docker connection over remote host tcp no tls

Archives Ansible Project
1

Hi everyone!

I’m Having a hard time trying to a remote docker connection over non tls. What I’m trying to achieve is to execute an ansible playbook inside a docker located in host A to another docker located in host B, FYI network mode is set to “host” on both docker hosts.

This is the playbook I’m trying to execute:

`

  • hosts: localhost
    tasks:
  • name: add container to inventory
    add_host:
    name: git-slave
    ansible_connection: docker
    ansible_docker_extra_args: “-H=tcp://192.168.255.2:2375”
    ansible_user: root
    changed_when: false
  • name: Test gitblit
    delegate_to: git-slave
    raw: cat /var/log/gitblit
    `

This is the error I’m getting:

fatal: [localhost]: UNREACHABLE! => {
“changed”: false,
“msg”: “Authentication or permission failure. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote temp path in ansible.cfg to a path rooted in "/tmp". Failed command was: ( umask 77 && mkdir -p "echo ~/.ansible/tmp/ansible-tmp-1511161385.72-174791577619947" && echo ansible-tmp-1511161385.72-174791577619947="echo ~/.ansible/tmp/ansible-tmp-1511161385.72-174791577619947" ), exited with result 1, stderr output: tls: oversized record received with length 20527\n”,
“unreachable”: true
}

Here some test I did:

  1. Ping from Host A to Host B

    `

    root@integration-centralothers0:/home/ubuntu# ping -c3 192.168.255.2
    PING 192.168.255.2 (192.168.255.2) 56(84) bytes of data.
    64 bytes from 192.168.255.2: icmp_seq=1 ttl=63 time=2.44 ms
    64 bytes from 192.168.255.2: icmp_seq=2 ttl=63 time=2.17 ms
    64 bytes from 192.168.255.2: icmp_seq=3 ttl=63 time=1.66 ms

    — 192.168.255.2 ping statistics —
    3 packets transmitted, 3 received, 0% packet loss, time 2003ms
    rtt min/avg/max/mdev = 1.662/2.094/2.447/0.329 ms

    `

  2. Telnet from Host A to Host B against docker remote API:

    `

    root@integration-centralothers0:/home/ubuntu# telnet 192.168.255.2 2375
    Trying 192.168.255.2…
    Connected to 192.168.255.2.
    Escape character is ‘^]’.

    HTTP/1.1 400 Bad Request
    Content-Type: text/plain; charset=utf-8
    Connection: close

    400 Bad RequestConnection closed by foreign host.

    `

  3. Remote Docker API test from Host A to Host B using curl
    `

    curl -s -XGET http://192.168.255.2:2375/v1.24/images/json

    –Response–
    [{“Containers”:-1,“Created”:1510250403,“Id”:“sha256:20233e267b88092164b554dcf2c7803d2c1eca109fa9224387e02df38e4c915d”,“Labels”:{“com.ansible.container.fingerprint”:“f6577dc923ef7ca2954ee10ef99b01f17e953bd26feef91b6ed4609fbd2af7cc”},“ParentId”:“”,“RepoDigests”:[“registry.rando.b-yond.com:5000/rando/rando-git-slave@sha256:f5b16936de627ad526042d40a695653b79c1ff0031bd0a9cae09a75e10d1008d”],…

    `

  4. Execution of ansible playbook using local docker connection from inside HOST B to the target docker

    `

    ansible all -i rando_git-slave_1, -vvvv -c docker -u root -m command -a “cat /var/log/gitblit.log”
    ansible 2.4.1.0
    config file = /etc/ansible/ansible.cfg
    configured module search path = [u’/root/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’]
    ansible python module location = /usr/lib/python2.7/dist-packages/ansible
    executable location = /usr/bin/ansible
    python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]
    Using /etc/ansible/ansible.cfg as config file
    setting up inventory plugins
    Parsed rando_git-slave_1, inventory source with host_list plugin
    Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/dist-packages/ansible/plugins/callback/init.pyc
    META: ran handlers
    Using module file /usr/lib/python2.7/dist-packages/ansible/modules/commands/command.py
    <rando_git-slave_1> ESTABLISH DOCKER CONNECTION FOR USER: root
    <rando_git-slave_1> EXEC [‘/usr/bin/docker’, ‘exec’, ‘-u’, u’root’, ‘-i’, u’rando_git-slave_1’, u’/bin/sh’, ‘-c’, u"/bin/sh -c ‘echo ~ && sleep 0’“]
    <rando_git-slave_1> EXEC [‘/usr/bin/docker’, ‘exec’, ‘-u’, u’root’, ‘-i’, u’rando_git-slave_1’, u’/bin/sh’, ‘-c’, u’/bin/sh -c '( umask 77 && mkdir -p “echo /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691” && echo ansible-tmp-1511165208.65-101293422432691=“echo /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691” ) && sleep 0'‘]
    <rando_git-slave_1> PUT /tmp/tmpYGG6kk TO /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py
    <rando_git-slave_1> EXEC [’/usr/bin/docker’, ‘exec’, ‘-u’, u’root’, ‘-i’, u’rando_git-slave_1’, u’/bin/sh’, ‘-c’, u”/bin/sh -c ‘chmod u+x /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/ /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py && sleep 0’"]
    <rando_git-slave_1> EXEC [‘/usr/bin/docker’, ‘exec’, ‘-u’, u’root’, ‘-i’, u’rando_git-slave_1’, u’/bin/sh’, ‘-c’, u’/bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/command.py; rm -rf “/root/.ansible/tmp/ansible-tmp-1511165208.65-101293422432691/” > /dev/null 2>&1 && sleep 0'']
    rando_git-slave_1 | SUCCESS | rc=0 >>
    2017-11-17 21:09:32 [INFO ]

    __ ()| | | | | |()| |

    / _ | |_ | |__ | | _ | |_
    __ | || || ’ \ | || || | http://gitblit.com
    \ | || | | |) || || || | @gitblit
    _    /|| _||.__/ |||| _| 1.8.0

    `

I don’t have idea what could be the problem, I will try to set up TLS and certificates in order to test the example that appears on http://docs.ansible.com/ansible/latest/intro_inventory.html#non-ssh-connection-types.

Thanks in advance

2

Hey,

Did you ever solve this issue?

I’m running in to the same problem…

3

I think your host B has SSL or TLS running on port 2375 OR ansible is trying to use TLS when the thing running on port 2375 isn’t.

4

Thank you for the response.

Using ‘openssl s_client -connect hostB:2375’ from host A to host B I belive that SSL is not active on hostB:2375:

`

CONNECTED(00000003)
140680139757208:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:794: