Community: Windows Working Group agenda - Mar-Jun 2017

[nitzmahone]

This agenda has been migrated to a new location: #195

---

The Windows Working Group is focused on improving Ansible's management of Windows hosts. The group meets every week on Tuesdays at 20:00 UTC (see ical)

More information related to the Windows Working Group is available at:
https://github.com/ansible/community/wiki/Windows

Feel free to add your questions to this ticket to be discussed during the upcoming meeting.

After being discussed, raised items are being updated, and after a month resolved items are being hidden from view (but remain accessible).

[gundalow]

Re-moved ansible/ansible#19070 win_file: fix error when creating an existing dir (merged)
~Migrated from https://github.com/ansible/community/issues/150~

• ~nitzmahone has this on his list~
• ~21 Feb: nitzmahone should be able to get to this later this week (likely Thursday)~

[jborean93]

I probably won't be there for the next meeting but I was hoping we could get a view around creating symlinks. Should we be putting that functionality into win_file and add another parameter that specifies the link type or should it be it's own module? The first keeps it similar to the file module but does add some complexity.

Edit: https://meetbot.fedoraproject.org/ansible-meeting/2017-03-28/windows_working_group.2017-03-28-00.00.log.html
I will create a PR to include the symlink utils in the win_file module to keep things consistent with the file module

Edit: https://github.com/ansible/ansible/pull/23119

[dagwieers]

---

The below list is no longer maintained.
We have moved stuff over to the Ansible community wiki at:

- https://github.com/ansible/community/wiki/Windows

Migrated from #152

• Cleaning up the existing Windows modules (see Wiki)
  
  
  
  • Ensure all modules have integration tests (before v2.4)
  
  
  • Ensure all modules are idempotent, implement check-mode and diff support where possible
  
  
• ~Select a reference Windows module ansible/ansible#20505 (before London)~
• Improve the existing Windows documentation ~ansible/ansible#16243 ansible/ansible#17311 ansible/ansible#19623 ansible/ansible#20696 ansible/ansible#21128~
  
  
  
  • compare feature-completeness between win_ modules and their python variant (see Wiki)
  
  
  • ~reference windows-variants in python module, and vice versa (before v2.4) ansible/ansible#25482~
  
  
  • improve module development checklist for Windows (before v2.4)
  
  
• ~Improvements to ConfigureRemoteingForAnsible.ps1 ansible/ansible#10509 ansible/ansible#14387 ansible/ansible#17378~
• ~Implement native newline sequence for win_template ansible/ansible#21846~
• Issue/PR triage (lots of bugs are waiting for feedback or PRs for review)
  
  
  
  • Open PRs:
    
    
    
    
    
    • Repository ansible/ansible (before v2.4 as to close known issues)
    
    
    
    • ~Repository ansible/ansible-modules-core~
    
    
    
    • ~Repository ansible/ansible-modules-extras~
    
    
    
  
  
  • Open issues:
    
    
    
    
    
    • Repository ansible/ansible
    
    
    
    • ~Repository ansible/ansible-modules-core~
    
    
    
    • ~Repository ansible/ansible-modules-extras (before London)~
    
    
    
  
  
• ~Running Ansible on Windows (WSL) as control master ansible/ansible#23515~
• ~How to support DSC best ? ansible/ansible#24872~
• Clean up Windows roles
• Using SSH as a transport for Windows ansible/ansible#25344
• Using Powershell on Unix/Linux (for DSC resources)
• Decide what to do wrt. group policies (on standalone systems, driving AD ?)
• Decide what to do with functional lists of registry keys (i.e. some have been proposed as modules https://github.com/ansible/ansible/pull/20992#issuecomment-277385149)
• Powershell coding style and CI testing ansible/proposals#63
  
  
  
  • Implement in Shippable
  
  
  • Discuss configuration/rules
  
  
• Windows coverage support

[dagwieers]

~During next meeting I would like to discuss a structured way of doing idempotency and check-mode testing (all-in-one) for all the Windows modules. I also put it on the TWG agenda so hopefully there is an agreement by next meeting about this. https://github.com/ansible/community/issues/114#issuecomment-286513361~

~Implemented in: ansible/ansible#22833 (merged)~

[gundalow]

Ansible 2.3 RC1 has been released for testing
Please see https://groups.google.com/forum/#!topic/ansible-devel/V2ESSQqLnS0 for details
We would appreciate your help testing.
Any issues, please raise at https://github.com/ansible/ansible/issues/new
Thanks!

