使用paloaltonetworks.panos执行Ansible Playbook时依赖库缺失问题

问题详情 #

在Linux Ubuntu 22.04系统中，执行依赖paloaltonetworks.panos集合的Ansible Playbook时，出现Missing required library错误，具体错误信息：

{"changed": false, "msg": "Missing required library \"pan-os-python\".", "pypi": "https://pypi.org/project/pan-os-python", "syspath": ["/tmp/ansible_paloaltonetworks.panos.panos_facts_payload_ygajy97b/ansible_paloaltonetworks.panos.panos_facts_payload.zip", "/usr/lib/python312.zip", "/usr/lib/python3.12", "/usr/lib/python3.12/lib-dynload", "/home/user/Test/.venvTest/lib/python3.12/site-packages"]}

通过pip list确认pan-os-python已安装在Python虚拟环境中：

pip list | grep pan
pan-os-python 1.8.0
pan-python 0.17.0
panos-upgrade-assurance 0.3.0

Playbook中已指定虚拟环境的Python解释器：

vars:
ansible_python_interpreter: /home/user/Test/.venvTest/bin/python3.12

执行Playbook的命令：

ansible-playbook /home/user/Test/FirewallManagement/panos/get.system.info/panos.get.system.info.yml

Playbook内容（用于获取防火墙基础信息，本地连接方式）：

# ansible-playbook /home/user/Test/FirewallManagement/panos/get.system.info/panos.get.system.info.yml
---
- name: Gather system info
  hosts: "{{ host }}"
  connection: local
  collections:
    - paloaltonetworks.panos
  vars:
    ansible_python_interpreter: /home/user/Test/.venvTest/bin/python3.12
  vars_prompt:
    - name: host
      prompt: Device/Devicegroup
      private: no

  tasks:
    - name: Gather facts for device
      paloaltonetworks.panos.panos_facts:
        provider: "{{ provider }}"
    - name: Display information
      ansible.builtin.debug:
        msg:
          - "Hostname: {{ ansible_facts['net_hostname'] }}"
          - "Serial: {{ ansible_facts['net_serial'] }}"
          - "Model: {{ ansible_facts['net_model'] }}"
          - "Version: {{ ansible_facts['net_version'] }}"
          - "Uptime: {{ ansible_facts['net_uptime'] }}"
          - "HA Enabled: {{ ansible_facts['net_ha_enabled'] }}"
          - "HA Type: {{ ansible_facts['net_ha_localmode'] }}"
          - "HA Status: {{ ansible_facts['net_ha_localstate'] }}"
          - "Multi-VSYS: {{ ansible_facts['net_multivsys'] }}"
          - "{{ ansible_facts['net_session_usage'] }} out of {{ ansible_facts['net_session_max'] }} sessions in use"
    - name: Save to file
      copy:
        content: 
          - "{{ ansible_facts['net_hostname'] }}"
          - "{{ ansible_facts['net_serial'] }}"
          - "{{ ansible_facts['net_model'] }}"
          - "{{ ansible_facts['net_version'] }}"
          - "{{ ansible_facts['net_uptime'] }}"
          - "{{ ansible_facts['net_ha_enabled'] }}"
          - "{{ ansible_facts['net_ha_localmode'] }}"
          - "{{ ansible_facts['net_ha_localstate'] }}"
          - "{{ ansible_facts['net_multivsys'] }}"
        dest: "/home/user/Test/FirewallManagement/panos/get.system.info/temp/{{ host }}.json"

需解决依赖库已安装但仍提示缺失的问题，使Playbook正常执行。

解决方案 #

1. 激活虚拟环境后执行Playbook #

即使Playbook指定了Python解释器，若ansible本身使用系统Python运行，可能导致环境识别异常。先激活虚拟环境再执行命令：

source /home/user/Test/.venvTest/bin/activate
ansible-playbook /home/user/Test/FirewallManagement/panos/get.system.info/panos.get.system.info.yml

2. 验证包导入有效性并重新安装 #

直接用虚拟环境的Python测试能否导入panos模块：

/home/user/Test/.venvTest/bin/python3.12 -c "import panos"

若报错，说明包安装异常，重新安装：

pip uninstall pan-os-python -y
pip install pan-os-python

3. 升级或调整集合与包版本 #

部分旧版本的paloaltonetworks.panos集合可能与pan-os-python 1.8.0不兼容，可尝试：

• 升级集合到最新版：

ansible-galaxy collection install paloaltonetworks.panos --upgrade

• 或降级pan-os-python到兼容版本（如1.7.0）：

pip install pan-os-python==1.7.0

4. 强制指定Python解释器 #

执行Playbook时通过-e参数显式指定解释器，优先级高于Playbook内的配置：

ansible-playbook /home/user/Test/FirewallManagement/panos/get.system.info/panos.get.system.info.yml -e "ansible_python_interpreter=/home/user/Test/.venvTest/bin/python3.12"

5. 调整Ansible全局配置 #

查看/etc/ansible/ansible.cfg中的interpreter_python选项，若设置为系统Python会覆盖局部配置。修改为虚拟环境路径或auto_silent：

[defaults]
interpreter_python = /home/user/Test/.venvTest/bin/python3.12

内容的提问来源于stack exchange，提问作者mxi.lolo