🌍 Terraform + OTC + windows

Surprisingly it was easy to create, but tricky to get access. It's not really well describe in the docs https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud/latest/docs/resources/compute_instance_v2#encrypted_password-1

1. Create the instance

resource "opentelekomcloud_compute_instance_v2" "win" {
  name      = "win"
  flavor_id = "s3.large.4"
  # Enterprise_Windows-Server_2025_STD_amd64_uefi_latest
  image_id          = "66b9843e-f662-40b2-a347-da1f99f314da"
  key_pair          = opentelekomcloud_compute_keypair_v2.pubkey.pub_key_name
...
}
...
output "win_admin_password_encrypted" {
  value     = opentelekomcloud_compute_instance_v2.win.encrypted_password
  sensitive = true
}

2. wait about ~5-10 mins till encrypted_password is reachable
3. Decode the password

echo pass - `terraform output -raw win_admin_password_encrypted | base64 -d | openssl rsautl -decrypt -inkey /path/to/private/key`

Alternative 1:
It's possible to print the password if terraform is able to decrypt

data "opentelekomcloud_compute_instance_v2" "win" {
  id                    = opentelekomcloud_compute_instance_v2.win.id
  ssh_private_key_path  = "/path/to/private/key"
}

output "win_admin_password" {
  value     = data.opentelekomcloud_compute_instance_v2.win.password
  sensitive = true
}

Alternative 2:
If there is cloud init inside, than it can be customized like that:

resource "opentelekomcloud_compute_instance_v2" "win" {
  name      = "win"
  flavor_id = "s3.large.4"
  # Enterprise_Windows-Server_2025_STD_amd64_uefi_latest
  image_id          = "66b9843e-f662-40b2-a347-da1f99f314da"
  user_data         = base64encode(<<-EOF
#ps1
$pwdAdmin = ConvertTo-SecureString "versysecurepassword" -AsPlainText -Force
Set-LocalUser -Name Administrator -Password $pwdAdmin -PasswordNeverExpires:$true
EOF
  )

#terraform #til #otc #windows

🛠 Ansible doesn't support python path with spaces

1️⃣ Jenkins job issue
I have jenkins job to test ansible roles. The job was was moved to the jenkins folder with the space & the error appeared:

<127.0.0.1> EXEC /bin/sh -c 'ANSIBLE_ASYNC_DIR=/home/jenkins_slave/.ansible_async/ /home/jenkins_slave/workspace/Ansible Guild/Snapshot/.venv/bin/python3.12 /home/jenkins_slave/...
failed: [localhost] (item=postgresql-instance) => {
    "ansible_loop_var": "item",
...
    },
    "module_stderr": "/bin/sh: /home/jenkins_slave/workspace/Ansible: No such file or directory\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 127
}

I found that it caused by
1. calling community.docker.docker_container https://github.com/ansible-community/molecule-docker/blob/main/src/molecule_docker/playbooks/destroy.yml which executing
2. the python code https://github.com/ansible-collections/community.docker/blob/main/plugins/module_utils/module_container/module.py which called
3. the python code https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/async_wrapper.py

2️⃣ Reproduce
so it wasn't about the molecule. I decided to reproduce it:

1. Prepare the venv

 mkdir "test dir"
 cd test\ dir/
 export PYTHONPATH=/usr/lib64/python3.6/site-packages
 python3.12 -m venv .venv --system-site-packages
 . .venv/bin/activate
 pip3 install --upgrade pip
 pip3 install -r ../example/requirements.txt 

2. Run debug

ANSIBLE_KEEP_REMOTE_FILES=1 ansible  -vvvv -m stat -c local -i 'asd,' asd
...
python3 ./AnsiballZ_stat.py explode

3. check internals

 echo PLATFORM; uname; echo FOUND; command -v 'python3.12'; command -v 'python3.11'; command -v 'python3.10'; command -v 'python3.9'; command -v 'python3.8'; command -v 'python3.7'; command -v 'python3.6'; command -v '/usr/bin/python3'; command -v '/usr/libexec/platform-python'; command -v 'python2.7'; command -v '/usr/bin/python'; command -v 'python'; echo ENDFOUND
PLATFORM
Linux
FOUND
/home/username/test dir/.venv/bin/python3.12
/home/username/.pyenv/shims/python3.9
/usr/bin/python3.8
/usr/bin/python3.6
/usr/bin/python3
/usr/libexec/platform-python
/home/ms/lgonchar/test dir/.venv/bin/python
ENDFOUND

the module detected symlink and caused the issue.

4️⃣ What is the source?
1. .venv/lib64/python3.12/site-packages/ansible/executor/interpreter_discovery.py:60

try:
...
    shell_bootstrap = "echo PLATFORM; uname; echo FOUND; {0}; echo ENDFOUND".format('; '.join(command_list))

2. .venv/lib64/python3.12/site-packages/ansible/plugins/action/__init__.py

found_interpreters = [interp.strip() for interp in match.groups()[1].splitlines() if interp.startswith('/')]
quoted_interpreters = []
for interpreter in found_interpreters:
    if ' ' in interpreter and not (interpreter.startswith('"') or interpreter.startswith("'")):
        quoted_interpreters.append('"%s"' % interpreter)
    else:
        quoted_interpreters.append(interpreter)
found_interpreters = quoted_interpreters

so the idea was to modify the .venv/lib64/python3.12/site-packages/ansible/plugins/action/__init__.py

if ' ' in interpreter:
    interpreter = shlex.quote(interpreter)
async_cmd = [interpreter, remote_async_module_path, async_jid, async_limit, remote_module_path]

It fixed the python detection but also there are some other places were _low_level_execute_command is called and much work to do.

5️⃣ Final
1. Rename the jenkins folder without space
2. Propose to use the first interpreter without spaces https://github.com/ansible/ansible/issues/82535#issuecomment-2910076878

#ansible #debug #jenkins