[akcrisp]

Hi Can you confirm if support for Windows Desired State Config (DSC) is being planned ?

Thanks

UPDATE (nitzmahone): trond will be doing a PR to include his win_dsc module in the 2.4 timeframe, which will allow for dynamic execution of arbitrary DSC resources from Ansible. (PR merged for 2.4)

[seljuck]

Are there any plans to control Active Directory?
For example

Add/Edit/Delete Organizational Units
Add/Edit/Delete Security Groups
Add/Edit/Delete Users and Computers
Add/Edit/Delete Group Policy Objects

Thanks

[jhawkesworth]

~Bug fixing.
There are around 40 open bugs against windows things at the moment (ignoring feature ideas and things awaiting info from issue owners)~

~https://github.com/ansible/ansible/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aopen%20label%3Awindows%20-label%3Aneeds_info%20-label%3Afeature_idea%20~

~Can we, the community (i.e. not @nitzmahone ) divide these up at all and see if we can squash as many bugs as possible before 2.3 completes?
I'm looking a win_regedit one at the moment - https://github.com/ansible/ansible/issues/18880
and after that I play to tackle https://github.com/ansible/ansible/issues/22871 and https://github.com/ansible/ansible/issues/21128~

~Does anyone else have time for a 'bug push' - if so what things do you want to tackle so we don't wind up tackling the same things?~

Update: We are now doing sprints to tackle this problem.

[jhawkesworth]

~Reminder to ask how others are debugging while we are in the (temporary) position of not being able to use ANSIBLE_KEEP_REMOTE_FILES=1 for windows modules at the moment.~

Update: You can now use ANSIBLE_KEEP_REMOTE_FILES=1 in latest 2.4 devel.

[jhawkesworth]

@seljuck - I wonder if it might be possible to use https://docs.ansible.com/ansible/ldap_entry_module.html and https://docs.ansible.com/ansible/ldap_attr_module.html to do some of the things you want to do? Since they are wrappers for python-ldap and there are examples around of people connecting to Active Directory using it - see https://blog.thomastoye.be/python-ldap-authentication-with-microsoft-active-directory-46661bebc483#.ikll25llj for example - then it might be worth trying out.

[seljuck]

@jhawkesworth Thanks for the info on the ldap module for Ansible. Based on a quick review it doe look like it would work. But I would need to know all the internal attributes that Active Directory creates for each object. While this is all doable it's much more then I was hoping to get into. I was looking for the simplicity that Ansible has brought to other modules I work with.

I am curious if Windows Desired State Config (DSC) can be used for this as well, that would kill two birds with one stone.

[gundalow]

Ansible 2.3 RC3 has been released https://groups.google.com/forum/#!topic/ansible-devel/X8sYLl-ZuTY
We welcome your feedback, after all, we can only fix what we know is broken. If you spot any issues please raise via https://github.com/ansible/ansible/issues/new
Thanks again for your help

[jborean93]

One thing that I am hoping we can discuss at the next UG is around desired formatting of powershell code. Some questions/standards I am hoping we can decide on would be around

~~1. Indenting and braces, I've seen modules written in C# style and other in more of a Python style, do we want to enforce a particular standard

1. Using pipelines in functions, do we want to allow this or frown upon it if possible to keep things similar to Python
2. Variable definitions, camelCase, CamelCase2, under_scores or any other standards
3. Aliases, should we support things like rm or try and use the full cmdlet name like Remove-Item
4. Command Parameters keys, do we want to try and enforce stating the key and value or allow using just the variables, i.e. New-Item C:\ansible vs New-Item -Path C:\ansible~~

Personally I want to keep things as similar to Python as possible, not use aliases, pipelines and staging parameter keys but happy for other peoples thoughts. There are probably more which I'm not thinking off but happy to discuss it futher.

