New to Molecule need help..

[dburns-vistra]

I am new to molecule. I am having to build a CI/CD pipeline for Ansible playbooks. We have/used to use Chef, we have a CI/CD pipeline that we used for Chef with Kitchen, and Molecule sure looks alot like it. The pipeline we have used Jenkins as the Orchestration, I want to use it all in Gitlab. That as the baseline, I built a server to be a Gitlab runner, it is RHEL 7, I first started to do this with Docker, it appears to operate, now I am trying to go beyond to EC2. I have an EC2 created but when it tries to login, error. I see from the EC2 AWS side, I have no key pair to use. What am I missing? Please forgive my ignorance.

Thank you
Daniel

[zhan9san]

@dburns-vistra

If I understand you correctly, you encounter login issue. It may be not related to Molecule.

Have you tried https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html?

[dburns-vistra]

You can see it skipped creating Keys.

[dburns-vistra]

[dburns-vistra]

These are almost the base files, with very few changes to them. I am searching the internet to get what I need to change.

[dburns-vistra]

Mainly changed things based on this URL --- https://dimmaski.com/molecule-with-ec2/

[dburns-vistra]

I have been curious about the cloud-init or ec2 so I changed it and now it creates the EC2 with an entry but I still cannot SSH into the EC2.

I did a find on my linux server that I am running this from and no pem key with that name.

[zhan9san]

Hi @dburns-vistra

By default, cloud-init is used, for which it won't create a key pari in AWS. That's why you didn't find the key pair in AWS console.

After you changed it to ec2, an AWS key pair would be created and attached to EC2 instance created by Molecule.

A public IP would be created by default.

Could you check you can access 22 port on created EC2 instance from your linux server?

$ nc -vz x.x.x.x 22
Connection to x.x.x.x port 22 [tcp/wap-wsp] succeeded!

BTW, the key file names on your linux server are id_rsa and id_rsa.pub like below.

    default_private_key_path: "{{ lookup('env', 'MOLECULE_EPHEMERAL_DIRECTORY') }}/id_rsa"
    default_public_key_path: "{{ default_private_key_path }}.pub"

[zhan9san]

Ok, so why does AWS EC2 that it spun up have the name of the key as molecule-drvgv?

I strongly recommend you search ssh key in Google. What is ssh private key? What is ssh public key? And what is AWS ssh key pair name?

I am also not having it use a public IP

molecule-ec2 driver will try to create a public IP by default. You can disable it thru an explicit configuration, https://github.com/ansible-community/molecule-ec2/blob/main/molecule_ec2/cookiecutter/%7B%7Bcookiecutter.molecule_directory%7D%7D/%7B%7Bcookiecutter.scenario_name%7D%7D/create.yml#L22

You can add default_assign_public_ip: false in your vars.

our VPC's do not allow it except in our DMZ subnets

Maybe this is the root cause. Molecule will try to access target node via public by default, and but as the limit in your VPC, no public would be created.

After you disable public IP, molecule will use private IP like below.
https://github.com/ansible-community/molecule-ec2/blob/main/molecule_ec2/cookiecutter/%7B%7Bcookiecutter.molecule_directory%7D%7D/%7B%7Bcookiecutter.scenario_name%7D%7D/create.yml#L267

[dburns-vistra]

You can add default_assign_public_ip: false in your vars.

our VPC's do not allow it except in our DMZ subnets

Maybe this is the root cause. Molecule will try to access target node via public by default, and but as the limit in your VPC, no public would be created.

After you disable public IP, molecule will use private IP like below.
https://github.com/ansible-community/molecule-ec2/blob/main/molecule_ec2/cookiecutter/%7B%7Bcookiecutter.molecule_directory%7D%7D/%7B%7Bcookiecutter.scenario_name%7D%7D/create.yml#L267

I have done this. I will look into the SSH key, I know what they are, when going to AWS, I have always used the key pair that is assigned to the EC2 for EC2-User.

Thank you for the guidance.

[zhan9san]

Once this is working, how does the Windows side work? You don't SSH into Windows and Amazon uses the Key file to get the Local Administrator password?

Here is guide for Windows.

https://gist.github.com/zhan9san/5af99c21a55ad560028516ada70bd854

[dburns-vistra]

It still did not work, however, I looked at the instance more closely.

I found that the security groups that were created allowed everything out but nothing in... So I added this manually and the ID-RSA SSH Key works. So what is the purpose of creating a PEM key attaching to the AWS EC2 instance if it can't be used? I will look but how to add an inbound to the security group that it should?

[dburns-vistra]

Ok I figured out the security policy... I have 22 now configured for 10.0.0.0/8 so that I can get to the private IP address.

[zhan9san]

I found that the security groups that were created allowed everything out but nothing in...

It's weird. The inbound rule should be created by default

Could you please show the full command log and your configuration file?

If this issue exist, could you please open a new issue in https://github.com/ansible-community/molecule-ec2/issues?

[dburns-vistra]

I can do. I have to do another run documenting what I did to make this work for my own company, as I want to keep the CI/CD pipeline I am building fully documented and what needs to be changed or when this is done, I can take the Create.yml and move it into place every time the pipeline runs.

[dburns-vistra]

I can now do a molecule create, converge and test but I can only do test with the --no-destroy flag. Otherwise it almost immediately goes into destroy mode for something that it has not created yet.