Ansible create Users and Group

user_12518647 0
Viewed 18221

I am trying to create new users and groups using Ansible playbook. Below is my folder structure.

tree
.
├── create-users.yaml
└── ubuntu

create-users.yaml playbook contains create user and group tasks. Note, I am not having any group (admin_group) and users (Rajini, Kamal) in my target machine, instead they will be created when running the playbook.

---
- name:  Create Users & Groups
  hosts: target1
  gather_facts: false
  tasks:
    - name: Create Users Task
      user:
        name: "{{ item }}"
        state: present
        password: "{{ 'default_user_password' | password_hash('sha512','A512') }}"
        shell: /bin/bash
        groups: "{{ admin_group }}"
      loop:
        - Rajini
        - Kamal

I have another file called ubuntu to pick group name and password. When running the playbook I am getting below error.

ansible-playbook --vault-id @prompt create-users.yaml -K
BECOME password:
Vault password (default):

PLAY [Create Users & Groups] *****************************************************************************************************************************************************************

TASK [Create Users Task] *********************************************************************************************************************************************************************
fatal: [target1]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'admin_group' is undefined\n\nThe error appears to be in '/home/osboxes/Ansible_Project/web_deployment/Ansible/groups_vars/create-users.yaml': line 6, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n  tasks:\n    - name: Create Users Task\n      ^ here\n"}

PLAY RECAP ***********************************************************************************************************************************************************************************
target1                    : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0


admin_group: admin
default_user_password: Password1

Can somebody please help me on this?

Updating Output after getting help from user Moon.

ansible-playbook --vault-id @prompt create-users.yaml -K
BECOME password:
Vault password (default):

PLAY [Create Users & Groups] *****************************************************************************************************************************************************************

TASK [Create Users Task] *********************************************************************************************************************************************************************
changed: [target1] => (item=Rajini)
changed: [target1] => (item=Kamal)

PLAY RECAP ***********************************************************************************************************************************************************************************
target1                    : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0


ssh Kamal@192.168.0.1
Kamal@192.168.0.1's password:
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 5.0.0-23-generic x86_64)
Kamal@Ansible_Target1:~$ id
uid=1005(Kamal) gid=1001(admin) groups=1001(admin)
ansible
2 Answers

Couple of things:

  • To use variables from ubuntu file you need specify the vars file in playbook.
  • To use default_user_password as a variable, remove the quotes '
  • If you want admin as the users primary group then use group attribute instead. groups on the other hand takes a list and add the users to the listed groups.

And, if the group isn't created yet on the target machine then first create the group using group module.

Playbook after the above changes.

---
- name: Create Users & Groups
  hosts: target1
  gather_facts: false
  vars_files: ubuntu
  tasks:
    - name: Create group
      group:
        name: "{{ admin_group }}"
        state: present

    - name: Create Users Task
      user:
        name: "{{ item }}"
        state: present
        password: "{{ default_user_password | password_hash('sha512','A512') }}"
        shell: /bin/bash
        group: "{{ admin_group }}"
      loop:
        - Rajini
        - Kamal
user_21285030

This will help you make your playbook more dynamic:

  • create a secret.yml file for storing user password using below command:

    ansible-vault create secret.yml
#sample:
user_password: mypass@155

  • create userlist.yml to specify the list of user and their department:

vim userlist.yml

#sample:
##user matching job role mentioned in create-user.yml playbook will be created


    - users:
            - name: "user1"
              job: "developer"
    
            - name: "user2"
              job: "devops"
    
            - name: "user3"
              job: "developer"
  • Now create your playbook as follows:

vim user-create.yml

   - hosts: appserver1
      vars_files: 
        - secret.yml
        - userlist.yml
    
      tasks:
        - name: "create group" 
          group:
            name: "{{ item  }}"  
          loop: 
              - "dev"
              - "devops"
          
        - name: "create user when Job=developer from userlist.yml file with password from secret.yml file and add to secondary group 'dev' "
          user: 
            name: "{{ item['name'] }}"
            password: "{{ user_password | password_hash('sha512')  }}"   
            update_password: on_create 
            groups: "dev"
            append: yes
          loop: "{{ users }}"
          when: "item['job'] == 'developer'"
    
    
        - name: "create user when Job=devops from userlist.yml file with password from secret.yml file and add to secondary group 'devops' "
          user:
            name: "{{ item['name']  }}"
            password: "{{ user_password | password_hash('sha512')  }}"
            update_password: on_create
            groups: "devops"
            append: yes
          loop: "{{ users }}"
          when: "item['job'] == 'devops'"

Run the playbook

ansible-playbook -i inventory  user-create.yml  --ask-vault-pass

Things to remember If you do not specify the update_password: on_create option, Ansible re-sets the user password every time the playbook is run: if the user has changed the password since the last time the playbook was run, Ansible re-sets password.

user_150144460
Related