Update (nitzmahone): jborean93 to propose strawman community-enforceable coding standards, to be discussed at a future WWG meeting
Update 2017-07-12: Moved item to action plan.

[dagwieers]

The documentation still states that Ansible is not supported on a Windows control machine. However, it works fine on Windows 10's Subsystem for Linux (WSL). The installation is identical to Linux (because it basically is Linux) although the version Ansible/WinRM in Ubuntu 16.04 is rather old, we need to rely on python pip or git for newer versions. (not different from the current documentation at that)

Since Ansible on WSL lowers the bar for Windows admins, I would open up the documentation to the possibility of running Ansible on WSL, and basically stating that WSL is just Linux on top of Windows.

I have the documentation prepared for something like this already.

<>
sudo apt-get install python-pip
pip install pywinrm
git clone https://github.com/ansible/ansible.git
source ansible/hacking/env-setup

UPDATE (nitzmahone): dagwieers to propose verbiage (with lots of caution tape) that it works under WSL for dev/test purposes, but not "supported" and recommended for production use (as Microsoft itself says re:WSL).

~Implemented in: ansible/ansible#23515 (merged)~

[dagwieers]

For the new win_route module (ansible/ansible#23405) there is some uncertainty on how to handle ip-address and netmask information. Mostly because the route command and the Powershell interface do it differently, but also because other modules do it differently too.
So maybe we do want to have a standard way for doing this in Windows modules ?

cc: @dlazz

UPDATE (nitzmahone): discussed "CIDR by default" and possibility of future module_utils support to convert between CIDR/netmask formats as necessary.

~Update: The win_route module as been adapted: ansible/ansible#23405~
~Update: Merged!~

[gundalow]

~Ansible 2.3.0 FINAL has been released. Thank you for all your help with this release
https://groups.google.com/forum/#!topic/ansible-project/aKnggI-Y8dk~

~For Windows:~

• ~Pipelining support for faster module execution (20-50% performance boost for many modules).~
• ~Support for the "runas" become method to execute as a different user and allow for transparent second-hop authentication in many cases.~
• ~Many other improvements for existing WIndows modules such as check mode, and other fixes for the winrm connection type.~
• ~Fourteen new modules, including:~
  
  
  
  • ~win_domain~
  
  
  • ~win_domain_controller~
  
  
  • ~win_domain_membership~
  
  
  • ~win_path~
  
  
  • ~win_region~
  
  
  • ~win_shortcut~
  
  

[dagwieers]

~Can we evaluate:~

• ~https://github.com/ansible/ansible/pull/23520~
• ~https://github.com/ansible/ansible/pull/23422~
• ~https://github.com/ansible/ansible/pull/23162~
• ~https://github.com/ansible/ansible/pull/23138~
• ~https://github.com/ansible/ansible/pull/23131~

And maybe this:

• https://github.com/ansible/ansible/pull/21898

Although you probably have better ideas for this one. Although I had hoped this was ok for v2.3.

[gundalow]

~Ansible 2.2.3 FINAL released, 2.1.6rc1 and 2.3.1rc1 available for testing~

~All of these releases address at least one CVE (listed below). Users of 2.2.x should upgrade to 2.2.3 as soon as possible. The CVE impacting 2.1.x and 2.3.0 is MODERATE in nature, however users should look to upgrade as soon as the final releases are done.~

~https://groups.google.com/forum/#!topic/ansible-devel/etlpnJDerY0~

[jhawkesworth]

