Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
Description
https://wiki.jenkins-ci.org/display/JENKINS/Amazon+EC2+Plugin
I followed the guidelines for setting up Windows AMI. While I can see that the EC2 is launched in AWS, the instance is not able to connect to master as slave. logs show something like
'waiting for Windows RM ... going to sleep ..'
Notes for Windows AMI:
EC2 Windows slaves are accessed with CIFS (to send the initial Jenkins slave.jar) and WinRM to launch and connect to the slave afterward. This windows AMI must be configured with:
a security group allowing SMB over TCP (incoming TCP port 445) and WinRM (incoming TCP port 5985)
windows firewall should allow incoming SMB over TCP
java should be installed and available in the %PATH%
WinRM should be enabled with the following commands (for more information see: Microsoft article 555966):
winrm quickconfig
winrm set winrm/config/service/Auth @
winrm set winrm/config/service @
{AllowUnencrypted="true"}winrm set winrm/config/winrs @
{MaxMemoryPerShellMB="1024"}Attachments
Activity
Hi guys.
So is this working or not? I just tried it and just sits there waiting:
Waiting for WinRM to come up. Sleeping 10s. Connecting to ec2-52-17-36-66.eu-west-1.compute.amazonaws.com(52.17.36.66) with WinRM as Waiting for WinRM to come up. Sleeping 10s. Connecting to ec2-52-17-36-66.eu-west-1.compute.amazonaws.com(52.17.36.66) with WinRM as Waiting for WinRM to come up. Sleeping 10s.
I'm having the same problem. I've setup winrm as specified in pull request #67, and also added the setup reported by Thomasz. I'm using version 1.28, which to my understanding (after reviewing the Github commits) includes the SPNEGO negotiation.
I've enabled logging, and the logs (after a lot of failures during initiation, which is expected) is now simply reporting:
Jun 14, 2015 4:20:46 PM FINEST hudson.plugins.ec2.win.winrm.WinRMClient Request: POST http://172.16.0.252:5985/wsman <?xml version="1.0" encoding="UTF-8"?> <env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:rsp="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd"><env:Header><a:To>http://172.16.0.252:5985/wsman</a:To><a:ReplyTo><a:Address mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address></a:ReplyTo><w:MaxEnvelopeSize mustUnderstand="true">153600</w:MaxEnvelopeSize><a:MessageID>uuid:24BD995E-DFCC-4B42-AF00-E5C85B66445B</a:MessageID><w:Locale mustUnderstand="false" xml:lang="en-US"/><p:DataLocale mustUnderstand="false" xml:lang="en-US"/><w:OperationTimeout>PT60S</w:OperationTimeout><a:Action mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/09/transfer/Create</a:Action><w:ResourceURI mustUnderstand="true">http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd</w:ResourceURI><w:OptionSet><w:Option Name="WINRS_NOPROFILE">FALSE</w:Option><w:Option Name="WINRS_CODEPAGE">437</w:Option></w:OptionSet></env:Header><env:Body><rsp:Shell><rsp:InputStreams>stdin</rsp:InputStreams><rsp:OutputStreams>stdout stderr</rsp:OutputStreams></rsp:Shell></env:Body></env:Envelope> Jun 14, 2015 4:20:46 PM WARNING hudson.plugins.ec2.win.winrm.WinRMClient sendRequest winrm returned 401 - shouldn't happen though - retrying in 2 minutes
I don't see the authentication header in the log.
Running the Ruby WinRM gem, everything seems correct:
$ irb -r winrm > puts WinRM::WinRMWebService.new("http://172.16.0.252:5985/wsman", :plaintext, user: "Administrator", pass: "XHNyRGud.K", basic_auth_only: true).cmd("dir")[:data].collect{ |r| r[:stdout] } Volume in drive C has no label. Volume Serial Number is 12A7-BAEB ...
I've made a TCP dump of the request, and it looks like the HTTP client sends the credentials incorrectly. Here's a tshark network analysis dump:
Hypertext Transfer Protocol
POST /wsman HTTP/1.1\r\n
[Expert Info (Chat/Sequence): POST /wsman HTTP/1.1\r\n]
[Message: POST /wsman HTTP/1.1\r\n]
[Severity level: Chat]
[Group: Sequence]
Request Method: POST
Request URI: /wsman
Request Version: HTTP/1.1
Content-Length: 1320\r\n
[Content length: 1320]
Content-Type: application/soap+xml; charset=UTF-8\r\n
Host: 172.16.0.252:5985\r\n
Connection: Keep-Alive\r\n
User-Agent: Apache-HttpClient/4.3 (java 1.5)\r\n
Authorization: Basic OjEyMzQ1Ngo=\r\n
Credentials: :123456
\r\n
[Full request URI: http://172.16.0.252:5985/wsman]
[HTTP request 1/1]
It looks like the user name is completely missing from the Authorization header.
Ok, the above problem was on my side - the EC2 plugin still needs to have the user specified in the AMI configuration, even though this is a Windows system. Kinds of make sense, I guess.
After I fixed the permissions, I still can't get the plugin to work - the node log shows
Connecting to ip-172-16-0-107.us-west-2.compute.internal(172.16.0.107) with WinRM as Administrator
Waiting for WinRM to come up. Sleeping 10s.
looping until I give up.
The winrm system log has this to say:
Jun 15, 2015 8:52:19 AM FINE hudson.plugins.ec2.win.winrm.WinRMClient opening winrm shell to: http://172.16.0.107:5985/wsman Jun 15, 2015 8:52:19 AM FINEST hudson.plugins.ec2.win.winrm.WinRMClient Request: POST http://172.16.0.107:5985/wsman <?xml version="1.0" encoding="UTF-8"?> <env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:rsp="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd"><env:Header><a:To>http://172.16.0.107:5985/wsman</a:To><a:ReplyTo><a:Address mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address></a:ReplyTo><w:MaxEnvelopeSize mustUnderstand="true">153600</w:MaxEnvelopeSize><a:MessageID>uuid:7CC37EC1-0EBF-4D8F-8347-CA90977880E9</a:MessageID><w:Locale mustUnderstand="false" xml:lang="en-US"/><p:DataLocale mustUnderstand="false" xml:lang="en-US"/><w:OperationTimeout>PT60S</w:OperationTimeout><a:Action mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/09/transfer/Create</a:Action><w:ResourceURI mustUnderstand="true">http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd</w:ResourceURI><w:OptionSet><w:Option Name="WINRS_NOPROFILE">FALSE</w:Option><w:Option Name="WINRS_CODEPAGE">437</w:Option></w:OptionSet></env:Header><env:Body><rsp:Shell><rsp:InputStreams>stdin</rsp:InputStreams><rsp:OutputStreams>stdout stderr</rsp:OutputStreams></rsp:Shell></env:Body></env:Envelope> Jun 15, 2015 8:52:19 AM FINEST hudson.plugins.ec2.win.winrm.WinRMClient Response: <?xml version="1.0" encoding="UTF-8"?> <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:x="http://schemas.xmlsoap.org/ws/2004/09/transfer" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:rsp="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd" xml:lang="en-US"><s:Header><a:Action>http://schemas.xmlsoap.org/ws/2004/09/transfer/CreateResponse</a:Action><a:MessageID>uuid:D729BFE3-6F66-4343-8516-DC023A81CADE</a:MessageID><a:To>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:To><a:RelatesTo>uuid:7CC37EC1-0EBF-4D8F-8347-CA90977880E9</a:RelatesTo></s:Header><s:Body><x:ResourceCreated><a:Address>http://172.16.0.107:5985/wsman</a:Address><a:ReferenceParameters><w:ResourceURI>http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd</w:ResourceURI><w:SelectorSet><w:Selector Name="ShellId">75644E5E-AFFA-429A-AD47-E05819E470F2</w:Selector></w:SelectorSet></a:ReferenceParameters></x:ResourceCreated><rsp:Shell><rsp:ShellId>75644E5E-AFFA-429A-AD47-E05819E470F2</rsp:ShellId><rsp:ResourceUri>http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd</rsp:ResourceUri><rsp:Owner>Administrator</rsp:Owner><rsp:ClientIP>172.16.0.12</rsp:ClientIP><rsp:IdleTimeOut>PT7200.000S</rsp:IdleTimeOut><rsp:InputStreams>stdin</rsp:InputStreams><rsp:OutputStreams>stdout