In an ideal world, all of your configuration information would be stored as Ansible variables, in the various places that Ansible lets you define variables (e.g., the vars section of your playbooks, files loaded by vars_files , files in the host_vars or group_vars directory).
Alas, the world is a messy place, and sometimes a piece of configuration data we need lives somewhere else. Maybe it’s in a text file or a .csv file, and we don’t want to just copy the data into an Ansible variable file because now you have to maintain two copies of the same data, and you believe in the DRY 2 principle. Or maybe the data isn’t maintained as a file at all; it’s maintained in a key-value storage service such as etcd.
Ansible has a feature called lookups that allows you to read in configuration data from various sources and then use that data in your playbooks and template. Ansible supports a collection of lookups for retrieving data from different sources. Some of the lookups are shown in the Table
| Name | Description |
|---|---|
| file | Contents of a file |
| password | Randomly generate a password |
| pipe | Output of locally executed command |
| env | Environment variable |
| template | Jinja2 template after evaluation |
| csvfile | Entry in a .csv file |
| dnstxt | DNS TXT record |
| redis_kv | Redis key lookup |
| etcd etcd | key lookup |
You invoke lookups by calling the lookup function with two arguments. The first is a string with the name of the lookup, and the second is a string that contains one or more arguments to pass to the lookup. For example, we call the file lookup like this:
lookup('file', '/path/to/file.txt')
- name: Copying the ssh-keys
authorized_key:
user: "{{ item.name }}"
state: "{{ item.state }}"
key: "{{ lookup('file','{{ item.key }}') }}"
with_items:
- "{{ users }}"
ignore_errors: "{{ ansible_check_mode }}"You can invoke lookups in your playbooks between {{ braces }} , or you can put them in templates.
In this section, I provided only a brief overview of lookups that are available. The Ansible documentation provides more details on available lookups and how to use them.
Let's try to generate a random password for a users list come from a file. The password should be encrypted and save in a file.
First we should have or import a list of users which we will use to create on our targets, the list is the below:
users:
- name: luiz.eduardo
comment: "Service account"
job: dev
- name: isweluiz
comment: "Service account"
job: infra- hosts: all
become: true
vars:
state_user: present
vars_files:
- users.yml
tasks:
- name: Create new user with random password - DEV
user:
name: "{{ item.name }}"
comment: "{{ item.comment }}"
password: "{{ lookup('password', '/home/vagrant/' + item.name + '/password.txt encrypt=md5_crypt length=15') }}"
state: "{{ state_user }}"
when:
- item.job == 'dev'
with_items:
- "{{ users }}"
- name: Create new user with random password - INFRA
user:
name: "{{ item.name }}"
comment: "{{ item.comment }}"
password: "{{ lookup('password', '/home/vagrant/' + item.name + '/password.txt encrypt=md5_crypt length=8') }}"
state: "{{ state_user }}"
when:
- item.job == 'infra'
with_items:
- "{{ users }}"Let run and see the result:
[vagrant@node-centos-1 ~]$ ansible-playbook playbooks/create-user.yml
PLAY [all] *******************************************************************************************************************************************************************************************
TASK [Gathering Facts] *******************************************************************************************************************************************************************************
Tuesday 04 October 2022 18:52:32 +0100 (0:00:00.020) 0:00:00.020 *******
ok: [192.168.56.12]
ok: [192.168.56.13]
TASK [Create new user with random password] **********************************************************************************************************************************************************
Tuesday 04 October 2022 18:52:33 +0100 (0:00:00.732) 0:00:00.752 *******
changed: [192.168.56.12] => (item={'name': 'luiz.eduardo', 'comment': 'Service account', 'job': 'dev'})
skipping: [192.168.56.12] => (item={'name': 'isweluiz', 'comment': 'Service account', 'job': 'infra'})
changed: [192.168.56.13] => (item={'name': 'luiz.eduardo', 'comment': 'Service account', 'job': 'dev'})
skipping: [192.168.56.13] => (item={'name': 'isweluiz', 'comment': 'Service account', 'job': 'infra'})
TASK [Create new user with random password] **********************************************************************************************************************************************************
Tuesday 04 October 2022 18:52:33 +0100 (0:00:00.725) 0:00:01.478 *******
skipping: [192.168.56.12] => (item={'name': 'luiz.eduardo', 'comment': 'Service account', 'job': 'dev'})
skipping: [192.168.56.13] => (item={'name': 'luiz.eduardo', 'comment': 'Service account', 'job': 'dev'})
changed: [192.168.56.12] => (item={'name': 'isweluiz', 'comment': 'Service account', 'job': 'infra'})
changed: [192.168.56.13] => (item={'name': 'isweluiz', 'comment': 'Service account', 'job': 'infra'})
PLAY RECAP *******************************************************************************************************************************************************************************************
192.168.56.12 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.56.13 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Tuesday 04 October 2022 18:52:34 +0100 (0:00:00.641) 0:00:02.120 *******
===============================================================================
Gathering Facts ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 0.73s
Create new user with random password ---------------------------------------------------------------------------------------------------------------------------------------------------------- 0.73s
Create new user with random password ---------------------------------------------------------------------------------------------------------------------------------------------------------- 0.64s
[vagrant@node-centos-1 ~]$ Now let's check if the folder and password was created inside it:
[vagrant@node-centos-1 ~]$ ls -la isweluiz/ luiz.eduardo/
isweluiz/:
total 8
drwx------. 2 vagrant vagrant 26 Oct 4 18:52 .
drwx------. 14 vagrant vagrant 4096 Oct 4 18:52 ..
-rw-------. 1 vagrant vagrant 23 Oct 4 18:52 password.txt
luiz.eduardo/:
total 8
drwx------. 2 vagrant vagrant 26 Oct 4 18:52 .
drwx------. 14 vagrant vagrant 4096 Oct 4 18:52 ..
-rw-------. 1 vagrant vagrant 30 Oct 4 18:07 password.txt
[vagrant@node-centos-1 ~]$ cat isweluiz/password.txt
WZD-C.hu salt=PEbfORdBEplore more: