linux - Ansible ec2_vpc_igw VPC 不存在

Question

我正在编写一本剧本来部署带有互联网网关的 VPC。由于某种原因，Ansible 模块无法找到网关。 documentation此模块上的内容稀疏，示例不完整。

Ansible 位:

- name: Create default VPC
  ec2_vpc_net:
    name: acme_baseline
    cidr_block: 10.11.0.0/16
    region: us-east-1
    state: present
    tags:
      Owner: "someuser"
  register: baseline_vpc

- name: Create internet gateway
  ec2_vpc_igw:
    vpc_id: "{{ baseline_vpc.vpc.id }}"
    region: us-east-1
    state: present
    tags:
      Name: "acme_baseline"
      Owner: "someuser"
  register: baseline_igw

直接 AWS CLI 可以毫无问题地找到 VPC:

# aws ec2 describe-vpcs --vpc-ids vpc-0123546897 --region us-east-1
{
    "Vpcs": [
        {
            "IsDefault": false,
            "Tags": [
                {
                    "Value": "acme_baseline",
                    "Key": "Name"
                },
                {
                    "Value": "someuser",
                    "Key": "Owner"
                }
            ],
            "CidrBlockAssociationSet": [
                {
                    "CidrBlock": "10.11.0.0/16",
                    "CidrBlockState": {
                        "State": "associated"
                    },
                    "AssociationId": "vpc-cidr-assoc-00001444444"
                }
            ],
            "VpcId": "vpc-0123546897",
            "CidrBlock": "10.11.0.0/16",
            "State": "available",
            "DhcpOptionsId": "dopt-aaaaaaa",
            "OwnerId": "000000000000",
            "InstanceTenancy": "default"
        }
    ]
}

两个 Ansible block 的输出(详细模式 x3):

ansible-playbook 2.7.9
  config file = None
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible-playbook
  python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

TASK [aws-baseline : Create default VPC] ***************************************************************************************************************************************
task path: /root/foo/roles/aws-baseline/tasks/main.yml:26
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: root
<localhost> EXEC /bin/sh -c 'echo ~root && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz `" && echo ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz="` echo /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz `" ) && sleep 0'
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/ec2_vpc_net.py
<localhost> PUT /root/.ansible/tmp/ansible-local-14593RSX_GI/tmpMcth9v TO /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py
<localhost> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/ /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/AnsiballZ_ec2_vpc_net.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-zzzzzzzzzzzzzzzzzzzzzz/ > /dev/null 2>&1 && sleep 0'
ok: [localhost] => {
    "changed": false,
    "invocation": {
        "module_args": {
            "aws_access_key": null,
            "aws_secret_key": null,
            "cidr_block": [
                "10.11.0.0/16"
            ],
            "dhcp_opts_id": null,
            "dns_hostnames": true,
            "dns_support": true,
            "ec2_url": null,
            "multi_ok": false,
            "name": "acme_baseline",
            "profile": null,
            "purge_cidrs": false,
            "region": "us-east-1",
            "security_token": null,
            "state": "present",
            "tags": {
                "Name": "acme_baseline",
                "Owner": "someuser"
            },
            "tenancy": "default",
            "validate_certs": true
        }
    },
    "vpc": {
        "cidr_block": "10.11.0.0/16",
        "cidr_block_association_set": [
            {
                "association_id": "vpc-cidr-assoc-00001444444",
                "cidr_block": "10.11.0.0/16",
                "cidr_block_state": {
                    "state": "associated"
                }
            }
        ],
        "classic_link_enabled": false,
        "dhcp_options_id": "dopt-aaaaaaa",
        "id": "vpc-0123546897",
        "instance_tenancy": "default",
        "is_default": false,
        "owner_id": "000000000000",
        "state": "available",
        "tags": {
            "Name": "acme_baseline",
            "Owner": "someuser"
        }
    }
}

TASK [aws-baseline : Create internet gateway] **********************************************************************************************************************************
task path: /root/foo/roles/aws-baseline/tasks/main.yml:37
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: root
<localhost> EXEC /bin/sh -c 'echo ~root && sleep 0'
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx `" && echo ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx="` echo /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx `" ) && sleep 0'
Using module file /usr/lib/python2.7/site-packages/ansible/modules/cloud/amazon/ec2_vpc_igw.py
<localhost> PUT /root/.ansible/tmp/ansible-local-14593RSX_GI/tmp1Ttirp TO /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py
<localhost> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/ /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/AnsiballZ_ec2_vpc_igw.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-xxxxxxxxxxxxxxxxxxxxxxxxxxx/ > /dev/null 2>&1 && sleep 0'
The full traceback is:
WARNING: The below traceback may *not* be related to the actual failure.
  File "/tmp/ansible_ec2_vpc_igw_payload_o6xIsP/__main__.py", line 244, in main
    result = ensure_igw_present(connection, vpc_id, tags, check_mode=module.check_mode)
  File "/tmp/ansible_ec2_vpc_igw_payload_o6xIsP/__main__.py", line 184, in ensure_igw_present
    'Unable to create Internet Gateway, error: {0}'.format(e))

fatal: [localhost]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "aws_access_key": null,
            "aws_secret_key": null,
            "ec2_url": null,
            "profile": null,
            "region": "us-east-1",
            "security_token": null,
            "state": "present",
            "tags": {
                "Name": "acme_baseline",
                "Owner": "someuser"
            },
            "validate_certs": true,
            "vpc_id": "vpc-0123546897"
        }
    },
    "msg": "Unable to create Internet Gateway, error: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidVpcID.NotFound</Code><Message>The vpc ID 'vpc-0123546897' does not exist</Message></Error></Errors><RequestID>111111111-22222222-33333</RequestID></Response>"
}

Answer 1

我复制粘贴了你的代码，它对我有用(Ansible 2.7.10)

从错误判断，您是 AWS 端最终一致性的受害者。

解决方案是在每个步骤之间稍等片刻。

但是，我强烈建议不要为此使用 Ansible。使用任何基础设施即代码工具在 AWS 中进行基本的基础设施配置。 CloudFormation、Terraform 或来自 AWS 的新 CDK(仍在开发中)等工具。

我说的是个人经历。您希望使用 IaC 部署核心云基础设施，并使用 Ansible 等其他配置管理工具部署更多动态事物(实例等)。