ansible-collections
gcp inventory: kind_auth: machineaccount returns a 404 error
SUMMARY
I'm trying to build the inventory of a GCP instance using the plugin gcp_compute and auth_kind: machineaccount. The machine is running on the GCP cloud.
Instead of the inventory I'm getting the error:
Failed to retrieve
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ansible-inventory@[email protected]/?recursive=true from the Google Compute Engine metadata service.
Status: 404
ISSUE TYPE
- Bug Report
COMPONENT NAME
gcp_compute
ANSIBLE VERSION
ansible [core 2.12.7] config file = /etc/ansible/ansible.cfg configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3/dist-packages/ansible ansible collection location = /home/user/.ansible/collections:/usr/share/ansible/collections executable location = /usr/bin/ansible python version = 3.8.10 (default, Jun 22 2022, 20:18:18) [GCC 9.4.0] jinja version = 2.10.1 libyaml = True
COLLECTION VERSION
google.cloud 1.0.2
CONFIGURATION
INVENTORY_ENABLED(/etc/ansible/ansible.cfg) = ['gcp_compute', 'vmware_vm_inventory']
OS / ENVIRONMENT
Ubuntu 20.04 Linux gcp04manans03p 5.15.0-1013-gcp #18~20.04.1-Ubuntu SMP Sun Jul 3 08:20:07 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
STEPS TO REPRODUCE
Can only be reproduced from a machine running in the GCP
Create a file inventory.gcp.yml with this content:
plugin: gcp_compute
projects:
- project
auth_kind: machineaccount
service_account_email: [email protected]
Than execute it:
ansible-inventory -i inventory.gcp.yml --list
EXPECTED RESULTS
The GCP inventory
ACTUAL RESULTS
Failed to retrieve
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ansible-inventory@[email protected]/?recursive=true from the Google Compute Engine metadata service.
Status: 404
The whole error message is
[WARNING]: * Failed to parse /home/user/inventory.gcp.yaml with ansible_collections.google.cloud.plugins.inventory.gcp_compute plugin: ('Failed to retrieve
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ansible-inventory@[email protected]/?recursive=true from the Google Compute Engine metadata service.
Status: 404 Response:\nb\'<!DOCTYPE html>\\n<html lang=en>\\n <meta charset=utf-8>\\n <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">\\n <title>Error 404 (Not
Found)!!1</title>\\n <style>\\n *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-
height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-
decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-
right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-
resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-
image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-
ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}\\n
</style>\\n <a href=//www.google.com/><span id=logo aria-label=Google></span></a>\\n <p><b>404.</b> <ins>That\\xe2\\x80\\x99s an error.</ins>\\n <p>The requested URL
<code>/computeMetadata/v1/instance/service-accounts/ansible-inventory@mms-cif-config-mgmt-p-1000.iam.gserviceaccount.com/?recursive=true</code> was not found on this server. <ins>That\\xe2\\x80\\x99s all we
know.</ins>\\n\'', <google.auth.transport.requests._Response object at 0x7fa6fc7ee190>)
[WARNING]: Unable to parse /home/user/inventory.gcp.yaml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
{
"_meta": {
"hostvars": {}
},
"all": {
"children": [
"ungrouped"
]
}
}```
do curl -H 'Metadata-Flavor:Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/' to see what service accounts you have available. I just used service_account_email: default
I also encountered a similar situation today. With auth_kind: serviceaccount or application it works fine.
However with auth_kind: machineaccount I get an error.
Do we have a solution to this problem?
