Ansible执行poetry config http-basic命令时卡住的排查求助

问题场景 #

在Ansible中执行以下Poetry仓库配置任务，前两个任务运行正常，但第三个任务会导致Ansible卡住：

- name: configure access to poetry repositories
  ansible.builtin.shell:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config repositories.vf-test-facilities {{ vf_test_facilities_gitlab_link }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"

- name: configure access to poetry repositories
  ansible.builtin.shell: 
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config repositories.vf-py {{ vf_py_gitlab_link }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"

- name: configure access to poetry repositories
  ansible.builtin.shell: 
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-test-facilities {{ vf_test_facilities_gitlab_access_user }} {{ vf_test_facilities_token }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"

- name: configure access to poetry repositories
  ansible.builtin.shell:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-py {{ vf_py_gitlab_access_user }} {{ vf_py_token }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"

注：为便于调试，已将可合并命令拆分为多个任务，忽略此点。

已完成的排查步骤 #

• 调换任务顺序后，确认卡住问题与poetry config http-basic.vf-test-facilities命令直接相关
• 以verbose模式运行脚本，显示任务卡在SSH执行AnsiballZ脚本阶段
• 在Ansible主机上手动执行SSH命令会卡住，中断后报错显示卡在Python的select方法
• 在远程主机直接执行相同命令可正常运行

进一步调试方法 #

1. 强制关闭Poetry交互式输入 #

Poetry的http-basic配置可能因参数异常尝试读取终端输入，而Ansible模块默认不分配完整TTY。可以添加--no-interaction参数并强制关闭标准输入：

- name: configure http-basic for vf-test-facilities
  ansible.builtin.shell:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-test-facilities {{ vf_test_facilities_gitlab_access_user }} {{ vf_test_facilities_token }} --no-interaction"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"
  stdin: ""

2. 捕获命令完整输出 #

将命令的标准输出和错误输出重定向到日志文件，查看是否有隐藏的错误提示：

- name: configure http-basic for vf-test-facilities
  ansible.builtin.shell:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-test-facilities {{ vf_test_facilities_gitlab_access_user }} {{ vf_test_facilities_token }} > /tmp/poetry_config.log 2>&1"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"

执行完成后在远程主机查看/tmp/poetry_config.log内容。

3. 改用command模块并禁用TTY #

shell模块会通过/bin/sh包装命令，尝试改用command模块并显式禁用TTY（Ansible 2.10+支持）：

- name: configure http-basic for vf-test-facilities
  ansible.builtin.command:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-test-facilities {{ vf_test_facilities_gitlab_access_user }} {{ vf_test_facilities_token }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"
  use_tty: no

4. 统一环境变量配置 #

对比远程主机直接执行与Ansible执行时的环境变量差异，显式指定Poetry相关的关键变量：

- name: configure http-basic for vf-test-facilities
  ansible.builtin.shell:
    cmd: "{{ pyenv_root }}/versions/{{ python_version }}/envs/{{ test_facilities_env_name }}/bin/poetry config http-basic.vf-test-facilities {{ vf_test_facilities_gitlab_access_user }} {{ vf_test_facilities_token }}"
  environment:
    PYENV_ROOT: "{{ pyenv_root }}"
    PATH: "{{ path }}:{{ path_pyenv }}:{{ path_cargo }}"
    HOME: "/home/pi"
    POETRY_CONFIG_DIR: "/home/pi/.config/poetry"

5. 跟踪系统调用定位卡点 #

在远程主机使用strace跟踪Python进程的系统调用，查看卡住时的资源等待情况：

strace -f -o /tmp/poetry_strace.log /usr/bin/python3 /home/pi/.ansible/tmp/ansible-tmp-1670923014.7820504-10195-255321159434435/AnsiballZ_command.py

查看/tmp/poetry_strace.log的最后几行输出，判断进程是否在等待输入或某个系统资源。

内容的提问来源于stack exchange，提问作者michaelgr22