~Anything else needed to push this to the line:~

~https://github.com/ansible/ansible/issues/23559 and https://github.com/ansible/ansible/pull/23581
win_copy folder fix - anything else needed or can this be cherry picked to 2.3.1 (I know I missed first RC).
Or can we do a 2.3.2 and try to get the others here https://github.com/ansible/ansible/issues?utf8=%E2%9C%93&q=is%3Aopen%20milestone%3A2.3.0%20label%3Awindows in?~
~(merged and cherry-picked to stable-2.3 for 2.3.1rc2)~

[jhawkesworth]

~Also - https://groups.google.com/forum/#!topic/ansible-devel/PEus1yp08h0 - is there anything we can do without analogous arg specification for windows modules? I haven't dug into the code but I get the impression its the controller side that is handling the no_log of individual params. Happy to take a stab at this if there's a good direction to go in. (OP misunderstood diff between control-side no_log and module arg-level no_log)~

[dagwieers]

New windows modules waiting for review/feedback:

• win_wait_for: ansible/ansible#26556
• win_xml: ansible/ansible#26404
• win_security_policy: ~https://github.com/ansible/ansible/pull/26332~ new in v2.4
• win_group_member: ansible/ansible#26307
• win_user_right: ansible/ansible#26276
• win_wakeonlan: ~https://github.com/ansible/ansible/pull/26232~ new in v2.4
• win_certificate: ansible/ansible#25837
• win_pagefile: ansible/ansible#25605
• win_dsc: ~https://github.com/ansible/ansible/pull/24872~ new in v2.4
• win_domain_user: https://github.com/ansible/ansible/pull/24075
• win_psmodule: ~https://github.com/ansible/ansible/pull/23604~ new in v2.4
• win_route: ~https://github.com/ansible/ansible/pull/23405~ new in v2.4
• win_firewall: ~https://github.com/ansible/ansible/pull/23224~ new in v2.4
• win_defrag: ~https://github.com/ansible/ansible/pull/23140~ new in v2.4
• win_domain: ~https://github.com/ansible/ansible/pull/22179~ new in v2.3
• win_disk_image: ~https://github.com/ansible/ansible/pull/22175~ new in v2.3
• win_domain_controller: ~https://github.com/ansible/ansible/pull/22115~ new in v2.3
• win_domain_membership: ~https://github.com/ansible/ansible/pull/22027~ new in v2.3
• win_dns_client: ~https://github.com/ansible/ansible/pull/22016~ new in v2.3
• win_msg: ~https://github.com/ansible/ansible/pull/22008~ new in v2.3
• win_tempfile: ~https://github.com/ansible/ansible/pull/21623~ new in v2.3
• win_shortcut: ~https://github.com/ansible/ansible/pull/20164~ new in v2.3
• win_psexec: ~https://github.com/ansible/ansible/pull/20141~ new in v2.3
• win_path: ~https://github.com/ansible/ansible/pull/20073~ new in v2.3
• win_region: ~https://github.com/ansible/ansible/pull/19147~ new in v2.3
• win_reg_stat: ~https://github.com/ansible/ansible/pull/19145~ new in v2.3
• win_find: ~https://github.com/ansible/ansible/pull/19144~ new in v2.3
• win_say: ~https://github.com/ansible/ansible-modules-extras/pull/2866~ new in v2.3

Once merged, please add to CHANGELOG.md !

[dagwieers]

~I have been reviewing a lot of the old issues on:~

• ~ansible-modules-core~
• ~ansible-modules-extras~

~And it seems both win_robocopy and the win_iis* modules need some more love to close a few more issues. Maybe we could get in contact with the authors to get them involved again ?~

~Most of the older issues require retesting because of various improvements we made the past few months.~

[dagwieers]

~We discussed using a Github Project or the Github Wiki for tracking Windows-related progress and distributing some of the bug triage/review/documentation work. Eventually we can get rid of those action-list comments, and Etherpad.~

~@nitzmahone We wanted a location to collaborate on WWG meeting agenda's, TODO lists, project progress and possibly an example library (DSC, registry, etc.). I am not sure how read-only collaborators will help for any of this.~
~@nitzmahone will set up a Wiki space for the WWG to collaborate and access to everyone involved in the WWG or Windows modules.~
~Update 2017-06-22: It was decided we are going to leverage the ansible/community wiki for doing progress tracking and collaboration. @gregdek !~

[jborean93]

~YFW you realise the meetings were last week and not this week~

[jborean93]

~Hoping to get some guidance from the others around this PR https://github.com/ansible/ansible/pull/22775~

~I was first going to just make the changes myself and try and get it merged in as is but as I am going through it I think it should be split up into separate modules. Instead of one module to set the parameters in exported by secedit I am thinking of creating a module for the following;~

~* Keep the module as is to do raw editing of this file for the extra stuff~
~* One to configure the user/privilege rights - add/remove/set users/groups to a right~
~* One to configure the Event Audit policies - set non/success/failure for an audit event~

~Unfortunately there might be some shared code between the 3 and I am wary of splitting up a module if the process is similar but I personally think 1 and 2 are nice not 100% sure of 3. Does anyone else have any thoughts?~
~(Jordan to implement as separate module)~

[gundalow]

~Ansible Contributor Summit 4 (Part of AnsibleFest 2017 London)~

~We are happy to announce our fourth Ansible Contributors Summit!
AnsibleFest London (http://www.ansible.com/ansiblefest) will be on Thursday 22nd June, and the Contributor Summit will be held on Wednesday 21st June, from 9:30am to 4pm (time subject to change).~

~Contributors Summit is a day-long working session with the core team and key contributors to discuss important issues affecting the Ansible community. You can participate in person or online~

~Proposed topics: https://public.etherpad-mozilla.org/p/ansible-summit-june-2017~

~See https://groups.google.com/forum/#!topic/ansible-devel/stUITiM6hMs for more info~

[jborean93]

~I apologise for delaying this for so long but I've finally found some time to work on the standards stuff we talked about a month ago or so. I've raised a proposal for this https://github.com/ansible/proposals/issues/63 and I hope you guys can have a good look and give your thoughts. I'm happy to provide more info if required but I believe the rules I have set out are fair and keep us more consistent with Python but will see what you think.~

Update 2017-07-12: This needs to be implemented in Shippable CI, moved item to action plan.

[jborean93]

~Are we able to get a consensus on the state parameters for win_file when dealing with links. @dagwieers raised a comment around the naming and was hoping we can get a consensus on the way forward. The PR for this is https://github.com/ansible/ansible/pull/23119 and the 3 options are;~

~* Keep the same with symbolic_link, hard_link, junction_point~
~* Keep it consistent with file with link, hard, junction~
~* Make it similar but more descriptive than file with symlink, hardlink, junction/junctionpoint~
~(discussed, Jordan to use link/hard/junction)~

[trondhindenes]

I should be able to join today, as I got up (way too) late
EDIT: The calendar is in UTC. Bummer. Too late for me then.

[dagwieers]

~Something else to discuss: a means of setting default WinRM connection parameters from ansible.cfg.
The default transport type plaintext (when Kerberos not installed) we should probably change in v2.4 as a security measure. (Better this late, than never)~

[winrm_connection]

# Control the WinRM transport type
#   * plaintext (default) 
#   * kerberos (default, if kerberos is installed)
#   * ssl
#   * ntlm
#   * credssp
#transport = kerberos,plaintext

# Default WinRM username to use
#username = Administrator

# Default WinRM password to use
#password = <your-password>

# Default WinRM service name
#service = HTTP

# The hostname to use for the Kerberos exchange (default to the hostname in the endpoint URL
#kerberos_hostname = <hostname>

# WinRM keytab file name
#keytab = /path/to/your/keytab-file

# WinRM CA trust path
#ca_trust_path = /path/to/ca/trust

# WinRM PEM client certificate file path
#cert_pem = /path/to/cert.pem

# WinRM PEM client certificate key file path
#cert_key_pem = /path/to/cert.key.pem

# Control whether server certificates should be validated (only for Python versions that support it)
#   * validate (default)
#   * ignore
#server_cert_validation = validate

