Red Hat Ansible for Network Automation

Create an encrypted file named users-secret.yml in the ~/proj/vars/ directory. This file will define the password variables and store the passwords to be used in the playbook.

Use the associative array variable newusers to define users and passwords using the name and pw keys, respectively. Define the ansibleuser1 user and its redhat password. Also define the ansibleuser2 user and its Re4H1T password.

Set the Vault password to redhat.

1. If you do not already have a vars/ directory, create it now.

   [student@workstation proj]$ mkdir -p vars

2. Change to the vars directory.

   [student@workstation proj]$ cd vars

3. Create an encrypted file named users-secret.yml in vars/. Provide a Vault password of redhat and confirm it. This will open a file in the default editor.

   [student@workstation vars]$ ansible-vault create users-secret.yml
   New Vault password: redhat
   Confirm New Vault password: redhat

4. Add a variable named newusers. It should consist of a list of associative arrays, with key/value pairs, where the keys are name and pw, as illustrated here:

   ---
   newusers:
   - name: ansibleuser1
     pw: redhat
   - name: ansibleuser2
     pw: Re4H1T

   Save the file.

Create a playbook in the ~/proj/ directory named create-users.yml that uses the variables defined in the vars/users-secret.yml encrypted file.

[student@workstation proj]$ cat create-users.yml
---
- name: create users on the spine machines
  hosts: spines
  vars_files:
    - vars/users-secret.yml

  tasks:

    - name: create users
      vyos_user:
        name: "{{ item.name }}"
        configured_password: "{{ item.pw }}"
        state: present
      loop: "{{ newusers }}"
      loop_control:
        label: "{{ item.name }}"

Verify the syntax of the play contained in your playbook, and then run it. The first command in the following example is on one long line that ends with create-users.yml.

[student@workstation proj]$ ansible-playbook --ask-vault-pass --syntax-check create-users.yml
Vault password: redhat

playbook: create-users.yml
[student@workstation proj]$ ansible-playbook --ask-vault-pass create-users.yml
SSH password: vyos
Vault password: redhat

PLAY [create users on the spine machines] *************************************

TASK [create users] ************************************************************
changed: [spine01] => (item=ansibleuser1)
changed: [spine02] => (item=ansibleuser1)
changed: [spine01] => (item=ansibleuser2)
changed: [spine02] => (item=ansibleuser2)

PLAY RECAP *********************************************************************
spine01                   : ok=1   changed=1   unreachable=0   failed=0
spine02                   : ok=1   changed=1   unreachable=0   failed=0

Execute an ad hoc command to confirm that the users exist.

[student@workstation proj]$ ansible -m vyos_command \
> -a "commands='sh sys login users'" spines
SSH password: vyos
spine02 | SUCCESS => {
    "changed": false,
...output omitted...
    "stdout_lines": [
        [
          "Username        Type    Tty      From              Last login",
          "ansibleuser1    vyatta                             never logged in",
          "ansibleuser2    vyatta                             never logged in",
          "vyos            vyatta  pts/0    172.25.250.254    Thu Jul 30 14:40:16 2020"
        ]
    ]
}
spine01 | SUCCESS => {
    "changed": false,
...output omitted...
    "stdout_lines": [
        [
          "Username        Type    Tty      From              Last login",
          "ansibleuser1    vyatta                             never logged in",
          "ansibleuser2    vyatta                             never logged in",
          "vyos            vyatta  pts/0    172.25.250.254    Thu Jul 30 14:40:15 2020"
        ]
    ]
}