From 961e10223c4ebed6c7dbfa8aa40e9e4c3abc53c1 Mon Sep 17 00:00:00 2001 From: Marty Oehme Date: Fri, 28 Nov 2025 18:01:17 +0100 Subject: [PATCH] ref(system): Fix ssh authorized keys task Fixed the loop for authorized keys. While I read previously that the Ansible module can take keys in the array format: ```yaml key: - key1 - key2 - ... ``` This seems to not be the case. Instead, we now do a 'sub-loop' through all the existing authorized_keys entries in the data structure, running the task once for each key. This also means we can simplify the 'when' condition to only check the data structure itself exists, not the key since we only loop once for each existing key anyway. More in-depth explanation on the subelements filter here: https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_filters.html#combining-objects-and-subelements Concise explanation of use here: https://overflow.ducks.party/questions/56086290/how-can-i-traverse-nested-lists-in-ansible One drawback: we can now _not_ change the key setting in the module to be exclusive (`exclusive: true` for `authorized_keys` module). As described in the documentation, if there are more than one key for a user, this would lead to the following keys overwriting the first key. Currently do not know how to fix this, but we are not supplying exclusive keys so it is fine for the moment. --- roles/system/tasks/main.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/roles/system/tasks/main.yaml b/roles/system/tasks/main.yaml index a5f051d..fd14baf 100644 --- a/roles/system/tasks/main.yaml +++ b/roles/system/tasks/main.yaml @@ -70,11 +70,11 @@ - name: Add authorized SSH keys ansible.posix.authorized_key: - user: "{{ item.name }}" + user: "{{ item.0.name }}" state: present - key: "{{ item.authorized_keys }}" - loop: "{{ system_users }}" - when: system_users is defined and item.authorized_keys is defined + key: "{{ item.1 }}" + loop: "{{ system_users | subelements('authorized_keys', skip_missing=True) }}" + when: system_users is defined tags: - ssh become: true