2

Edit: this seems to impact any task that I add the prefix_to property to, instead of just the uri module.

Edit 2: Rounding it down - removing become: yes fixes it in the test playbook I made. The actual playbook requires super user privileges, so it doesn't solve this question, but it might help in figuring out what's going on!


For background - I'm trying to deploy rke2 using Rancher's Ansible role. I found a particular task hanging so pulled it out into a standalone playbook.

When I run this, commenting out the delegate_to works successfully:

---
- name: test failing task
  hosts: rke2_cluster
  become: yes
  vars:
    rke2_channel: "stable"
  tasks:
    - name: TARBALL | Get full version name url
      uri:
        url: https://update.rke2.io/v1-release/channels/{{ rke2_channel }}
        follow_redirects: all
      register: rke2_version_url
      # delegate_to: 127.0.0.1
    
    - name: print url
      debug: 
        msg: "{{ rke2_version_url.url }}"

outputs:

ansible-playbook -i inventories/development/rke2_dev.yml -K -u ansible playbooks/development/rke2_test.yml
[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the controller starting with Ansible 2.12. Current version: 3.6.9 (default, Jan 26 2021, 15:33:00) [GCC 8.4.0]. This feature will be removed from 
ansible-core in version 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
BECOME password: 

PLAY [test failing task] ************************************************************************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************************************************************************************
ok: [10.10.77.68]

TASK [TARBALL | Get full version name url] ******************************************************************************************************************************************************************************
ok: [10.10.77.68]

TASK [print debug] ******************************************************************************************************************************************************************************************************
ok: [10.10.77.68] => {
    "msg": "https://github.com/rancher/rke2/releases/tag/v1.21.3+rke2r1"
}

PLAY RECAP **************************************************************************************************************************************************************************************************************
10.10.77.68                : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 

However, if I uncomment the delegate_to (which as far as I understand, makes the command run on the machine running ansible), it hangs at the Get full version name url step and never times out:

(with -vvv)

TASK [TARBALL | Get full version name url] ***************************************************************************************************************************************************************************************
task path: /home/username/repo/playbooks/development/rke2_test.yml:8
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: username
<127.0.0.1> EXEC /bin/sh -c 'echo ~username && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/username/.ansible/tmp `"&& mkdir "` echo /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387 `" && echo ansible-tmp-1627533289.9444108-1997530-278576600249387="` echo /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387 `" ) && sleep 0'
Using module file /home/username/repo/venv/lib/python3.6/site-packages/ansible/modules/uri.py
<127.0.0.1> PUT /home/username/.ansible/tmp/ansible-local-1997470y4pvg7my/tmp1t0q1uen TO /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387/AnsiballZ_uri.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387/ /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387/AnsiballZ_uri.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c 'sudo -H -S  -p "[sudo via ansible, key=ysckktxpcgauzytljfjbljwgnujzabqy] password:" -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-ysckktxpcgauzytljfjbljwgnujzabqy ; /home/username/repo/venv/bin/python3 /home/username/.ansible/tmp/ansible-tmp-1627533289.9444108-1997530-278576600249387/AnsiballZ_uri.py'"'"' && sleep 0'

This happens on all the remote hosts I tried. I can confirm the ansible host can connect to the remote server:

» nc -zv -w 1 update.rke2.io 443
Connection to update.rke2.io 443 port [tcp/https] succeeded!
» curl https://update.rke2.io/v1-release/channels/stable
<a href="https://github.com/rancher/rke2/releases/tag/v1.21.3+rke2r1">Found</a>.

Is this a bug within the ansible uri module, or something else? Can anyone reproduce this?

ansible version:

ansible [core 2.11.2] 
  config file = /home/username/repo/ansible.cfg
  configured module search path = ['/home/username/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/username/repo/venv/lib/python3.6/site-packages/ansible
  ansible collection location = /home/username/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/username/repo/venv/bin/ansible
  python version = 3.6.9 (default, Jan 26 2021, 15:33:00) [GCC 8.4.0]
  jinja version = 3.0.1
  libyaml = True
Ben S
  • 95
  • 1
  • 7
  • 1
    Based solely upon the very limited output you've provided, you'll want to strongly consider removing `become: yes` since there's nothing in your (provided) playbook that requires root, and it's an opportunity for the local privilege escalation to go toes up. Toward that end, running ansible-playbook with increased verbosity (`-vvv`) will show you what it is attempting to do, which is not something we can guess – mdaniel Jul 29 '21 at 02:21
  • @mdaniel thanks, added `-vvv` output above. Removing `become: yes` fixes it in the test playbook, which may give some clues as to what's going on. – Ben S Jul 29 '21 at 04:44
  • 1
    In that case, I'd guess your local `sudo` config is not "allow passwordless everything," [which ansible requires](https://docs.ansible.com/ansible/2.10/user_guide/become.html#privilege-escalation-must-be-general) – mdaniel Jul 29 '21 at 15:30

0 Answers0