![使用带有 pyopenssl 的自定义 EE 图像时出现 AWX 错误 X509](https://linux22.com/image/789195/%E4%BD%BF%E7%94%A8%E5%B8%A6%E6%9C%89%20pyopenssl%20%E7%9A%84%E8%87%AA%E5%AE%9A%E4%B9%89%20EE%20%E5%9B%BE%E5%83%8F%E6%97%B6%E5%87%BA%E7%8E%B0%20AWX%20%E9%94%99%E8%AF%AF%20X509.png)
我目前正在设置一个托管在 K8s 集群上的 AWX 平台,以获得适合多用户使用的 UI + 功能。
语境 :
我创建了一个 EE 图像,推送到 AWX 使用的 Nexus 存储库上,以便拥有 Ansible 项目所需的所有 ansible galaxy 集合(nutanix.ncp、community.hashi_vault、community.windows 和 ansible.windows)+ pip 模块(ansible-pylibssh、hvac、paramiko、pexpect、pykerberos、pywinrm、cryptography、pyopenssl)。
EE 图像创建和推送/拉取都可以。如果需要,我可以分享 requirements.yml 和 requirements.txt 文件。
以下是供参考的execution-environment.yml:
---
version: 1
build_arg_defaults:
EE_BASE_IMAGE: 'quay.io/ansible/awx-ee:latest'
dependencies:
galaxy: requirements.yml
python: requirements.txt
additional_build_steps:
prepend: |
RUN python3 -m pip install --upgrade pip
RUN pip3 install --upgrade pip setuptools
RUN whoami
RUN cat /etc/os-release
append:
- RUN ls -la /etc
然后,当我使用此 EE 图像在 AWX 上设置项目时,它会因 X509_V_FLAG_CB_ISSUER_CHECK 错误而失败:
{
"module_stdout": "",
"module_stderr": "Traceback (most recent call last):\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 107, in <module>\n _ansiballz_main()\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 99, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 47, in invoke_module\n runpy.run_module(mod_name='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', init_globals=dict(_module_fqn='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', _modlib_path=modlib_path),\n File \"/usr/lib64/python3.8/runpy.py\", line 207, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.8/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib64/python3.8/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/modules/ntnx_subnets_info.py\", line 188, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/subnets.py\", line 9, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/clusters.py\", line 7, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/prism.py\", line 5, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/entity.py\", line 13, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible/module_utils/urls.py\", line 115, in <module>\n File \"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py\", line 46, in <module>\n import OpenSSL.SSL\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/__init__.py\", line 8, in <module>\n from OpenSSL import crypto, SSL\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1517, in <module>\n class X509StoreFlags(object):\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1537, in X509StoreFlags\n CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK\nAttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'\n",
"exception": "Traceback (most recent call last):\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 107, in <module>\n _ansiballz_main()\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 99, in _ansiballz_main\n invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 47, in invoke_module\n runpy.run_module(mod_name='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', init_globals=dict(_module_fqn='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', _modlib_path=modlib_path),\n File \"/usr/lib64/python3.8/runpy.py\", line 207, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.8/runpy.py\", line 97, in _run_module_code\n _run_code(code, mod_globals, init_globals,\n File \"/usr/lib64/python3.8/runpy.py\", line 87, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/modules/ntnx_subnets_info.py\", line 188, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/subnets.py\", line 9, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/clusters.py\", line 7, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/prism.py\", line 5, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/entity.py\", line 13, in <module>\n File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n File \"<frozen zipimport>\", line 259, in load_module\n File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible/module_utils/urls.py\", line 115, in <module>\n File \"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py\", line 46, in <module>\n import OpenSSL.SSL\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/__init__.py\", line 8, in <module>\n from OpenSSL import crypto, SSL\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1517, in <module>\n class X509StoreFlags(object):\n File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1537, in X509StoreFlags\n CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK\nAttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'\n",
"msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
"rc": 1,
"_ansible_no_log": false,
"changed": false
}
测试: 我尝试了以下测试来尝试解决它:
- 获取最新版本的 cryptography 和 pyopenssl
- 将加密降级到 36.0.2/37.0.0,将 pyopenssl 版本降级到 22.0.0,如一些 stackoverflow 帖子中所示
- 在镜像创建中的 additional_build_steps > prepend 块上运行 pip3 upgrade
另外,有一点我不明白:
我看到错误日志提到了该文件\"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py
但是当我运行 shell 时,docker 镜像中没有 /usr/lib/python3.8 但有 python3.9 文件夹。
问题: 当我登录到 AWX pods 时,我发现只有 awx-operator-controller-manager pod 获得了该路径 python3.8 路径。那么在尝试运行项目时,AWX pods/EE 映像之间有什么关系?
关于 pyopenssl,我还可以测试哪些其他测试/解决方案?
谢谢 !
答案1
最后是我的错误...重新创建 EE 映像后,清理我的存储库并再次推送它,它就可以工作了(每个要求都是最新的)
我认为我在测试时推送/拉取了错误的图像...无论如何,一切都很好!