feat(podman_host): do not create local users and assume a user exists

For SR2's usage, these users will exist because they have been created
in FreeIPA along with their subids.
This commit is contained in:
Iain Learmonth 2025-11-08 20:57:43 +00:00
parent b471a034a4
commit 7792cac0c7
2 changed files with 31 additions and 52 deletions

View file

@ -1,13 +1,22 @@
---
- name: Podman Host | PRELIM | Ensure the rootless users are defined and are not root
- name: Podman Host | AUDIT | Ensure the rootless users are defined and are not root
ansible.builtin.assert:
that:
- podman_host_rootless_users | length > 0
- '"root" not in podman_host_rootless_users'
- name: Podman Host | AUDIT | Ensure that subuid and subgid are defined for the users
- name: Podman Host | PATCH | Install Podman
ansible.builtin.dnf:
name:
- podman
- container-selinux
- shadow-utils-subid # for getsubids
state: latest
become: true
- name: Podman Host | AUDIT | Ensure that users exist and have subids configured
ansible.builtin.include_tasks:
file: check_subid.yml
file: check_users.yml
vars:
_podman_host_rootless_user: "{{ item }}"
with_items: "{{ podman_host_rootless_users }}"
@ -21,17 +30,10 @@
reload: true
become: true
- name: Podman Host | PATCH | Create users for rootless podman
ansible.builtin.user:
name: "{{ item }}"
become: true
with_items: "{{ podman_host_rootless_users }}"
- name: Podman Host | PATCH | Set XDG_RUNTIME_DIR in .profile for rootless users
- name: Podman Host | PATCH | Set XDG_RUNTIME_DIR in .bash_profile for rootless users
ansible.builtin.lineinfile:
path: "/home/{{ item }}/.bash_profile"
line: "export XDG_RUNTIME_DIR=/run/user/$(id -u)"
create: false
become: true
become_user: "{{ item }}"
with_items: "{{ podman_host_rootless_users }}"
@ -46,14 +48,6 @@
become: true
with_items: "{{ podman_host_rootless_users }}"
- name: Podman Host | PATCH | Install Podman
ansible.builtin.dnf:
name:
- podman
- container-selinux
state: latest
become: true
- name: Podman Host | PATCH | Create users quadlets directory
ansible.builtin.file:
path: "/home/{{ item }}/.config/containers/systemd"