# Control whether TGT are sent to target nodes to allow multiple hops
#kerberos_delegation = False

# Control the WinRM default timeout for all operations
# This is the maximum allowed time in seconds for any single wsman HTTP operation (default 20).
# Note that operation timeouts while receiving output (the only wsman operation that should take
# any significant time, and where these timeouts are expected) will be silently retried indefinitely.
#operation_timeout_sec = 20 

# Control the WinRM connect/read timeout
# This is the maximum seconds to wait before an HTTP connect/read times out (default 30).
# This value should be slightly higher than operation_timeout_sec, as tasks can stall *at least* that long.
#read_timeout_sec = 30

Update: As discussed in the meeting, we definitely want this but are waiting for @bcoca's config changes to be merged.
Update 2017-07-12: Move item to action plan.

[jhawkesworth]

I'm seeing more improvement PRs for ConfigurRemotingForAnsible.ps1 and have begun wondering whether this script is getting overloaded with functionality ( see my comment on https://github.com/ansible/ansible/pull/24938). So I want to canvas opinion on whether we could/should break it up somehow.

Update 2017-06-09: Action jhawkesworth to work out matrix of options before further discussion.
Update 2017-07-12: Moved item to action plan.

[jborean93]

~Just having a look at https://github.com/ansible/ansibullbot/blob/master/MAINTAINERS.txt and see win_share and win_owner don't have a contributor I'm happy to take them on unless somebody has any objections?~

[dagwieers]

~@jborean93 Congratulations: https://github.com/ansible/ansibullbot/pull/560 !~

~Idea, why don't we add the following line in the MAINTAINERS.txt ? windows/: nitzmahone jhawkesworth jborean93 dagwieers~

[dagwieers]

~Time to split up the Windows documentation into various sections, as we want to document DSC usage with plenty of examples and best-practices:~

• ~Getting started / Introduction~
• ~Authentication options~
• ~Windows modules~
• ~Desired State Configuration~
• ~Best practices / Tips and tricks / Cookbook~
• ~Development / WWG~

[gundalow]

Regarding the above comment about documentation just a reminder regarding the docs/docsite/rst/ and docs/docsite/rst/dev_guide/ split

[dagwieers]

~I would like to discuss selecting the win_uri module as the reference module for the development documentation. It does require quite some work to get it there though. https://github.com/ansible/ansible/issues/20505#issuecomment-305962773~

~Update: It was decided to use win_environment as the reference module for the basic structure of a good module (check-mode and diff-mode), and refer to win_uri for examples of different types supported for Windows modules.~

[dagwieers]

~I'd like a discussion about -type="dict" (for win_nssm and possibly others). Do we only need support for dictionaries (hashtables) or also serialized PSObjects ? See ansible/ansible#25265, ansible/ansible#25356 and ansible/ansible#25358.~

~Update: In a Core meeting it was decided to fix win_nssm so it does not need an ordered dict implementation.~

[dagwieers]

Effort to have integration tests for all Windows modules. Please review and merge:

• win_iis_webapppool -- @jborean93 -- https://github.com/ansible/ansible/pull/25869
• win_iis_website -- @jborean93 -- https://github.com/ansible/ansible/pull/25902
• win_unzip -- @dagwieers -- https://github.com/ansible/ansible/pull/25335

[nitzmahone]

~Did some experimentation with GH wikis, projects, and read-only repo collaborators. I think making folks we want to assign issues to or request reviews from read-only repo collaborators is the way to go. Projects don't seem to be very useful in general in their current state, since only full collaborators can add/move issues between states. We'd have to augment that with the bot if we wanted to use them, and it doesn't seem significantly more useful than milestones/tags, but I could be convinced otherwise. Similar story with wikis- we could potentially use them, but short of having the ability to lock down changes to the same list of folks, we don't get a lot of added benefit (no apparent integration with issues/PRs, for instance).~

[dagwieers]

