Ansible 2.0 VMWare modules

Archives Ansible Project
21

So I’ve tried with two different environments, one vSphere 6, one with 5.5 and it does’t seem to work. Always comes back with [SSL: CERTIFICATE_VERIFY_FAILED] even when set to false

22

I installed the ansible from devel branch, I got the same issue even set validate_certs to false.
My test environment:

Ubuntu: 14.04
Python: 2.7.6
vSphere 5.5

23

I’ll add that I also tried on Ubuntu 15.04 w Python 2.7.10

24

So it appears this is still an issue? Would be awesome to get this fixed in the GA release so we can proceed with testing out the modules w/out hacks. Also not assuming that every environment uses self-signed certs should have been considered initially???

25

I’ve been struggling with these SSL CERTIFICATE_VERIFY_ISSUES also. I can’t get validate_certs: false to work, I’ve even downloaded the unsigned cert, converted it to PEM and added it to /usr/local/etc/openssl/certs and run /usr/local/opt/openssl/bin/c_rehash to no avail. Something is definitely broken with the validate_certs parameter (at least on my OSX machine running python 2.7.11 and ansible (2.0.1.0))

The only way I’ve found to get this working, which might work for you guys is to open up the following file:

./ansible/modules/core/cloud/vmware/vsphere_guest.py (or whatever module vmware module you’re using that connects via SSL).

This file is usually located in your /Library/Python/2.7/site-packages/ folder (OSX)
or
/usr/lib/python2.7/site-packages/ (redhat/centos)

And ADD the following lines below the initial comments:

import requests, ssl
requests.packages.urllib3.disable_warnings()
try:
_create_unverified_https_context = ssl._create_unverified_context
except AttributeError:
pass
else:
ssl._create_default_https_context = _create_unverified_https_context

Also, make sure you have the requests module installed.

Hope this gets fixed soon, but in the meantime that should work to completely disable SSL and make everything super unsecure :slight_smile:

26

Thanks for the tips Julian! Hoping to show this off at work without any hacks. Don’t want it to come off as glitchy and unsupportable

27

I’ve tested it with the same configuration and I can confirm it’s not working. I’ll try to fix it until the end of week.

28

I’ve created PR with a small fix (https://github.com/ansible/ansible/pull/14988) that I’ve tested with Ubuntu 15.10/14.04 and Python 2.7.11. This should resolve the issue with Python > 2.7.9. I"m not sure about older python, since it shouldn’t validate certificates in a first place.

Kamil

29

Thanks, look forward to testing. As I sit here now, I also wonder if this is a pyVmomi specific issue…

30

I had the same thing on my mind this morning, but I’m not certain if this is a pyvmomi issue.

Kamil

31

In any case, thank you so much for looking into it. I’ll keep an eye on the PR to see when it is merged.

32

If you’d like to try it out ASAP, my fork is up to date with ansible main devel.

Kamil

33

That would be fantastic. I think there’s a great deal of people using self-signed certs with vsphere.

34

Hi Jonathan,

I was so happy to see this post. I have struggled almost a day for this but could not rersolve this.
did you have any luck on this issue…

Thanks,
Vijay

35

Hi Kamil,

I am facing the similar issue related to certificate. :frowning: do you know the solution ?

Thanks,
Vijay

36

Hi Vijay,

I have a friend who may have a solution, though I have not been able to test. You can try

add the below into the file: /usr/lib/python2.7/site-packages/pyVim/connect.py

try:
if sslContext is not None and sslContext.verify_mode == ssl.CERT_NONE:
sock = requests.get(url, verify=False)
else:
sock = requests.get(url, verify=False)