Using Packer to build a windows box and provision with Ansible

116 views
Skip to first unread message

Richard Payne

unread,
Aug 12, 2019, 11:09:00 AM8/12/19
to Packer
tl:dr The Ansible provision will not connect to my Windows EC2 instances

This is my packer file:

{
    "variables": {
      "aws_access_key": "",
      "aws_secret_key": ""
    },
    "builders": [{
      "type": "amazon-ebs",
      "access_key": "{{user `aws_access_key`}}",
      "secret_key": "{{user `aws_secret_key`}}",
      "region": "eu-west-2",
      "vpc_id": "vpc-071989c63a4a111a2",
      "subnet_id": "subnet-04e9835b580b420b4",
      "source_ami": "ami-00ab607c2193c70c9",
      "instance_type": "t2.micro",
      "ami_name": "Windows Core 1809 {{timestamp}}",
      "user_data_file": "./user_data.ps1",
      "communicator": "winrm",
      "winrm_username": "Administrator",
      "winrm_use_ssl": true,
      "winrm_insecure": true,
      "run_tags": [
        { "windows": "" }
      ]
    }],
   "provisioners": [
      {
        "type": "ansible",
        "playbook_file": "../playbooks/windows_image_build/playbook.yml",        
        "extra_arguments": [
          "--extra-vars", "{'environment_name': 'packer', 'hosting_environment': 'aws', 'connection': 'packer'}",
          "--skip-tags", "gitchecks",
          "--skip-tags", "gather_facts",
          "--skip-tags", "slack"
        ]
      }
    ]
  }

The builder runs fine but the Ansible provisioner fails with this error:

==> amazon-ebs: Provisioning with Ansible...
==> amazon-ebs: Executing Ansible: ansible-playbook --extra-vars packer_build_name=amazon-ebs packer_builder_type=amazon-ebs -i /tmp/packer-provisioner-ansible213362483 /home/richard/git/ansible/playbooks/windows_image_build/playbook.yml --private-key /tmp/ansible-key656970276 --extra-vars environment_name=packer --extra-vars hosting_environment=aws --extra-vars connection=packer --skip-tags gitchecks --skip-tags gather_facts --skip-tags slack
    amazon-ebs:  [WARNING]: Found variable using reserved name: connection
    amazon-ebs:
    amazon-ebs: PLAY [all] *********************************************************************
    amazon-ebs:
    amazon-ebs: TASK [Gathering Facts] *********************************************************
    amazon-ebs: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo ~/.ansible/tmp/ansible-tmp-1565621734.13375-223774312712604 `\" && echo ansible-tmp-1565621734.13375-223774312712604=\"` echo ~/.ansible/tmp/ansible-tmp-1565621734.13375-223774312712604 `\" ), exited with result 1", "unreachable": true}
    amazon-ebs:         to retry, use: --limit @/home/richard/git/ansible/playbooks/windows_image_build/playbook.retry
    amazon-ebs:
    amazon-ebs: PLAY RECAP *********************************************************************
    amazon-ebs: default                    : ok=0    changed=0    unreachable=1    failed=0



I'm confused because it appears to be referring to the target box, but is also referring to Linux paths (/tmp).  The /tmp directory on the system I'm running packer from never visibly contains the temporary paths mentioned, even when stepping through using the -debug option.

If I manually hook it up using the ec2 inventory plugin:

plugin: aws_ec2
regions:
  - eu-west-2
filters:
  tag:Name: Packer Builder
compose:
  ansible_host: private_ip_address
hostnames:
  - network-interface.addresses.private-ip-address

and the following group vars:

ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore
ansible_port: 5986
ansible_winrm_scheme: https

then Ansible will connection start running the playbook.  I did try to do a manual connection use a local-shell provisioner but there doesn't appear to be any way to retrieve the ip address from Packer.

I can only assume I'm doing something wrong or the provisioner is broken.  Can any one give me some clues here?

dean warren

unread,
Aug 12, 2019, 11:24:02 AM8/12/19
to packe...@googlegroups.com
Doesn't the PACKER_LOG show the ip/port info?

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/packer/issues
IRC: #packer-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Packer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/packer-tool/9eb4db18-0ea0-478c-a569-ba4adda97b84%40googlegroups.com.

Richard Payne

unread,
Aug 13, 2019, 3:37:49 AM8/13/19
to Packer
I'm not seeing the IP in the log.  However, it might provide some info on what's wrong with the Ansible provisioner?


