docker connection over remote host tcp no tls

[Esteban Mirizio]

Hi everyone! 

I'm Having a hard time trying to a remote docker connection over non tls. What I'm trying to achieve is to execute an ansible playbook inside a docker located in host A to another docker located in host B, FYI network mode is set to "host" on both docker hosts.

This is the playbook I'm trying to execute:

- hosts: localhost
  tasks:
  - name: add container to inventory
    add_host:
      name: git-slave
      ansible_connection: docker
      ansible_docker_extra_args: "-H=tcp://192.168.255.2:2375"
      ansible_user: root
    changed_when: false
  - name: Test gitblit
    delegate_to: git-slave
    raw: cat /var/log/gitblit

This is the error I'm getting:

fatal: [localhost]: UNREACHABLE! => {

    "changed": false,

    "msg": "Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote temp path in ansible.cfg to a path rooted in \"/tmp\". Failed command was: ( umask 77 && mkdir -p \"` echo ~/.ansible/tmp/ansible-tmp-1511161385.72-174791577619947 `\" && echo ansible-tmp-1511161385.72-174791577619947=\"` echo ~/.ansible/tmp/ansible-tmp-1511161385.72-174791577619947 `\" ), exited with result 1, stderr output: tls: oversized record received with length 20527\n",

    "unreachable": true

}

Here some test I did:

1. Ping from Host A to Host B
   
   
   root@integration-centralothers0:/home/ubuntu# ping -c3 192.168.255.2

   PING 192.168.255.2 (192.168.255.2) 56(84) bytes of data.

   64 bytes from 192.168.255.2: icmp_seq=1 ttl=63 time=2.44 ms

   64 bytes from 192.168.255.2: icmp_seq=2 ttl=63 time=2.17 ms

   64 bytes from 192.168.255.2: icmp_seq=3 ttl=63 time=1.66 ms

   
   

   --- 192.168.255.2 ping statistics ---

   3 packets transmitted, 3 received, 0% packet loss, time 2003ms

   rtt min/avg/max/mdev = 1.662/2.094/2.447/0.329 ms
   
   
   
2. Telnet from Host A to Host B against docker remote API:
   
   root@integration-centralothers0:/home/ubuntu# telnet 192.168.255.2 2375

   Trying 192.168.255.2...

   Connected to 192.168.255.2.

   Escape character is '^]'.

   
   

   HTTP/1.1 400 Bad Request

   Content-Type: text/plain; charset=utf-8

   Connection: close

   
   

   400 Bad RequestConnection closed by foreign host.
   
   
3. Remote Docker API test from Host A to Host B using curl
   curl -s -XGET http://192.168.255.2:2375/v1.24/images/json
   
   --Response--
   [{"Containers":-1,"Created":1510250403,"Id":"sha256:20233e267b88092164b554dcf2c7803d2c1eca109fa9224387e02df38e4c915d","Labels":{"com.ansible.container.fingerprint":"f6577dc923ef7ca2954ee10ef99b01f17e953bd26feef91b6ed4609fbd2af7cc"},"ParentId":"","RepoDigests":["registry.rando.b-yond.com:5000/rando/rando-git-slave@sha256:f5b16936de627ad526042d40a695653b79c1ff0031bd0a9cae09a75e10d1008d"],............
   
   
   
   
4. Execution of ansible playbook using local docker connection from inside HOST B to the target docker
   
   
   ansible all -i rando_git-slave_1, -vvvv -c docker -u root -m command -a "cat /var/log/gitblit.log"

   ansible 2.4.1.0

     config file = /etc/ansible/ansible.cfg

     configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']

     ansible python module location = /usr/lib/python2.7/dist-packages/ansible

     executable location = /usr/bin/ansible

     python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]

   Using /etc/ansible/ansible.cfg as config file

   setting up inventory plugins

   Parsed rando_git-slave_1, inventory source with host_list plugin

   Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/dist-packages/ansible/plugins/callback/__init__.pyc

   META: ran handlers

   Using module file /usr/lib/python2.7/dist-packages/ansible/modules/commands/command.py

