How can I resolve this ansible kerberos error?

Question

I have Ubuntu 20.04 in WSL and Ansible installed. I'm trying to simply run a Windows update on my local machine. I've tried using my account, a service account, etc. I've run the kinit -C [email protected] command and have a valid ticket. My computer is joined to an AD/Azure hybrid with the local domain being "domain.local", yet we login with [email protected] to the computer.

I have the internal domain controllers listed in my /etc/resolv.conf so I can ping/access domain computers.

I've tried with [email protected], DOMAIN.COM, myuser, [email protected]

I keep getting errors when running "ansible-playbook -i hosts -vvvv win-update.yml":

TASK [Gathering Facts] ******************************************************************************************************************************************************************************************
task path: /home/gmeyer/ansible/win-update.yml:5
Using module file /usr/lib/python3/dist-packages/ansible/modules/windows/setup.ps1
Pipelining is enabled.
<10.20.30.174> ESTABLISH WINRM CONNECTION FOR USER: myuser on PORT 5986 TO 10.20.30.174
fatal: [10.20.30.174]: UNREACHABLE! => {
"changed": false,
"msg": "kerberos: authGSSClientStep() failed: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377))",
"unreachable": true
}


PLAY RECAP ******************************************************************************************************************************************************************************************************`
10.20.30.174               : ok=0    changed=0    unreachable=1    failed=0    skipped=0    rescued=0    ignored=0

My /etc/krb5.conf:
[libdefaults]
default_realm = DOMAIN.LOCAL
[realms]
X-ISS.LOCAL = {
kdc = dc.domain.local
admin_server = dc.domain.local
default_domain = domain.local
}
[domain_realm]
.domain.local = DOMAIN.LOCAL
domain.local = DOMAIN.LOCAL

My hosts:

[win]
10.20.30.174

[win:vars]
[email protected]
ansible_connection = winrm
ansible_winrm_server_cert_validation = ignore
ansible_password = [redacted]
ansible_winrm_transport = kerberos
ansible_winrm_kerberos_delegation = true

My playbook:

---
# DESCRIPTION
# Apply windows updates

- name: Apply windows updates
  hosts: win
  gather_facts: yes
  vars:
    initial_reboot: |-
      {{ 86400 <
          (( ((ansible_date_time.date+" "+ansible_date_time.time)|to_datetime('%Y-%m-%d %H:%M:%S')) -
              ansible_facts.lastboot|to_datetime('%Y-%m-%d %H:%M:%SZ')).total_seconds())|abs }}

  tasks:

  # Reboot systems with if up longer then day
  # this way we know that the system was able to come back
  # up before updates were applied
  - name: Reboot if system has a large uptime
    win_reboot:
    when: initial_reboot and not ansible_check_mode
    tags:
    - never
    - reboot

  - block:
    - name: >
        {{ 'Install' if 'install' in ansible_run_tags else 'Search' }} updates
        {{ 'will automatically reboot' if 'reboot' in ansible_run_tags else 'no reboot' }}
      win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
          - UpdateRollups
          - DefinitionUpdates
          - Updates
        reboot: "{{ 'yes' if 'reboot' in ansible_run_tags else 'no' }}"
        state: "{{ 'installed' if 'install' in ansible_run_tags else 'searched' }}"
      become: yes
      become_method: runas
      become_user: SYSTEM
      register: update_results
      tags:
      - never
      - install
      - check

    rescue:
    - name: Windows update failed?
      debug:
        msg: "error: {{ update_results.msg }}"
      when: update_results is failed and update_results.msg is defined
      tags:
      - always
    - name: Server had pending reboots?
      win_reboot:
      when:  not ansible_check_mode and
            update_results is failed and
            update_results.msg is search('A reboot is required')
      tags:
      - never
      - reboot

    always:
    - name: Report results
      debug:
        var: update_results
      tags:
      - never
      - install
      - check

I have tried many different options for formatting the domain name while running Ansible in Ubuntu. I am expecting to get the script to connect to the Windows machine to run the Windows Updates, but keep getting Kerberos errors.

Answer 1

I figured out what the problem was. It was in my hosts file - I changed the lines to the fqdn and put the "ansible_host=IP ansible_connection=local" and it worked!