1

Using Packer to build an AMI based on Windows Server 2019, and Ansible as provisioner.

This is the provisioners part of my packer-build.json:

    "provisioners": [
        {
            "type": "ansible",
            "playbook_file": "./provisioners/ansible/ansible_playbook.yml",
            "user": "Administrator",
            "use_proxy": false,
            "extra_arguments": ["-e", "ansible_winrm_server_cert_validation=ignore"]
        }
    ]

This is my ansible_playbook.yml:

---
- name: Jenkins node playbook
  hosts: all
  tasks:
    - include_tasks: update_system.yml
    - include_tasks: install_dependencies.yml
    - include_tasks: create_user.yml

I can confirm that at least update_system.yml and install_dependencies.yml run successfully.

This is my create_user.yml:

---

- name: Ensure user jenkins is present
  ansible.windows.win_user:
    name: jenkins
    password: ***REDACTED***
    state: present
    groups:
      - Users

.
.
.

I get an error at this point:

amazon-ebs: TASK [Ensure user jenkins is present] ******************************************

amazon-ebs: fatal: [default]: UNREACHABLE! => {"changed": false, "msg": "basic: Illegal operation attempted on a registry key that has been marked for deletion. (extended fault data: {'transport_message': 'Bad HTTP response returned from server. Code 500', 'http_status_code': 500, 'wsmanfault_code': '2147943418', 'fault_code': 's:Receiver', 'fault_subcode': 'w:InternalError'})", "unreachable": true}

Googling "ansible Illegal operation attempted on a registry key that has been marked for deletion" did not yield anything useful.

While writing this question, I tried to reproduce the issue, and to get quicker results, I changed ansible_playbook.yml from

---
- name: Jenkins node playbook
  hosts: all
  tasks:
    - include_tasks: update_system.yml
    - include_tasks: install_dependencies.yml
    - include_tasks: create_user.yml

to

---
- name: Jenkins node playbook
  hosts: all
  tasks:
    - include_tasks: create_user.yml
    - include_tasks: update_system.yml
    - include_tasks: install_dependencies.yml

so putting create_user.yml first.

Result: the error could no longer be reproduced.

Then I restored to the original configuration, and I also no longer had the error.

That does not make any sense at all to me, and I don't trust it. Sounds like a Heisenbug to me.

What is this error and how can I make absolutely sure that it doesn't occur again?

@Semicolon asked in the comments for the contents of update_system.yml and install_dependencies.yml.

---

- name: Install all critical and security updates
  win_updates:
    category_names:
      - CriticalUpdates
      - SecurityUpdates
    state: installed
  register: update_result

- name: Reboot host if required
  win_reboot:
  when: update_result.reboot_required

---

- name: Install AWS CLI
  win_shell: Import-Module AWSPowerShell

- name: install the Win32-OpenSSH service
  win_chocolatey:
    name: openssh
    package_params: /SSHServerFeature
    state: present

- name: Install required software
  win_chocolatey:
    name: '{{ item }}'
    state: present
  loop:
    - openjdk11
    - maven
    - git
    - ghostscript
    - imagemagick
    - nodejs
    - nuget.commandline
    - visualstudio2017buildtools
Amedee Van Gasse
  • 328
  • 3
  • 18
  • If consistently repeatable with the sequence you have, and consistently avoidable with the modified sequence, it would be an unusual for somebody to offer an explaination without knowing the contents of either install_dependencies.yml or update_system,yml, – Semicolon Dec 16 '20 at 14:58
  • See edit. It is not consistently repeatable with the original sequence. I've done some further googling, and didn't find anything related to Ansible, but did find some vague references to the error in other contexts, with something something it being a feature of Windows to delete registry keys when a user is not logged in. As I haven't used Windows since Windows for Workgroups 3.11, I am unsure how to prevent that. – Amedee Van Gasse Dec 16 '20 at 15:51
  • I've added the contents of `install_dependencies.yml` and `update_system,yml`, please tell me how they are related to the issue at hand. – Amedee Van Gasse Dec 16 '20 at 15:58
  • I know this wont add any value for you, but I see this error often and rerunning the jobs without changing a single thing fixes the issue. I suspect that it has something to do with how unstable the winrm python module is. It seems as though it is very vulnerable to network instability. – Micah 'Powershell Ninja' Apr 09 '21 at 12:41

0 Answers0