~I would like to discuss the documentation updates to reference non-Windows and Windows modules.
https://github.com/ansible/ansible/pull/25482~

~Update 2017-06-09: @nitzmahone to check with core/docs folks if they have any objection~
~Update 2017-06-22 Everyone signed off on it, so it now needs to be merged~
Update 2017-09-20 Implemented in https://github.com/ansible/ansible/pull/30588

[dagwieers]

~For the win_uri module we would need a basic webserver to test against (this is how Python is doing it). https://github.com/ansible/ansible/issues/25420~

~Is anyone interested in writing this in Powershell, or do we look for something else ?
cc: @gundalow @mattclay~

~Update 2017-06-09: @nitzmahone prefers to use something lightweight/builtin, so a bespoke HttpListener-based test server is still probably our best bet.~
Update 2017-06-22: An idea coined was to use httptester (docker), requires to open up the docker network for VMs first (@mattclay) Moved item to action plan.

[dagwieers]

WinRM and Connection refused issues, what can we do to make this recoverable ?
https://github.com/ansible/ansible/issues/25532

cc: @jborean93

Update 2017-06-09: @dagwieers to try and get a solid repro of this using Ansible, then we'll look at possible code changes to pywinrm to silently retry in "connection refused" case
Update 2017-06-12: Repro using SCVMM installer add to ansible/ansible#25532
Update 2017-06-17 @dagwieers has a working implementation doing retries

[dagwieers]

~Item raised during the meeting to move the meetings around so in Europe (CEST) we don't have a meeting either at 2AM or 18:30PM (on Friday).~

~Update: Meeting was moved to weekly at 20:00PM UTC. Calendar, MEETINGS.md and WWG updated.~

[dagwieers]

~We now have an IRC channel #ansible-windows for closer collaboration or support.~

~Update: This is now documented in the Windows Working Group info.~

[gundalow]

~Ansible Contributor Summit 4 (Part of AnsibleFest 2017 London)~

~Agenda for Contributor Summit has finalised can be found at https://public.etherpad-mozilla.org/p/ansible-summit-june-2017-agenda.~

~As a reminder, it will be in #ansible-meeting and BlueJeans~

~Note that there are sub pages for each topic. It's on the sub pages where you can add any topics there, rather than on the main agenda page.~

[nitzmahone]

~NO WWG MEETINGS WEEK OF JUNE 18-24 (AnsibleFest London + Contributor Summit)~

~Next meeting June 27/28~

[nitzmahone]

~So long as we can corner somebody with owner privs to turn it on on our repo (it's currently disabled, not sure if that's on purpose).~

[nitzmahone]

~With the new weekly schedule, might as well start it this week... The new meeting time falls on a US holiday next week (July 4), but if @jborean93 or someone else with #ansible-windows channel ops is willing to run it, no reason to cancel. (I will be eating BBQ, apple pie, and blowing things up)~

~https://s-media-cache-ak0.pinimg.com/736x/8d/34/e2/8d34e2b76e4d26ab9708699f7d101b1a--simpsons-funny-los-simpsons.jpg~

[jborean93]

~I've got a fun 2 days at orientation Tuesday and Wednesday next week so won't be able to do it as well. Looks like we have a week off.~

[dagwieers]

~We are planning a Windows sprint on 2017-07-04 instead of the meeting. Now, we may decide to do this earlier than the scheduled meeting time since all participants are close to UTC (@jhawkesworth, @trondhindenes, @gundalow, @dagwieers)~

~Preliminary sprint agenda is at: https://github.com/ansible/community/wiki/Windows:-sprints~

[jborean93]

~There are some PR's and Issues around adding/fixing facts for the Windows side, was hoping we can come to a consensus around how we want to handle them (the below are just some brief ones I've found)~

~Issues:~

• ~https://github.com/ansible/ansible/issues/25993~
• ~https://github.com/ansible/ansible/issues/25952~
• ~https://github.com/ansible/ansible/issues/25748~

~PRs:~

• ~https://github.com/ansible/ansible/pull/25917~
• ~https://github.com/ansible/ansible/pull/25803~
• ~https://github.com/ansible/ansible/pull/23500~

Update 2017-07-12: We decide to list the various missing/new facts in the Wiki and then take it from there. Moved item to action plan.