2019/08/13 07:37:43 packer: 2019/08/13 07:37:43 [DEBUG] Password is blank, will retry...
2019/08/13 07:37:49 ui:     amazon-ebs:
    amazon-ebs: Password retrieved!
    amazon-ebs:
    amazon-ebs: Password retrieved!
==> amazon-ebs: Waiting for WinRM to become available...
2019/08/13 07:37:49 packer: 2019/08/13 07:37:49 Waiting for WinRM, up to timeout: 30m0s
2019/08/13 07:37:49 ui: ==> amazon-ebs: Waiting for WinRM to become available...
2019/08/13 07:37:54 packer: 2019/08/13 07:37:54 [INFO] Attempting WinRM connection...
2019/08/13 07:37:54 packer: 2019/08/13 07:37:54 [DEBUG] connecting to remote shell using WinRM
2019/08/13 07:38:01 ui: ==> amazon-ebs: Connected to WinRM!
2019/08/13 07:38:01 packer: 2019/08/13 07:38:01 Running the provision hook
==> amazon-ebs: Connected to WinRM!
2019/08/13 07:38:01 [INFO] (telemetry) Starting provisioner ansible
2019/08/13 07:38:01 ui: ==> amazon-ebs: Provisioning with Ansible...
==> amazon-ebs: Provisioning with Ansible...
2019/08/13 07:38:02 packer: 2019/08/13 07:38:02 SSH proxy: serving on 127.0.0.1:36005
2019/08/13 07:38:02 ui: ==> amazon-ebs: Executing Ansible: ansible-playbook --extra-vars packer_build_name=amazon-ebs packer_builder_type=amazon-ebs -i /tmp/packer-provisioner-ansible774557480 /home/richard/git/ansible/playbooks/windows_image_build/playbook.yml --private-key /tmp/ansible-key713730989 --extra-vars {'environment_name': 'packer', 'hosting_environment': 'aws', 'connection': 'packer'} --skip-tags gitchecks --skip-tags gather_facts --skip-tags slack
==> amazon-ebs: Executing Ansible: ansible-playbook --extra-vars packer_build_name=amazon-ebs packer_builder_type=amazon-ebs -i /tmp/packer-provisioner-ansible774557480 /home/richard/git/ansible/playbooks/windows_image_build/playbook.yml --private-key /tmp/ansible-key713730989 --extra-vars {'environment_name': 'packer', 'hosting_environment': 'aws', 'connection': 'packer'} --skip-tags gitchecks --skip-tags gather_facts --skip-tags slack
2019/08/13 07:38:03 ui:     amazon-ebs:  [WARNING]: Found variable using reserved name: connection
    amazon-ebs:  [WARNING]: Found variable using reserved name: connection
    amazon-ebs:
2019/08/13 07:38:03 ui:     amazon-ebs:
2019/08/13 07:38:03 ui:     amazon-ebs: PLAY [all] *********************************************************************
    amazon-ebs: PLAY [all] *********************************************************************
2019/08/13 07:38:03 ui:     amazon-ebs:
    amazon-ebs:
2019/08/13 07:38:03 ui:     amazon-ebs: TASK [Gathering Facts] *********************************************************
    amazon-ebs: TASK [Gathering Facts] *********************************************************
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 SSH proxy: accepted connection
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 authentication attempt from 127.0.0.1:41696 to 127.0.0.1:36005 as richard using none
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 authentication attempt from 127.0.0.1:41696 to 127.0.0.1:36005 as richard using publickey
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new env request: LANG=en_GB.UTF-8
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new exec request: /bin/sh -c 'echo ~richard && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] starting remote command: /bin/sh -c 'echo ~richard && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] command '/bin/sh -c 'echo ~richard && sleep 0'' exited with code: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new env request: LANG=en_GB.UTF-8
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new exec request: /bin/sh -c 'echo "`pwd`" && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] starting remote command: /bin/sh -c 'echo "`pwd`" && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] command '/bin/sh -c 'echo "`pwd`" && sleep 0'' exited with code: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new env request: LANG=en_GB.UTF-8
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 new exec request: /bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" && echo ansible-tmp-1565678283.204747-204856165820508="` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" ) && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] starting remote command: /bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" && echo ansible-tmp-1565678283.204747-204856165820508="` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" ) && sleep 0'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] command '/bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" && echo ansible-tmp-1565678283.204747-204856165820508="` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `" ) && sleep 0'' exited with code: 1
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC endpoint: Communicator ended with: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdout'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 44 bytes written for 'stderr'
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] RPC client: Communicator ended with: 1
2019/08/13 07:38:03 packer: 2019/08/13 07:38:03 [INFO] 0 bytes written for 'stdin'
2019/08/13 07:38:03 ui:     amazon-ebs: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `\" && echo ansible-tmp-1565678283.204747-204856165820508=\"` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `\" ), exited with result 1", "unreachable": true}
    amazon-ebs: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `\" && echo ansible-tmp-1565678283.204747-204856165820508=\"` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508 `\" ), exited with result 1", "unreachable": true}
2019/08/13 07:38:03 ui:     amazon-ebs:         to retry, use: --limit @/home/richard/git/ansible/playbooks/windows_image_build/playbook.retry
    amazon-ebs:         to retry, use: --limit @/home/richard/git/ansible/playbooks/windows_image_build/playbook.retry
    amazon-ebs:
2019/08/13 07:38:03 ui:     amazon-ebs:
2019/08/13 07:38:03 ui:     amazon-ebs: PLAY RECAP *********************************************************************
    amazon-ebs: PLAY RECAP *********************************************************************
2019/08/13 07:38:03 ui:     amazon-ebs: default                    : ok=0    changed=0    unreachable=1    failed=0
    amazon-ebs: default                    : ok=0    changed=0    unreachable=1    failed=0
2019/08/13 07:38:03 ui:     amazon-ebs:
    amazon-ebs:



