Ansible 使用模板管理 ssh 用户

Question

我有一个可添加 50 多个 ssh 用户的 ansible playbook，用于打包 ami 构建。

这是我的 /playbooks/roles/users/tasks/create_user.yml: 的样子。

---
- name: "User {{ item.name }}"
  user:
    comment: "Add {{ item.name }} account"
    name: "{{ item.name }}"
    home: "/data/companies/project/{{ item.name }}"
    state: present
    uid: "{{ item.uid }}"
    group: company
    groups: company
    shell: /sbin/nologin
    state: present
    generate_ssh_key: no
    password: "{{ item.password }}"

- name: "Create home directory for {{ item.name }}"
  file:
    path: "/data/companies/project/{{ item.name }}"
    state: directory
    owner: "{{ item.name }}"
    group: company
    mode: 0700

/playbooks/roles/users/vars/main.yml 文件如下所示

---
location: UK
users:
  - name: user1
    password: $6$8T8lH2vS$JKIdqkQmHUHR/s75RYMguPyHTisnNrXIPOjJ9IWxMHB4LY9PJX.3rgkmfLCWAHDi5VYZno2ntlYm7Kkdy0iAZ.
    uid: 601
    location: UK
  - name: user2
    password: $6$8T8lH2vS$JKIdqkQmHUHR/s75RYMguPyHTisnNrXIPOjJ9IWxMHB4LY9PJX.3rgkmfLCWAHDi5VYZno2ntlYm7Kkdy0iAZ
    uid: 602
    location: USA

这是我的“/playbooks/roles/users/tasks/main.yml”的样子

---
 - name: Create users based on location
   include: create_users.yml
   loop: "{{ users | selectattr('location', 'equalto', location) | list }}"

运行相应的打包程序构建时，没有错误，但未创建 user1、user2 及其属性。

amazon-ebs: TASK [: Create users based on location] ***********************************
    amazon-ebs:
    amazon-ebs: PLAY RECAP *********************************************************************
    amazon-ebs: default                    : ok=10   changed=7    unreachable=0    failed=0
    amazon-ebs:

请有人帮我理解为什么没有创建用户？谢谢

Answer 1

这通常通过使用变量和循环来解决。将所有变量内容提取到一个列表变量中，其中包含参数字典，然后使用循环读取并应用。所以根据你的角色方法：

创建一个包含两个要运行的任务的任务文件 - /playbooks/roles/users/tasks/create_user.yml：

---

- name: User "{{ item.name }}"
  user:
    comment "{{ item.name }} company account"
    name: "{{ item.name }}"
    home: "/data/company/{{ item.name }}"
    state: present
    uid: 666
    group: company
    groups: company
    shell: /bin/bash
    state: present
    generate_ssh_key: no
    password: "{{ item.password }}"

- name: "Create home directory for {{ item.name }}"
  file:
    path: "/data/company/{{ item.name }}"
    state: directory
    owner: "{{ item.name }}"
    group: company
    mode: 0700

创建一个包含您的用户的 vars 文件 - /playbooks/roles/users/vars/main.yml：

---

location: UK   # This will be your default. It can be overridden in a variety of places
users:
  - name: user1
    password: <some password>
    location: US
  - name: user2
    password: <some password>
    location: UK
  - name: user3
    password: <some password>
    location: UK

然后在 /playbooks/roles/users/tasks/main.yml:

---

- name: Create users based on location
  include: create_user.yml
  loop: "{{ users | selectattr('location', 'equalto', location) | list }}"

希望大部分内容是不言自明的。因为您使用的是角色，所以通过将 users 变量放在 /playbooks/roles/users/vars/main.yml 中，该变量会自动变为可用。 users | selectattr('location', 'equalto', location) 表达式采用 user 变量并过滤列表以仅包含 'location' 元素等于 'location' 变量中指定的值的对象。

Variables

Loops

Roles

Answer 2

一些额外的提示，你也可以使用默认值。 此外，如果您想保护加密密码，可以将它们存储在 Ansible Vault 中：

users.yml 示例：

users:
- name: user1
  uid: 666
  group: group1
  groups: [allusers]
  comment: User One
  home: /home/user1
  shell: /bin/bash

passwords: "{{ vault_passwords }}"

您使用“ansible-vault”命令加密的保管库文件看起来像（已解密）：

passwords:
- name: user1
  password: $6$509875346RH.RAaVNW2iWtf/QJ4zUGaJiEyh.

playbook 包含的任务文件示例：

  - name: Set up user accounts
    user:
      name: "{{ item.name }}"
      create_home: '{{ item.createhome | default("no") }}'
      uid: "{{ item.uid }}"
      group: "{{ item.group }}"
      state: '{{ item.state | default("present") }}'
      comment: '{{ item.comment | default("Ansible created comment") }}'
      home: "{{ item.home }}"
      shell: '{{ item.shell | default("/bin/bash") }}'
    with_items: "{{ users }}"

  - name: Set up user account passwords
    user:
      name: "{{ item.name }}"
      password: '{{ item.password | default("*") }}'
    with_items: "{{ passwords }}"