[dagwieers]

~So none of the Windows file-manipulating modules have backup: support (e.g. win_copy, win_template, win_lineinfile), now the new win_xml module comes with this option, and we should implement this in the same way for the other modules. @richardcs is willing to look at this and report back~

~See: https://github.com/ansible/ansible/pull/26404#issuecomment-312963901 and the python implementation at: https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/basic.py#L2208~

Update 2017-07-12: We decided @richardcs can propose an implementation based on the python code, which will then be merged into the revamped module_utils for Powershell when it is ready. Moved item to action plan.

[dagwieers]

~We probably should discuss the Windows Sprint 1 to learn from it. I already listed a few things from the top of my hat: https://github.com/ansible/community/blob/master/SPRINTS.md#best-practices~

~But new ideas and feedback is very welcome.~

[dagwieers]

~We have prepared documentation related to Windows paths and how Ansible works with quoting and backslashes. This documentation currently lives in the Wiki and we have a set of integration tests at ansible/ansible#26490, but we may want to move the docs to a PR so we can use the normal review process. Feedback welcome.~

Update 2017-07-12: Move this to a PR to the documentation. Moved item to action plan.

[dagwieers]

~We need a discussion about the use of Test-Path -LiteralPath for modules. Most modules are now allowing for globs in their tests where they probably should not. But how would we handle globs from Get-AnsibleParam when using type="path" ? Is there a need for this ?~

~[EDIT: nitzmahone]: -LiteralPath didn't seem to make any difference in any of the scenarios that use -IsValid, so we need to decide how/if to handle paths with globs, as well as paths with invalid (at validation time) drive letters: https://github.com/ansible/ansible/issues/26623~
~[EDIT: dagwieers]: This comment was not related to the -IsValid changes, but more general for all modules.~

Update 2017-07-12: Create integration tests to prove the issue and scope, then fix modules individually. Moved item to action plan.

[jborean93]

~Floating around the idea of creating a diagnostic script which users can run manually on their Windows servers. This script will check the current WinRM configuration for common issues like~

        Encryption level and if a HTTPS listener exists
    HTTPS/Certificate Checks
        NETWORK SERVICE can read the certificate
        CN matching hostname
        Subject Alternative names
        Expiry Date
        Signature Algorithm (for channel binding diagnostics)
    NTLM
        LmCompatibilityLevel
    CredSSP
        Value for winrm/config/service/CertificateThumbprint and that NETWORK SERVICE can access it
        TLS version supported by Windows
    Kerberos
        DNS stuff
        setspn -q ....

~This can help us by being able to easily point users to a script that will either show warning or error messages that we know are problematic as well as giving us more info to help debug issues for users.~

Update 2017-07-12: This idea was approved by everyone. Moved item to action plan.

[jborean93]

~Another thing to add to the agenda, we have a few modules that deal with converting usernames/groups to SIDs and a question has come up around the forms we want to handle. Currently there are 2 PRs out there which handle it in one form or another~

~https://github.com/ansible/ansible/pull/26276 and https://github.com/ansible/ansible/pull/26307 accepts similar forms except 26276 allows you to specify service accounts like SYSTEM, NETWORK SERVICE without specifying NT AUTHORITY while 26307 requires you to set NT AUTHORITY. There is also a minor different in how it handles local users on a DC but I don't think local users really apply on DCs.~

~I am hoping we can come to a consensus around this so when the modular utils are online we can have a consistent way Ansible can parse usernames and groups to a SID. @andrewsaraceni~

Update 2017-07-12: Consensus was that service accounts don't need NT AUTHORITY\ prepended for convenience. Moved item to action plan.

[dagwieers]

---

This agenda has been migrated to a new location: #195

---