title: Connection problem with WinRM and Ansible
body: <p>I am trying to connect to multiple Windows nodes but I am getting different errors. The behaviour is the same for all of them. I have done it many times successfully in other enviroments, but in this case there must be some problem that I cannot find out. In case it is relevant, my infrastructure consists of a Kubernetes cluster made up of several pods. One of those pods has a container in which I have Ansible installed and it is from which I want to establish the remote connection with machines out of the cluster. Below I show all my attempts to make it work in one of the nodes.</p>
  <p>First of all, I have run the script ConfigureAnsibleForRemoting.ps1 to initiate WinRM so that Ansible can connect. The WinRM configuration shows that Basic, Kerberos, Negotiate, and Certificate auth are enabled. Both HTTP and HTTPS listeners are configured too:</p>
  <p><a href="https://i.stack.imgur.com/vJaHU.png" rel="nofollow noreferrer">WinRM configuration and listeners</a></p>
  <p>To check that everything is set up correctly, I have carried out some tests:</p>
  <ol>
  <li><p>Run Test-WSMan</p>
  </li>
  <li><p>Log in powershell session from remote machine</p>
  </li>
  <li><p>Node is reachable from the container</p>
  <p><a href="https://i.stack.imgur.com/os2GL.png" rel="nofollow noreferrer">Tests</a></p>
  </li>
  </ol>
  <p>I have used Basic, NTLM and Certificate auth. Here is my inventory (I do not utilize a domain user but a local user) and the result when I make a win_ping with Ansible in each case:</p>
  <p><strong>- Basic: port 5986</strong></p>
  <pre><code>[prueba_cinco]
  host ansible_host=IP
  
  [prueba_cinco:vars]
  ansible_user=user
  ansible_password=pass
  ansible_connection=winrm
  ansible_winrm_server_cert_validation=ignore
  </code></pre>
  <p><a href="https://i.stack.imgur.com/AsHPU.png" rel="nofollow noreferrer">Basic: port 5986 output</a></p>
  <p><strong>- Basic: port 5985</strong></p>
  <pre><code>[prueba_cinco]
  host ansible_host=IP
  
  [prueba_cinco:vars]
  ansible_user=user
  ansible_password=pass
  ansible_connection=winrm
  ansible_port=5985
  </code></pre>
  <p><a href="https://i.stack.imgur.com/NT4VZ.png" rel="nofollow noreferrer">Basic: port 5985 output</a></p>
  <p>This is the expected behaviour, since AllowUnencrypted in the winrm configuration is set to false.
  Just to gain more insight into the problem, I allowed unencrypted traffic, and after that the connection could be established normally:</p>
  <p><a href="https://i.stack.imgur.com/qUg3x.png" rel="nofollow noreferrer">WinRM config: AllowUnencrypted and Basic: port 5985 output 2</a></p>
  <p><strong>- NTLM: port 5986</strong></p>
  <pre><code>[prueba_siete]
  host ansible_host=IP
  
  [prueba_siete:vars]
  ansible_user=user
  ansible_password=pass
  ansible_connection=winrm
  ansible_winrm_server_cert_validation=ignore
  ansible_winrm_transport=ntlm
  </code></pre>
  <p><a href="https://i.stack.imgur.com/Cws2I.png" rel="nofollow noreferrer">NTML: port 5986 output</a></p>
  <p><strong>- NTLM: port 5985</strong></p>
  <pre><code>[prueba_siete]
  host ansible_host=IP
  
  [prueba_siete:vars]
  ansible_user=user
  ansible_password=pass
  ansible_connection=winrm
  ansible_winrm_transport=ntlm
  ansible_port=5985
  </code></pre>
  <p><a href="https://i.stack.imgur.com/z1KRX.jpg" rel="nofollow noreferrer">NTLM: port 5985 output</a></p>
  <p>This works, although a huge error is obtained. I later tried this option with a domain user and the credentials were rejected.</p>
  <p><strong>- Certificate: port 5986 (only works with HTTPS)</strong></p>
  <p>For this method, I have followed the procedure of the official documentation. I have generated a certificate with New-SerfSignedcertificate in Powershell. Then I have converted the PFX file created to a private key with OpenSSL (that also contains the public key). By last, I have imported a certificate to the Certificate Store and mapped the certificate to an account.</p>
  <pre><code>[WINDOWS]
  host ansible_host=IP
  
  [WINDOWS:vars]
  ansible_connection='winrm'
  ansible_winrm_cert_pem='cert_win.pem'
  ansible_winrm_cert_key_pem='cert_win.pem'
  ansible_winrm_transport='certificate'
  ansible_winrm_scheme='https'
  ansible_winrm_server_cert_validation='ignore'
  </code></pre>
  <p><a href="https://i.stack.imgur.com/Zshfs.png" rel="nofollow noreferrer">Certificate: port 5986 output</a></p>
  <p>As you may have noticed, when I try to connect through the port 5986, I always obtain a time out (Read timed out) regardless of the method or credentials. I have increased the execution time out, but the result is the same. On the other hand, the port 5985 seems to work but an error related to headers appears and I do not know the reason. Anyway, I only would use this one as a last option, since I need to use the port 5986.</p>
  <p>To make sure that the container configuration is not what is causing these issues, I have deployed the same image in another environment and everything works perfectly when I try to connect to Windows nodes, I can connect without any error.</p>
  <p>Does anyone know what is happening?</p>
  <p>Thank you in advance.</p>