0

I'm new to Ansible, Ansible Tower, and AWS Cloud Formation and am trying to have Ansible Tower deploy an EC2 Container Service using a Cloud Formation template. I try to run the deploy job and am running into this error below. 

 TASK [create/update stack] *****************************************************
  task path: /var/lib/awx/projects/_6__api/tasks/create_stack.yml:2
  <127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: awx
  <127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo         $HOME/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790 `" && echo ansible-tmp-1470427494.79-207756006727790="` echo $HOME/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790 `" ) && sleep 0'
<127.0.0.1> PUT /tmp/tmpgAsKKv TO /var/lib/awx/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790/cloudformation
<127.0.0.1> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-coqlkeqywlqhagfixtfpfotjgknremaw; LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 AWS_DEFAULT_REGION=us-west-2 LC_MESSAGES=en_US.UTF-8 /usr/bin/python /var/lib/awx/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790/cloudformation; rm -rf "/var/lib/awx/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790/" > /dev/null 2>&1'"'"' && sleep 0'
fatal: [localhost]: FAILED! => {"changed": false, "failed": true, "invocation": {"module_name": "cloudformation"}, "module_stderr": "/bin/sh: /usr/bin/sudo: Permission denied\n", "module_stdout": "", "msg": "MODULE FAILURE", "parsed": false}

This is the create/update task:

---
- name: create/update stack
  cloudformation:
    stack_name: my-stack
    state: present
    template: templates/stack.yml
    template_format: yaml
    template_parameters:
      VpcId: "{{ vpc_id }}"
      SubnetId: "{{ subnet_id }}"
      KeyPair: "{{ ec2_keypair }}"
      DbUsername: "{{ db_username }}"
      DbPassword: "{{ db_password }}"
      InstanceCount: "{{ instance_count | default(1) }}"
   tags:
     Environment: test
  register: cf_stack

- debug: msg={{ cf_stack }}
  when: debug is defined

The playbook that Ansible Tower executes is a site.yml file:

---
- name: Deployment Playbook
  hosts: localhost
  connection: local
  gather_facts: no
  environment:
    AWS_DEFAULT_REGION: "{{ lookup('env', 'AWS_DEFAULT_REGION') | default('us-west-2', true) }}"
  tasks:
    - include: tasks/create_stack.yml
    - include: tasks/deploy_app.yml

This is what my playbook folder structure looks like:

/deploy
    /group_vars
       all
    /library
       aws_ecs_service.py
       aws_ecs_task.py 
       aws_ecs_taskdefinition.py
    /tasks
      stack.yml
    /templates
      site.yml

I'm basing everything really on Justin Menga's pluralsight course "Continuous Delivery using Docker and Ansible", but he uses Jenkins, not Ansible Tower, which is probably why the disconnect. Anyway, hopefully that is enough information, let me know if I should also provide the stack.yml file. The files under the library directory are Menga's customized modules from his video course.

Thanks for reading all this and for any potential help! This is a link to his deploy playbook repository that I closely modeled everything after, https://github.com/jmenga/todobackend-deploy. Things that I took out are the DB RDS stuff.

4

1 回答 1

1

如果您查看错误消息的最后两行，您会发现它正在尝试提升权限但失败了：

<127.0.0.1> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-coqlkeqywlqhagfixtfpfotjgknremaw; LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 AWS_DEFAULT_REGION=us-west-2 LC_MESSAGES=en_US.UTF-8 /usr/bin/python /var/lib/awx/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790/cloudformation; rm -rf "/var/lib/awx/.ansible/tmp/ansible-tmp-1470427494.79-207756006727790/" > /dev/null 2>&1'"'"' && sleep 0'
fatal: [localhost]: FAILED! => {"changed": false, "failed": true, "invocation": {"module_name": "cloudformation"}, "module_stderr": "/bin/sh: /usr/bin/sudo: Permission denied\n", "module_stdout": "", "msg": "MODULE FAILURE", "parsed": false}

由于这是一项本地任务，它试图切换到运行 Ansible Tower 的机器上的 root 用户，而该用户可能（并且有充分的理由）没有执行此操作的权限。

使用普通的 Ansible，您可以通过不在命令行上指定--becomeor标志或在任务/播放定义中指定来避免这种情况。-bbecome: false

正如您在评论中指出的那样，对于 Ansible Tower，这是在作业模板中取消选中“启用特权升级”选项的情况。

于 2016-08-07T11:20:13.543 回答