Skip to content

Improve ensure_stack_user tasks #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danpawlik wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Improve ensure_stack_user tasks #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 34 additions & 28 deletions ansible/roles/ensure_stack_user/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,34 +3,27 @@
- name: create stack user as root
become: yes
tags: users
vars:
devstack_user: stack
block:
- name: stack group
group:
name: stack
state: present

- name: stack user
user:
name: stack
- name: Create user
become: true
ansible.builtin.user:
name: "{{ devstack_user }}"
password: "{{ stack_user_password | password_hash('sha512','A512') }}"
shell: /bin/bash
group: stack
home: /opt/stack

@SeanMooney SeanMooney Jun 11, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i was actully intentionlly not using /opt/stack as the home dire but we can. that is more aligned to devstacsk default behavior if you use its script

@danpawlik danpawlik Jun 11, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agree, but if you would like to have /home/{{ microshift_user }} in that case there would be another issue

@SeanMooney SeanMooney Jun 11, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[stack@microshift ~]$ ls -al .kube/config
-rw-------. 1 stack stack 11431 Jun 9 05:29 .kube/config
[stack@microshift ~]$ echo $HOME
/home/stack
[stack@microshift ~]$ pwd
/home/stack
[stack@microshift ~]$ oc get pod | head -n 2
NAME READY STATUS RESTARTS AGE
bootstrap-edpm-deployment-openstack-edpm-zssvc 0/1 Completed 0 2d20h

so what your seeign dose not seam to macht up to what i saw in my microshfit env

how did you create teh vm out of interst

currentl that is form the oko microshfit molecule senario

@SeanMooney SeanMooney Jun 12, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think i know why there may be a delta in behavior.

im using molecule for testign invoking the ansibel to providsion the vms which is using cloud-init to bootstrap the intiall vm before runnign the ansible.

if you created the vm or are tryign to run agaisnt a prexisting vm the user setup may be different.

https://github.com/SeanMooney/ard/blob/master/ansible/roles/ard_libvirt_node/tasks/node.yml#L38-L45

ill review the behvior with and without that and get back to you.

this role is how i used to do that when i was using molecule vagrant and the old way this repo works but i changed the user creation in the last week and have not confirm this role is still alinged to that on a prexisting vm or one when the cloud-init file is not used.

create_home: true
state: present
shell: /bin/bash

- name: grant stack user passwordless sudo privileges
copy:
dest: /etc/sudoers.d/50_stack_user
content: |
stack ALL=(ALL) NOPASSWD:ALL

- name: create /opt/stack
become: yes
ansible.builtin.file:
path: '/opt/stack'
state: directory
mode: '0777'
owner: stack
group: stack
- name: Add user to sudoers with NOPASSWD
become: true
ansible.builtin.lineinfile:
path: /etc/sudoers.d/50_stack_user
create: true
mode: "0440"
line: "{{ devstack_user }} ALL=(ALL) NOPASSWD:ALL"
validate: "visudo -cf %s"

@SeanMooney SeanMooney Jun 11, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure that makes it configurable.


- name: generate stack user ssh key "{{ssh_key_filename}}"
delegate_to: 127.0.0.1
Expand All @@ -43,6 +36,19 @@
mode: '0600'
force: no

- name: "Read {{ ssh_key_filename }} pub key"
tags: ssh
delegate_to: 127.0.0.1
ansible.builtin.slurp:
src: "~/.ssh/{{ssh_key_filename}}.pub"
register: _ssh_key_filename_content

- name: Read authorized_keys
tags: ssh
ansible.builtin.slurp:
src: .ssh/authorized_keys
register: _user_authorized_keys

@SeanMooney SeanMooney Jun 11, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok so your doing this so that if you have preprovisioned a node we can extend the exsitng keys

i thoug we didnt need to do that when using ansible.posix.authorized_key and it would append.

im not agsint that but let me double check the docs

- name: setup stack user ssh keys
become_user: stack
become: yes
Expand All @@ -61,11 +67,12 @@
copy:
src: "~/.ssh/{{ssh_key_filename}}.pub"
dest: "~/.ssh/id_ed25519.pub"

- name: Set authorized key
ansible.posix.authorized_key:
user: stack
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/' + ssh_key_filename + '.pub') }}"
key: "{{ _user_authorized_keys.content | b64decode + _ssh_key_filename_content.content | b64decode }}"

- name: setup root user ssh keys
become: yes
Expand All @@ -88,7 +95,7 @@
ansible.posix.authorized_key:
user: root
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/' + ssh_key_filename + '.pub') }}"
key: "{{ _user_authorized_keys.content | b64decode + _ssh_key_filename_content.content | b64decode }}"

- name: setup ansible user ssh keys
tags: ssh
Expand All @@ -110,8 +117,7 @@
ansible.posix.authorized_key:
user: "{{ ansible_user }}"
state: present
key: "{{ lookup('file', lookup('env','HOME') + '/.ssh/' + ssh_key_filename + '.pub') }}"

key: "{{ _user_authorized_keys.content | b64decode + _ssh_key_filename_content.content | b64decode }}"

- name: update ansible_user
tags: always
Expand Down