Ansible problem - fatal error for host: "UNREACHABLE!" "Failed to create temporary directory."

User Support
1

Hello,
I installed Ansible as described in README.md https://github.com/QubesOS/qubes-ansible/blob/main/README.md:

  • to Dom0 I installed qubes-ansible-dom0
  • to template used for default-mgmt-dvm (fedora-43-xfce) I installed qubes-ansible-vm

Then I appended lines as described in Management VM-section to files:

  • /etc/qubes/policy.d/include/admin-local-rwx
  • /etc/qubes/policy.d/include/admin-global-ro
  • /etc/qubes/policy.d/30-ansible.policy

Next I created inventory file:

[local]
localhost
[local:vars]
ansible_connection=local
[appvms]
fedora-demo-appvm
[appvms:vars]
ansible_connection=qubes
[templatevms]
fedora-demo                             # this is existing template
fedora-clone-ansible 
[templatevms:vars]
ansible_connection=qubes

Then I created a playbook that should:

  • clone fedora-demo template as new template with name fedora-clone-ansible
  • start it
  • install flatpak package to it (by using mgmt-dvm as proxy)

This is my playbook.yaml:

---
- hosts: local
  connection: local
  tasks:
  - name: clone template
    qubesos:
      name: fedora-clone-ansible
      state: present
      template: "fedora-demo"
      vmtype: TemplateVM
      

- hosts: local
  tasks:
  - name: start template
    qubesos:
      name: fedora-clone-ansible
      state: running
      wait: true

- hosts: fedora-clone-ansible
  tasks:
  - name: install flatpak
    become: yes
    dnf:
      package: flatpak

Everything works fine until last task. Qubes starts mgmt-dvm-fedora-clone-ansible, but then I get an error:
fatal: [fedora-clone-ansible]: UNREACHABLE! => {
“changed”: false,
“msg”: “Failed to create temporary directory. In some cases, you may have been able to authenticate and did not have permissions on the target directory. Consider changing the remote tmp path in ansible.cfg to a path rooted in "/tmp", for more error information use -vvv. Failed command was: ( umask 77 && mkdir -p "echo ~/.ansible/tmp"&& mkdir "echo ~/.ansible/tmp/ansible-tmp-1778910509.4363546-763-113605423299708" && echo ansible-tmp-1778910509.4363546-763-113605423299708="echo ~/.ansible/tmp/ansible-tmp-1778910509.4363546-763-113605423299708" ), exited with result 1”,
“unreachable”: true
}
How to get this working?

2

The forum mangled your error message, which almost certainly contains backticks (`) - which I hate, for this reason…

First thing/idea that I would try is to move the “become: yes” line under “- hosts: fedora-clone-ansible” so that all the tasks are executed as root:

3

Thansk for you answer barto, but I still get same error. I don’t know, if this error means, that Ansible hasn’t permission to write to /tmp/ in mgmt-dvm or in target template; in my case fedora-clone-ansible (?)

4

Same issue here when using a management VM based on Fedora 43, while one based on Debian 13 works fine.

Basic troubleshooting points to SELinux.

When you run ansible-playbook, add “-vvvv” to get a more detailed error message.

Edit: Missed a word.

5

According to https://github.com/QubesOS/qubes-ansible it is possible to use a dedicated qube to run Ansible playbooks. If I want to e.g. clone a template:

---
- hosts: local
  connection: local
  tasks:
  - name: clone template
    qubesos:
      name: fedora-clone-ansible
      state: present
      template: "fedora-demo"
      vmtype: TemplateVM

what should I change for hosts and connection values? And how to change invenroty file?
I have made changes to files in /etc/qubes/policy.d/include/ and created /etc/qubes/policy.d/30-mgmtvm.policy file as instructed in Github.

6

For those who come after:

I have had this problem. After much searching I found:

  • the target was a template - I do not know if this is important.
  • the target qube was not running. Lets call it “tpl-target”
  • the hidden management qube was running. For example: qvm-ls | grep disp-mgmt- shows “disp-mgmt-tpl-target”
  • after qvm-kill of the “disp-mgmt-tpl-target” qube, my playbook could run.
  • [see Edit2, below, and ignore this :I think that this must have happened after I did Ctrl-C during an ansible-playbook run.
    I think there must be some cleanup which my Ctrl-C bypassed. Maybe there is some missing trap or test in qubes-ansible but I really do not know what it should be.]

[Edit2: I find that “Shut down when idle” is inactive on default-dvm and default-mgmt-dvm, because of missing qubes-app-shutdown-idle package in the template. Maybe this could explain the problem I see…] [Edit 3: No, at least some disposables are shutting down correctly… I have no explanation]

[Edit: I took the liberty of making the title more descriptive. I hope it is OK]