stderr</rsp:OutputStreams><rsp:ShellRunTime>P0DT0H0M0S</rsp:ShellRunTime><rsp:ShellInactivity>P0DT0H0M0S</rsp:ShellInactivity></rsp:Shell></s:Body></s:Envelope> Jun 15, 2015 8:52:19 AM FINER hudson.plugins.ec2.win.winrm.WinRMClient shellid: 75644E5E-AFFA-429A-AD47-E05819E470F2 Jun 15, 2015 8:52:19 AM FINE hudson.plugins.ec2.win.winrm.WinRMClient closing winrm shell 75644E5E-AFFA-429A-AD47-E05819E470F2 Jun 15, 2015 8:52:19 AM FINEST hudson.plugins.ec2.win.winrm.WinRMClient Request: POST http://172.16.0.107:5985/wsman <?xml version="1.0" encoding="UTF-8"?> <env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:rsp="http://schemas.microsoft.com/wbem/wsman/1/windows/shell" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd"><env:Header><a:To>http://172.16.0.107:5985/wsman</a:To><a:ReplyTo><a:Address mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address></a:ReplyTo><w:MaxEnvelopeSize mustUnderstand="true">153600</w:MaxEnvelopeSize><a:MessageID>uuid:41DD51F9-4B36-437E-ABD0-7F60DAC94394</a:MessageID><w:Locale mustUnderstand="false" xml:lang="en-US"/><p:DataLocale mustUnderstand="false" xml:lang="en-US"/><w:OperationTimeout>PT60S</w:OperationTimeout><a:Action mustUnderstand="true">http://schemas.xmlsoap.org/ws/2004/09/transfer/Delete</a:Action><w:SelectorSet><w:Selector Name="ShellId">75644E5E-AFFA-429A-AD47-E05819E470F2</w:Selector></w:SelectorSet><w:ResourceURI mustUnderstand="true">http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd</w:ResourceURI></env:Header><env:Body/></env:Envelope> Jun 15, 2015 8:52:19 AM FINEST hudson.plugins.ec2.win.winrm.WinRMClient Response: <?xml version="1.0" encoding="UTF-8"?> <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:w="http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd" xmlns:p="http://schemas.microsoft.com/wbem/wsman/1/wsman.xsd" xml:lang="en-US"><s:Header><a:Action>http://schemas.xmlsoap.org/ws/2004/09/transfer/DeleteResponse</a:Action><a:MessageID>uuid:6BC43E0E-F959-41D8-B313-5A915F4EB9C8</a:MessageID><a:To>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:To><a:RelatesTo>uuid:41DD51F9-4B36-437E-ABD0-7F60DAC94394</a:RelatesTo></s:Header><s:Body/></s:Envelope>
And this goes on forever.
Even though the above exchange seems successful to me (all I can see is WinRMClient opens a session successfully and then immediately closes it), the node manager shows the new node as being "offline", no details are populated in the node table and the "Response Time" column only says "Time out for last 1 try".
I found that my problem was that the SMB access was not configured correctly (some bad interaction between the master security group, slave security group, and the routing in VPC through public IP addresses). I found that out after modifying the EC2 plugin with a lot of debug logging.
I've created a pull request ( https://github.com/jenkinsci/ec2-plugin/pull/152 ) to add the critical log where the most relevant information about the problem I had was thrown away in the official release of the plugin.
If you're interested in checking out whether this modification provides the missing information for your use case, the changed plugin can be gotten from: https://jenkins.ci.cloudbees.com/job/plugins/job/ec2-plugin/277/org.jenkins-ci.plugins$ec2/
Code changed in jenkins
User: Jason Mittertreiner
Path:
src/main/java/hudson/plugins/ec2/win/EC2WindowsLauncher.java
src/main/java/hudson/plugins/ec2/win/winrm/WinRMClient.java
http://jenkins-ci.org/commit/ec2-plugin/0e840f7129b91af5101cb8f08f938743dc188ff9
Log:
JENKINS-27260SPNEGO for Windows in EC2 PluginFixed the Windows temp directory getting set to ""
Enabled SPNEGO authentication
JENKINS-25385andJENKINS-4995both have comments complaining aboutinfinite loops when creating Windows slaves. Because SPNEGO is
unregistered for, the httpclient throws and exception that is silently
caught and causes the infinite loop.