To unsubscribe from this group and stop receiving emails from it, send an email to packe...@googlegroups.com.

Richard Payne

unread,
Aug 13, 2019, 5:09:56 AM8/13/19
to Packer
Actually, the IP is in the standard output, not even debug.

No idea how you're supposed to use that though.

deanwarrenuk

unread,
Aug 13, 2019, 6:45:23 AM8/13/19
to Packer
Looks like its saying you don't have permissions to create ~/.ansible/tmp/etc... 
e.g.
exec request: /bin/sh -c '( umask 77 && mkdir -p "` echo ~/.ansible/tmp/ansible-tmp-1565678283.204747-204856165820508...
amazon-ebs: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "Authentication or permission failure.

Does the user have those permission?

deanwarrenuk

unread,
Aug 13, 2019, 8:47:51 AM8/13/19
to Packer

John Roh

unread,
Aug 13, 2019, 1:20:52 PM8/13/19
to packe...@googlegroups.com
I had the tough time to make this working as well, however, I am on packer 1.4.0 and ansible 2.4.0 (any upper version I have tried all failed). 
Also, I could check the inbound rule to make sure 5985 or 5986 (https) which ever you defined ("winrm_port" : 5986, I don't see from your template). 

John.

On Tue, Aug 13, 2019 at 5:47 AM deanwarrenuk <dean.wa...@gmail.com> wrote:

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/mitchellh/packer/issues
IRC: #packer-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Packer" group.
To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/packer-tool/e13608ae-3040-46e9-a9c1-0faa8e676a51%40googlegroups.com.

deanwarrenuk

unread,
Aug 13, 2019, 4:15:25 PM8/13/19
to Packer
Just dawned on me, the IP is also available as {{.HTTPIP}} as used in the builder boot_command. Now whether this is available as where I am not sure...


On Tuesday, 13 August 2019 10:09:56 UTC+1, Richard Payne wrote:

Richard Payne

unread,
Aug 14, 2019, 3:39:18 AM8/14/19
to Packer
Yeah, the relevant directories are accessible and writable by my user.

I have managed to get it working using this:

You have to create connection plugin alongside the playbook.

Alvaro Miranda Aguilera

unread,
Aug 16, 2019, 10:34:47 AM8/16/19
to packe...@googlegroups.com
hello 

could you share some code that works?

in case someone came later to this thread, will be good to have a working example

thanks
alvaro

To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/packer-tool/7907eeff-6e0d-444c-a2b1-446d92eef894%40googlegroups.com.


