Testing with ec2 on Windows

[iasllanih]

Hi, so i was able to successfully able to run molecule converge on a linux ec2 instance, however I am running into barriers for testing on windows ami (specifically base 2019).

The instance gets created, however molecule fails when trying to ssh into the instance (instead of using winrm)

When initializing the role and its driver to ec2, it looks like the default create file is using ssh, how can we change this up for windows?

[AdamBrassard]

Hello!

When writing your molecule.yml for a windows AMI, did you add the additional connection options?

platforms:
  - name: test-instance
    image: ami-06a0d33fc8d328de0
    instance_type: t3a.medium
    vpc_subnet_id: subnet-8b23efa5
    ec2_region: "us-east-1"
    connection_options:
      sudo: False
      ansible_user: Administrator
      # Specify a password to override the automatic lookup
      # or omit to retrieve automatically
      # (requires boto3 & cryptography packages)
      # ansible_password: MANUALPASSWORD
      ansible_port: 5986
      ansible_connection: winrm
      ansible_winrm_scheme: https
      ansible_winrm_server_cert_validation: ignore

[AdamBrassard]

After running a test even after manually making changes to have the right username/password a default instance of windows (2019 or otherwise) doesn't have winrm enabled for anyone but system on the insecure 5985 port.

When I created a personal role to generate EC2 instances I had to conditionally send a powershell to the "user data" input to enable secure WinRM on boot with a self signed cert:

<powershell>
$admin = [adsi]("WinNT://./administrator, user")
$admin.PSBase.Invoke("SetPassword", "{{ vault_provision_password }}")
Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1'))
</powershell>

The above has a password set mechanism as to not retrieve the password, it can be removed, the key is the call to the ansible powershell script that enabled WinRM. This is parameterized with a vaulted password and executed conditionally on calling EC2, I will see if I can find a way to introduce something similar to molecule as I will likely require it as well.

[zhan9san]

How about Ansible on Windows over SSH?

[thos25]

After running a test even after manually making changes to have the right username/password a default instance of windows (2019 or otherwise) doesn't have winrm enabled for anyone but system on the insecure 5985 port.

When I created a personal role to generate EC2 instances I had to conditionally send a powershell to the "user data" input to enable secure WinRM on boot with a self signed cert:

<powershell>
$admin = [adsi]("WinNT://./administrator, user")
$admin.PSBase.Invoke("SetPassword", "{{ vault_provision_password }}")
Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1'))
</powershell>

The above has a password set mechanism as to not retrieve the password, it can be removed, the key is the call to the ansible powershell script that enabled WinRM. This is parameterized with a vaulted password and executed conditionally on calling EC2, I will see if I can find a way to introduce something similar to molecule as I will likely require it as well.

Did you ever find a way to introduce this to molecule? I'm running into this exact issue, attempting to leverage molecule to spin up a windows EC2 instance and test my playbook against it over winRM. I'm not having much luck finding answers, but i did stumble across this thread.

[AdamBrassard]

@thos25 Unfortunately due to changes in my companies I hadn't been active in molecule or able to move forward with this more.

It is likely you can define what I mentioned above with the molecule.yml: platform section for user_data as defined in the create cookie cutter for molecule-ec2 found here: Create.yml template

So probably adding to your molecule.yml file under platforms similar to this

dependency:
   name: galaxy
driver:
   name: ec2
platforms:
  - name: instance
    image_owner: "099720109477"
    image_name: ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-*
    instance_type: t2.micro
    vpc_subnet_id: <your-aws-vpc-subnet-id>
    user_data:  |
         <powershell>
         $admin = [adsi]("WinNT://./administrator, user")
         $admin.PSBase.Invoke("SetPassword", "{{ vault_provision_password }}")
         Invoke-Expression ((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1'))
         </powershell>
    tags:
      Name: molecule_instance
provisioner:
  name: ansible
verifier:
  name: ansible

I hope this works or helps.

Cheers