Times out and terminates aws instance before windows server password retrieval. #201
Comments
|
I have a slightly different issue... it doesn't terminate the instance -- but it does fail to obtain the password, then gets into a state in which it tries to login, but cannot: @JaBurd I am not really clear about your suggestion to increase the values for |
|
@rhass a WinRM auth error is a different issue because it has successfully grabbed the password from the EC2 API and is now trying to authenticate with it. Try running test kitchen in debug mode and checking that the username/password/etc that test kitchen attempts to authenticate with are what you would expect them to be. |
|
@rhass Yes, that error is indicating kitchen is unable to authenticate properly with the instance. Definitely run the statement suggested by @zl4bv or This will show you the entire configuration kitchen is using. Also check the following: In your .kitchen.yml transport make sure the username: tag matches the admin account of the instance. Also, in the .kitchen folder a .yml file will get created which contains key information kitchen uses to connect to your instance. I've found this file doesn't get written until your kitchen process has completed. i.e. if you exit out of the process before it either errors or completes this file will be blank. Check this file to see if the information is correct to connect to your instance. I've finally found that my situation is quite unique. I need to be on my corporate proxy for Kitchen to initially create my instance. Once the converge gets to the point of connecting via winrm to upload cookbooks it will fail. It seems my corporate proxy sees the winrm traffic as http web traffic and intercepts it. I have to wait for it to fail, remove my proxy and re-start the converge. Yes, as to the initial comment above, Windows can really take 20 minutes to be ready for login. The default 5 minutes is far too short for windows instances. At a minimum the readme should call this out somewhere. |
|
@JaBurd I realize it is unable to authenticate, but the root cause for the authentication failure with WinRM is the initial converge it gets a null value for the password when it attempt to retrieve it from AWS and decrypt the value against the ssh key. The result is the password key/value in the state file is never created, and the driver does not attempt to retrieve the key ever again if the value is missing from the state/state-file. The following is what I see when I try to converge a node for the first time: I have attempted to hack the driver in various ways to force it to request the key every time to prove out the issue and possibly fix it, but so far I have been unsuccessful. I think the various wait methods assume if the state/state-file is defined, then no work is needed to be done and effectively skips the call to https://github.com/test-kitchen/kitchen-ec2/blob/master/lib/kitchen/driver/ec2.rb#L222 However, it seems |
|
Quick update -- I did get further with everything specified correctly in my .kitchen.local.yml for this. ---
platforms:
- name: windows-2012r2
driver:
name: ec2
region: us-west-2
availability_zone: b
image_id: ami-f8f715cb
instance_type: t2.small
associate_public_ip: true
subnet_id: subnet-CENSORED
aws_ssh_key_id: public-key-name-in-aws
transport:
ssh_key: /path/to/private/keyfileNow it seems to get stuck in a loop with |
|
@rhass-r7 Did you ever get this resolved? I am setting this up for the first time and have a similar error |
|
I'm not sure I have ever used kitchen-ec2 to converge windows boxes. I have used knife-ec2 and passed a userdata file which creates a user on the fly with username and password you tell it to use. I believe kitchen-ec2 does the same hen you tell it the credentials to use. Once you get past authorization, you also need to setup the winrm settings necessary depending on the transport you are using (ssl/plain text). This may include allowing unencrypted traffic. If you try to use basic auth and the target machine's winrm config does not allow it, you won't get very far. So those might be some things to look at on the target box to try and figure out why winrm connections are failing. |
|
I've converged many Windows machines via kitchen-ec2. The biggest issue In my ,kitchen.yml I had to override the default retryable_tries and retryable_tries: 200 I get winrm issues due to our corporate proxy blocking winrm traffic once
On Fri, Jan 8, 2016 at 7:12 PM, Matt Wrock [email protected] wrote:
|
In my experience kitchen-ec2's default timeouts are usually long enough when converging Windows machines using the Amazon-provided Windows AMIs. However, when using "baked" Windows AMIs the timeouts in kitchen-ec2 are almost always reached before the Windows password is retrieved. Setting |
cheeseplus
changed the title
|
@zl4bv @JaBurd This is my .kitchen.cloud.yml |
|
@jsmickey yeah, if I set the timeout to long enough it gets the Windows password. Would you be able to paste the full backtrace from |
|
@jsmickey @JaBurd with increasing of the Console Output
This is how my
|
|
I am launching into an ec2-classic account, and kept getting Using a combination of solutions from above what finally allowed my transport:
name: 'winrm'
ssh_key: /Users/user1/chef-repo/cookbooks/win_config/win_config.pem
platforms:
- name: windows-2008r2
driver_config:
guest: windows
communicator: 'winrm'full file here if it helps anyone |
|
@rojomisin I am so glad I read all the way to your comment because what you have snipped into your post is what got mine working after trying to increase the retry counts etc which did nothing to help. Thank you so much for posting your solution! |
|
This has been apparently going on for quite a while. I'm also having this issue. My yaml looks like this: my .kitchen/default.yml looks like this during the kitchen create command: After I cancel the command or it times out it writes out a file that looks like this: It seems to be unable to get the username/password from AWS When I run This is really confirming that the password is not getting set correctly in the I'm generating my ssh key with this AWS command: I notice some people are using a .pem file. Is that the same as what I'm doing with my ssh key? How can I get the default admin password from AWS as atleast a minimum workaround? As an asside for other people with issues w/ this you need to have the default winrm port 5985 and most likely the rdp port 3389 open for this to have a shot at connecting. |
|
Ok, I did some sleuthing on this issue. This is not an issue with kitchen-ec2 directly. calls the Ruby AWS library aws-sdk and function: Now the issue is that this times out around 245 seconds or so. No matter what you put in for the timeout, it fails before the number it has been given. From the docs It could be that it is using an older version of the API that had a bug, but I am not sure. I have not run a test on the side using the aws-sdk gem to validate. Sorry about the formatting. |
|
I'm closing this one out given the age and meandering nature - we've definitely addressed some of the issues in kitchen-ec2 as best we can as well as aws-sdk updates. If folks are seeing this with version 1.4+ please open a new issue with the relevant diagnostic data. |
The kitchen ec2 driver waits for the AWS ec2 windows server to be able to provide the password before moving forward.
However this process can take up to 30 minutes as stated in Amazon's documentation. http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/IIS4.1GettingPassword.html
Kitchen-ec2's default wait time is only 5 minutes. Suggest either better documentation for changing these default values:
Or increasing these when the platform is a windows instance.
The text was updated successfully, but these errors were encountered: