The ConfigWinRMListenerPlugin configures a WinRM HTTPS listener with a self signed certificate generated on the spot and enables (optionally) basic authentication, which means that a secure communication channel can be established between any client and the server being provisioned, without the requirement of having both the client and the server in the same domain. A firewall rule is added by cloudbase-init in the Windows firewall for TCP port 5986.
A this point you can login into your server. To begin with, don’t forget to add a rule to your security groups in OpenStack!
1
|
nova secgroup-add-rule default tcp 5986 5986 0.0.0.0/0
|
| - |
Get the admin password for the instance:
1
|
nova get-password yourinstance ~/.ssh/your_ssh_rsa_key
|
| - |
On your client connect to your instance as shown in the following PowerShell snippet:
If using WinRM your only “password less” options are certificate based auth which is a massive pain to setup and I would not recommend it or Kerberos. With Kerberos you can use kinit before running Ansible to get a token that is then used for subsequent authentication. Kinit also works with a pre generated key tab so you don’t need to set the password.
A final option is to use SSH with Windows with key auth. This is a fairly recent feature and it may still have some bugs but it does work.