   <rando_git-slave_1> ESTABLISH DOCKER CONNECTION FOR USER: root

   <rando_git-slave_1> EXEC ['/usr/bin/docker', 'exec', '-u', u'root', '-i', u'rando_git-slave_1', u'/bin/sh', '-c', u"/bin/sh -c 'echo ~ && sleep 0'"]

   <rando_git-slave_1> EXEC ['/usr/bin/docker', 'exec', '-u', u'root', '-i', u'rando_git-slave_1', u'/bin/sh', '-c', u'/bin/sh -c \'( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691 `" && echo ansible-tmp-1511165208.65-101293422432691="` echo /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691 `" ) && sleep 0\'']

   <rando_git-slave_1> PUT /tmp/tmpYGG6kk TO /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py

   <rando_git-slave_1> EXEC ['/usr/bin/docker', 'exec', '-u', u'root', '-i', u'rando_git-slave_1', u'/bin/sh', '-c', u"/bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/ /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py && sleep 0'"]

   <rando_git-slave_1> EXEC ['/usr/bin/docker', 'exec', '-u', u'root', '-i', u'rando_git-slave_1', u'/bin/sh', '-c', u'/bin/sh -c \'/usr/bin/python /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py; rm -rf "/root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/" > /dev/null 2>&1 && sleep 0\'']

   rando_git-slave_1 | SUCCESS | rc=0 >>

   2017-11-17 21:09:32 [INFO ]

     _____  _  _    _      _  _  _

    |  __ \(_)| |  | |    | |(_)| |

    | |  \/ _ | |_ | |__  | | _ | |_

    | | __ | || __|| '_ \ | || || __|  http://gitblit.com

    | |_\ \| || |_ | |_) || || || |_   @gitblit

     \____/|_| \__||_.__/ |_||_| \__|  1.8.0

   
   
   
   

I don't have idea what could be the problem, I will try to set up TLS and certificates in order to test the example that appears on http://docs.ansible.com/ansible/latest/intro_inventory.html#non-ssh-connection-types. 

Thanks in advance

[Tom van Duist]

Hey,

Did you ever solve this issue?

I'm running in to the same problem..

Op maandag 20 november 2017 08:09:47 UTC schreef Esteban Mirizio:

[dma...@istreamplanet.com]

I think your host B has SSL or TLS running on port 2375 OR ansible is trying to use TLS when the thing running on port 2375 isn't.

[Tom van Duist]

Thank you for the response.

Using 'openssl s_client -connect hostB:2375' from host A to host B I belive that SSL is not active on hostB:2375:

CONNECTED(00000003)

140680139757208:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794:

---

no peer certificate available

---

No client certificate CA names sent

---

SSL handshake has read 7 bytes and written 305 bytes

---

New, (NONE), Cipher is (NONE)

Secure Renegotiation IS NOT supported

Compression: NONE

Expansion: NONE

No ALPN negotiated

SSL-Session:

    Protocol  : TLSv1.2

    Cipher    : 0000

    Session-ID: 

    Session-ID-ctx: 

    Master-Key: 

    Key-Arg   : None

    PSK identity: None

    PSK identity hint: None

    SRP username: None

    Start Time: 1534945992

    Timeout   : 300 (sec)

    Verify return code: 0 (ok)

---

Furthermore I have set the ansible connection type to docker, but the problem persists:

- name: add container to inventory

  add_host:

    name: "{{ docker.container_name }}"

    ansible_docker_extra_args: "-H=tcp://hostB:2375"

    ansible_connection: docker

    ansible_user: docker

If I remove the 'ansible_connection: docker' from the 'add_host' task I get the following exception:

fatal: [hostB]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname docker_container: Temporary failure in name resolution\r\n", "unreachable": true}

Any other things I can try?

It looks like there is a problem with the permissions (instead of the connection) between the hosts/users.


Cheers!
Op dinsdag 21 augustus 2018 18:31:10 UTC schreef dma...@istreamplanet.com: