        "Preparing OpenStack Network-related Nova entries     [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Nova Common entries                        [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron LBaaS Agent entries                [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron API entries                        [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron L3 entries                         [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron L2 Agent entries                   [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron DHCP Agent entries                 [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Neutron Metering Agent entries             [ \u001b[32mDONE\u001b[0m ]",
        "Checking if NetworkManager is enabled and running    [ \u001b[32mDONE\u001b[0m ]",
        "Preparing OpenStack Client entries                   [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Horizon entries                            [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Swift builder entries                      [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Swift proxy entries                        [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Swift storage entries                      [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Heat entries                               [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Heat CloudFormation API entries            [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Gnocchi entries                            [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Redis entries                              [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Ceilometer entries                         [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Aodh entries                               [ \u001b[32mDONE\u001b[0m ]",
        "Adding Magnum manifest entries                       [ \u001b[32mDONE\u001b[0m ]",
        "Preparing Puppet manifests                           [ \u001b[32mDONE\u001b[0m ]",
        "Copying Puppet modules and manifests                 [ \u001b[32mDONE\u001b[0m ]",
        "Applying 10.0.2.6_controller.pp",
        "",
        "10.0.2.6_controller.pp:                              [ \u001b[32mDONE\u001b[0m ]",
        "Applying 10.0.2.6_network.pp",
        "",
        "10.0.2.6_network.pp:                                 [ \u001b[32mDONE\u001b[0m ]",
        "Applying 10.0.2.6_compute.pp",
        "Applying 10.0.2.8_compute.pp",
        "",
        "10.0.2.6_compute.pp:                                 [ \u001b[32mDONE\u001b[0m ]",
        "",
        "10.0.2.8_compute.pp:                                 [ \u001b[32mDONE\u001b[0m ]",
        "Applying Puppet manifests                            [ \u001b[32mDONE\u001b[0m ]",
        "Finalizing                                           [ \u001b[32mDONE\u001b[0m ]",
        "",
        " **** Installation completed successfully ******",
        "",
        "Additional information:",
        " * \u001b[33mWarning: NetworkManager is active on 10.0.2.6, 10.0.2.8. OpenStack networking currently does not work on systems that have the Network Manager service enabled.\u001b[0m",
        " * File /root/keystonerc_admin has been created on OpenStack client host 10.0.2.6. To use the command line tools you need to source the file.",
        " * To access the OpenStack Dashboard browse to http://10.0.2.6/dashboard .",
        "Please, find your login credentials stored in the keystonerc_admin in your home directory.",
        " * The installation log file is available at: /var/tmp/packstack/20190211-184549-mk7xXn/openstack-setup.log",
        " * The generated manifests are available at: /var/tmp/packstack/20190211-184549-mk7xXn/manifests"
    ]
}

TASK [install : add br-ex to neutron ini] ***********************************************************
 [WARNING]: Consider using the replace, lineinfile or template module rather than running sed.  If
you need to use command because replace, lineinfile or template is insufficient you can add
warn=False to this command task or set command_warnings=False in ansible.cfg to get rid of this
message.

changed: [master000.shift] => {"changed": true, "cmd": "sed -i -e 's/After=network-pre.target ovsdb-server.service ovs-vswitchd.service/After=network-pre.target ovsdb-server.service ovs-vswitchd.service NetworkManager.service/g' /usr/lib/systemd/system/openvswitch.service\n sed -i -e 's/#external_network_bridge =/external_network_bridge = br-ex/g' /etc/neutron/l3_agent.ini", "delta": "0:00:00.007496", "end": "2019-02-11 19:17:40.043816", "rc": 0, "start": "2019-02-11 19:17:40.036320", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

PLAY RECAP ******************************************************************************************
master000.shift            : ok=6    changed=2    unreachable=0    failed=0