A good start: able to run playbooks on AWS EC2 SSM.

[johnlane]

I found your project having had problems with Semaphore and I achieved a successful run against AWS using SSM within 15 mins of my initial docker pull. So very happy with that. I just wanted to give you some feedback.

I had to augment the Dockerfile to add the AWS stuff (the SSM plugin build from here). Here's what I did in case you want to make it standard (or offer an AWS variant):

FROM golang:1.15.3-alpine as ssm-builder

ARG VERSION=1.2.279.0

RUN set -ex && apk add --no-cache make git gcc libc-dev curl bash zip && \
    curl -sLO https://github.com/aws/session-manager-plugin/archive/${VERSION}.tar.gz && \
    mkdir -p /go/src/github.com && \
    tar xzf ${VERSION}.tar.gz && \
    mv session-manager-plugin-${VERSION} /go/src/github.com/session-manager-plugin && \
    cd /go/src/github.com/session-manager-plugin && \
    make release

FROM ansible0guy/ansible-webui:latest

RUN apk add py3-boto3 aws-cli
COPY --from=ssm-builder /go/src/github.com/session-manager-plugin/bin/linux_amd64_plugin/session-manager-plugin /usr/bin/

My run command-line, with AWS credentials, looks like this (from root of my ansible project):

docker run -d --name ansible-webui --publish 127.0.0.1:8000:8000 --volume $(pwd)/webui-data:/data --volume $(pwd):/play -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" ansible-webui:latest

At first, my play didn't work because collections weren't loaded. I went in and manually did it:

docker exec -it ansible-webui sh
cd /play
ansible-galaxy collection install -r collections/requirements.yml

The location of my requirements.yml was due to previous experimenting. I then RTFM and moved requirements.yml up to the project root. After that, it worked fine - from docker run to completing a play without having to tinker. You might want to consider configurable paths to Galaxy collections and roles on the job definition page.

A minor observation is that everything inside the container runs as root. We have scanners that red-flag any containers that do that.

The beauty of ansible-webui is that it's so simple. I didn't have to mess around with setup just to run a play. Hopefully it'll stay like that as it develops. Really nice. Thank you for making this available.

[ansibleguy]

Greetings!

I'm glad you found the tool useful (:

I'll try to keep it as simple and lightweight as possible.

Thank you also for your insightful feedback!

1. Container with AWS support

   I did not think of that as I'm not a user of cloud platforms.
   Providing an image with AWS support makes sense - yeah.

2. I may add the collections/requirements.yml and roles/requirements.yml as sources to the image as they are standardized.

3. Running as non-root makes sense. I'll implement it!

- AnsibleGuy

[ansibleguy]

I've implemented all 3 on latest now: fcc2617

The image(s) should be available on the next release!

- AnsibleGuy

[ansibleguy]

@johnlane Could you check if the image I created works for you?

https://hub.docker.com/repository/docker/ansible0guy/ansible-webui-aws/general

I actually bumped the versions of SSM and Golang up to the ones they use in the SSM-Repo Dockerfile

[johnlane]

I will do yes, tomorrow hopefully I can do it.

[ansibleguy]

Thank you!

[johnlane]

I tried a run this morning....

docker run -d --name ansible-webui --publish 127.0.0.1:8000:8000 --volume "$mypath:/data" --volume "$(pwd):/play" -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" ansible0guy/ansible-webui-aws:0.0.11

When I try a play I get this error

TASK [Run a command] ***********************************************************
Exception ignored in: 
Traceback (most recent call last):
  File "/root/.ansible/collections/ansible_collections/community/aws/plugins/connection/aws_ssm.py", line 493, in __del__
    self.close()
  File "/root/.ansible/collections/ansible_collections/community/aws/plugins/connection/aws_ssm.py", line 963, in close
    self._session.communicate(cmd)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'communicate'
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: AttributeError: 'NoneType' object has no attribute 'communicate'
fatal: [mi-dev-euw2-eksstaging-agent10-21200]: FAILED! => {"msg": "Unexpected failure during module execution: 'NoneType' object has no attribute 'communicate'", "stdout": ""}

I confirmed that it still works using my image. The only difference being the image ansible-webui:latest (i.e. my locally built based on your ansible0guy/ansible-webui:0.0.9 image).

You probably know this already but the database schema is different and I had to delete the db and start over when changing the image.

I'm around on-and-off today if you want me to test anything let me know :)

[ansibleguy]

Alright, thank you. I'll retry and check that the binary is acutally executable in the finished image.

[ansibleguy]

Sooo. After beginning to 'love' the AWS toolset - I think I got it working:

# docker exec -it ansible-webui-aws /bin/sh
/play # /usr/bin/session-manager-plugin --version
1.2.553.0
/play # /usr/bin/ssmcli help
ssmcli
Available commands are:
start-session

I've also added the running-user (root/unprivileged) and SSM version to the system-version UI:

Please retry it with the new images whenever you find time: https://hub.docker.com/repository/docker/ansible0guy/webui-aws/general

[johnlane]

You're missing the aws-cli and boto3. The SSM plugin is installed fine. I had to augment the Dockerfile before it would work

FROM ansible0guy/webui-aws:0.0.12
USER 0
RUN apk add py3-boto3 aws-cli
USER 8785

With that, I can successfully execute a play.

One observation is that the directory given for /data has to be writable by uid 8785 so I had to chmod o+rw it before doing docker run.

[ansibleguy]

Oh - yeah. Seems I forgot to re-add those after the troubleshooting.
Thank you for testing it 👍🏼

[ansibleguy]

Should be fixed now.
Also: the information regarding /data ownership for persistent data is available in the docs: https://webui.ansibleguy.net/en/latest/usage/docker.html#persistent-data

[johnlane]

Yes that is working now. I was able to spin up ansible0guy/webui-aws:0.0.12 (same version tag, pulled again) and was able to execute a playbook against EC2 instances usins SSM.