--
Alvaro

Richard Payne

unread,
Aug 20, 2019, 3:01:07 AM8/20/19
to Packer
This is what I have:

Packer JSON:

{
    "variables": {
      "aws_access_key": "",
      "aws_secret_key": ""
    },
    "builders": [{
      "type": "amazon-ebs",
      "access_key": "{{user `aws_access_key`}}",
      "secret_key": "{{user `aws_secret_key`}}",
      "region": "eu-west-2",
      "vpc_id": "vpc-xxxxxxxxxxx",
      "subnet_id": "subnet-xxxxxxxxxxxx",
      "source_ami": "ami-xxxxxxxxxxx",
      "instance_type": "t2.micro",
      "iam_instance_profile": "packer_builder",      
      "ami_name": "Windows Core 1809 {{timestamp}}",
      "user_data_file": "./user_data.ps1",
      "communicator": "winrm",
      "winrm_username": "Administrator",
      "winrm_use_ssl": true,
      "winrm_insecure": true,
      "tags": [
        { "windows": "" } 
      ],
      "launch_block_device_mappings": [{
        "delete_on_termination": "true",
        "device_name": "xvde",
        "volume_size": 100,
        "volume_type": "gp2"
      }]
    }],
   "provisioners": [
      {
        "type": "ansible",
        "playbook_file": "../playbooks/windows_image_build/playbook.yml",
        "extra_arguments": [
          "--connection", "packer",
          "--extra-vars", "ansible_shell_type=powershell ansible_shell_executable=None"
        ]
      }
    ]
  }


user_data.ps1:

<powershell>

#Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
#Enable-PSRemoting -SkipNetworkProfileCheck -Force

write-output "Running User Data Script"
write-host "(host) Running User Data Script"

Set-ExecutionPolicy Unrestricted -Scope LocalMachine -Force -ErrorAction Ignore

# Don't set this before Set-ExecutionPolicy as it throws an error
$ErrorActionPreference = "stop"

# Remove HTTP listener
Remove-Item -Path WSMan:\Localhost\listener\listener* -Recurse

Set-Item WSMan:\localhost\MaxTimeoutms 1800000
Set-Item WSMan:\localhost\Service\Auth\Basic $true

$Cert = New-SelfSignedCertificate -CertstoreLocation Cert:\LocalMachine\My -DnsName "packer"
New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $Cert.Thumbprint -Force

# WinRM
write-output "Setting up WinRM"
write-host "(host) setting up WinRM"

cmd.exe /c winrm quickconfig -q
cmd.exe /c winrm set "winrm/config" '@{MaxTimeoutms="1800000"}'
cmd.exe /c winrm set "winrm/config/winrs" '@{MaxMemoryPerShellMB="1024"}'
cmd.exe /c winrm set "winrm/config/service" '@{AllowUnencrypted="true"}'
cmd.exe /c winrm set "winrm/config/client" '@{AllowUnencrypted="true"}'
cmd.exe /c winrm set "winrm/config/service/auth" '@{Basic="true"}'
cmd.exe /c winrm set "winrm/config/client/auth" '@{Basic="true"}'
cmd.exe /c winrm set "winrm/config/service/auth" '@{CredSSP="true"}'
cmd.exe /c winrm set "winrm/config/listener?Address=*+Transport=HTTPS" "@{Port=`"5986`";Hostname=`"packer`";CertificateThumbprint=`"$($Cert.Thumbprint)`"}"
cmd.exe /c netsh advfirewall firewall set rule group="remote administration" new enable=yes
cmd.exe /c netsh firewall add portopening TCP 5986 "Port 5986"
cmd.exe /c net stop winrm
cmd.exe /c sc config winrm start= auto
cmd.exe /c net start winrm

</powershell>


ec2launch.json:

{
    "setComputerName": false,
    "setWallpaper": false,
    "addDnsSuffixList": false,
    "extendBootVolumeSize": false,
    "handleUserData": false,                      
    "adminPasswordType": "Random"
}


aws_ec2.yml (dynamic inventory):

plugin: aws_ec2
regions:
  - eu-west-2 
filters:
  tag:Name: Packer Builder
keyed_groups:
  - key: tags
    prefix: ''
    separator: ""  
compose:
  ansible_host: private_ip_address
hostnames:
  - network-interface.addresses.private-ip-address

groups_vars/windows:

ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore
ansible_port: 5986
ansible_winrm_scheme: https


Rickard von Essen

unread,
Aug 20, 2019, 3:16:52 AM8/20/19
to packe...@googlegroups.com
Don't know much about the Windows stuff but you don't need the dynamic EC2 inventory, remove it and try again. 

To unsubscribe from this group and stop receiving emails from it, send an email to packer-tool...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/packer-tool/8f7d06ae-91a0-4662-8849-63dd7d873e5b%40googlegroups.com.

Richard Payne

unread,
Aug 20, 2019, 5:27:43 AM8/20/19
to Packer
This issue is solved and I posted the code at Alvaro's request.  
Reply all
Reply to author
Forward
0 new messages