9a9af41e48
This updates our user management system to use the userdel --force flag when disabling and removing distro cloud image users like 'ubuntu', 'centos' and 'admin'. The reason for this is when we switch from using the distro user to boot strap launchnode over to root the distro user may still have running processes that prevent userdel from succeeding. This should address that problem and delete the user anyway. The last step in the launch node process is to reboot which should clear out any stale processes. We don't do this for normal users as they aren't removed at node launch time and this may be too forceful for them. It would be better for us to error in that case and clean up any stale processes. Change-Id: I79caf2a996566ecaec4cb4a70941bb3f03a5fb73
86 lines
2.0 KiB
YAML
86 lines
2.0 KiB
YAML
- name: Add sudo group
|
|
group:
|
|
name: "sudo"
|
|
state: present
|
|
|
|
# NOTE(mordred): We replace the main file rather than dropping a file in to
|
|
# /etc/sudoers.d to deal with divergent base sudoers files from our distros.
|
|
# We also want to change some default behavior (we want nopassword sudo, for
|
|
# instance).
|
|
- name: Setup sudoers file
|
|
copy:
|
|
dest: /etc/sudoers
|
|
src: sudoers
|
|
owner: root
|
|
group: root
|
|
mode: 0440
|
|
|
|
- name: Setup adduser.conf file
|
|
copy:
|
|
dest: /etc/adduser.conf
|
|
src: '{{ ansible_facts.os_family }}/adduser.conf'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: Setup login.defs file
|
|
copy:
|
|
dest: /etc/login.defs
|
|
src: '{{ ansible_facts.os_family }}/login.defs'
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: Delete default distro cloud image users
|
|
# Do this in a separate task so that we can use force: yes which is
|
|
# probably too destructive for normal users, but should be fine for
|
|
# these built in cloud image names.
|
|
loop: "{{ disabled_distro_cloud_users }}"
|
|
user:
|
|
name: "{{ item }}"
|
|
state: absent
|
|
remove: yes
|
|
force: yes
|
|
|
|
- name: Delete old users
|
|
loop: "{{ disabled_users }}"
|
|
user:
|
|
name: "{{ item }}"
|
|
state: absent
|
|
remove: yes
|
|
|
|
- name: Add groups
|
|
loop: "{{ base_users + extra_users }}"
|
|
group:
|
|
name: "{{ item }}"
|
|
state: present
|
|
gid: "{{ all_users[item].gid|default(omit) }}"
|
|
when:
|
|
- item in all_users
|
|
- "'gid' in all_users[item]"
|
|
|
|
- name: Add users
|
|
loop: "{{ base_users + extra_users }}"
|
|
user:
|
|
name: "{{ item }}"
|
|
state: present
|
|
uid: "{{ all_users[item].uid }}"
|
|
group: "{{ item }}"
|
|
comment: "{{ all_users[item].comment }}"
|
|
groups: sudo
|
|
shell: /bin/bash
|
|
when:
|
|
- item in all_users
|
|
- "'uid' in all_users[item]"
|
|
|
|
- name: Add ssh keys to users
|
|
loop: "{{ base_users + extra_users }}"
|
|
authorized_key:
|
|
user: "{{ item }}"
|
|
state: present
|
|
key: "{{ all_users[item].key }}"
|
|
exclusive: yes
|
|
when:
|
|
- item in all_users
|
|
- "'key' in all_users[item]"
|