Ansible 创建用户和组

Question

我正在尝试使用 Ansible playbook 创建新用户和组。下面是我的文件夹结构。

tree
.
├── create-users.yaml
└── ubuntu

create-users.yaml playbook 包含创建用户和组任务。请注意，我的目标计算机中没有任何组 (admin_group) 和用户 (Rajini, Kamal)，而是在运行 playbook 时创建它们。

---
- name:  Create Users & Groups
  hosts: target1
  gather_facts: false
  tasks:
    - name: Create Users Task
      user:
        name: "{{ item }}"
        state: present
        password: "{{ 'default_user_password' | password_hash('sha512','A512') }}"
        shell: /bin/bash
        groups: "{{ admin_group }}"
      loop:
        - Rajini
        - Kamal

我有另一个名为ubuntu 的文件来选择组名和密码。运行 playbook 时出现以下错误。

ansible-playbook --vault-id @prompt create-users.yaml -K
BECOME password:
Vault password (default):

PLAY [Create Users & Groups] *****************************************************************************************************************************************************************

TASK [Create Users Task] *********************************************************************************************************************************************************************
fatal: [target1]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'admin_group' is undefined\n\nThe error appears to be in '/home/osboxes/Ansible_Project/web_deployment/Ansible/groups_vars/create-users.yaml': line 6, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n  tasks:\n    - name: Create Users Task\n      ^ here\n"}

PLAY RECAP ***********************************************************************************************************************************************************************************
target1                    : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

admin_group: admin
default_user_password: Password1

有人可以帮我解决这个问题吗？

在得到用户 Moon 的帮助后更新输出。

ansible-playbook --vault-id @prompt create-users.yaml -K
BECOME password:
Vault password (default):

PLAY [Create Users & Groups] *****************************************************************************************************************************************************************

TASK [Create Users Task] *********************************************************************************************************************************************************************
changed: [target1] => (item=Rajini)
changed: [target1] => (item=Kamal)

PLAY RECAP ***********************************************************************************************************************************************************************************
target1                    : ok=1    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

ssh Kamal@192.168.0.1
Kamal@192.168.0.1's password:
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 5.0.0-23-generic x86_64)
Kamal@Ansible_Target1:~$ id
uid=1005(Kamal) gid=1001(admin) groups=1001(admin)

Answer 1

几件事：

• 要使用 ubuntu 文件中的变量，您需要在 playbook 中指定 vars 文件。
• 要将default_user_password 用作变量，请删除引号'
• 如果您希望admin 作为用户的主要组，请改用group 属性。另一方面，groups 获取一个列表并将用户添加到列出的组中。

并且，如果尚未在目标计算机上创建组，则首先使用 group module 创建组。

上述更改后的剧本。

---
- name: Create Users & Groups
  hosts: target1
  gather_facts: false
  vars_files: ubuntu
  tasks:
    - name: Create group
      group:
        name: "{{ admin_group }}"
        state: present

    - name: Create Users Task
      user:
        name: "{{ item }}"
        state: present
        password: "{{ default_user_password | password_hash('sha512','A512') }}"
        shell: /bin/bash
        group: "{{ admin_group }}"
      loop:
        - Rajini
        - Kamal

Answer 2

这将帮助您使您的剧本更有活力：

• 使用以下命令创建一个用于存储用户密码的 secret.yml 文件：

  ansible-vault create secret.yml
  #sample:
  user_password: mypass@155
  

• 创建 userlist.yml 以指定用户及其部门的列表：

vim userlist.yml

#sample:
##user matching job role mentioned in create-user.yml playbook will be created


    - users:
            - name: "user1"
              job: "developer"
    
            - name: "user2"
              job: "devops"
    
            - name: "user3"
              job: "developer"

• 现在创建您的剧本，如下所示：

vim user-create.yml

   - hosts: appserver1
      vars_files: 
        - secret.yml
        - userlist.yml
    
      tasks:
        - name: "create group" 
          group:
            name: "{{ item  }}"  
          loop: 
              - "dev"
              - "devops"
          
        - name: "create user when Job=developer from userlist.yml file with password from secret.yml file and add to secondary group 'dev' "
          user: 
            name: "{{ item['name'] }}"
            password: "{{ user_password | password_hash('sha512')  }}"   
            update_password: on_create 
            groups: "dev"
            append: yes
          loop: "{{ users }}"
          when: "item['job'] == 'developer'"
    
    
        - name: "create user when Job=devops from userlist.yml file with password from secret.yml file and add to secondary group 'devops' "
          user:
            name: "{{ item['name']  }}"
            password: "{{ user_password | password_hash('sha512')  }}"
            update_password: on_create
            groups: "devops"
            append: yes
          loop: "{{ users }}"
          when: "item['job'] == 'devops'"

运行剧本

ansible-playbook -i inventory  user-create.yml  --ask-vault-pass

要记住的事情 如果不指定 update_password: on_create 选项，Ansible 会在每次 playbook 运行时重新设置用户密码：如果用户自上次运行 playbook 后更改了密码，Ansible 会重新设置密码。