Introduction
User and scheduled task automation is common in operational playbooks. Ansible can create accounts, manage file ownership, and install cron entries safely.
In this lab, you will create a temporary service user, manage a report directory and file, and install a cron job for that user.
Create a User Automation Project
In this step, you will create a project for managing a disposable service user named rhce_ops.
cd /home/labex/project
mkdir -p rhce-ansible/{inventory,playbooks,reports}
cd rhce-ansible
cat > ansible.cfg <<'EOF'
[defaults]
inventory = ./inventory/hosts
host_key_checking = False
retry_files_enabled = False
EOF
cat > inventory/hosts <<'EOF'
[managed]
host ansible_connection=local
EOF
The setup removed any previous rhce_ops account, so the first playbook run will show the full creation path. The account is disposable and separate from the LabEx labex user.
Define Account and Schedule Variables
In this step, you will define variables for the service account, report directory, and cron schedule. Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
mkdir -p inventory/group_vars
cat > inventory/group_vars/managed.yml <<'EOF'
ops_user: rhce_ops
ops_comment: RHCE automation operator
ops_report_dir: /home/rhce_ops/reports
cron_minute: '*/15'
EOF
These variables describe the account and schedule policy. Quoting */15 is intentional because YAML can treat * specially; the quotes keep it as a cron string.
cat inventory/group_vars/managed.yml
Write the User and File Playbook
In this step, you will write a playbook that creates the user, creates an owned directory, writes a managed file, and installs a cron entry. Before running commands in this step, return to the Ansible project directory. This keeps the commands stable even when LabEx runs each step separately.
cd /home/labex/project/rhce-ansible
cat > playbooks/users-files-cron.yml <<'EOF'
---
- name: Manage user files and scheduled task
hosts: managed
become: true
gather_facts: false
tasks:
- name: Ensure operations user exists
ansible.builtin.user:
name: "{{ ops_user }}"
comment: "{{ ops_comment }}"
shell: /bin/bash
state: present
- name: Ensure report directory exists
ansible.builtin.file:
path: "{{ ops_report_dir }}"
state: directory
owner: "{{ ops_user }}"
group: "{{ ops_user }}"
mode: '0750'
- name: Install managed report file
ansible.builtin.copy:
dest: "{{ ops_report_dir }}/status.txt"
content: |
managed_by=ansible
owner: "{{ ops_user }}"
group: "{{ ops_user }}"
mode: '0640'
- name: Install heartbeat cron job
ansible.builtin.cron:
name: RHCE heartbeat
user: "{{ ops_user }}"
minute: "{{ cron_minute }}"
job: "/usr/bin/date >> {{ ops_report_dir }}/heartbeat.log"
EOF
The tasks build on each other: the user must exist before ownership can be assigned, the report directory must exist before the status file is written, and the cron job runs as that same user.
ansible-playbook playbooks/users-files-cron.yml --syntax-check
Run the User Automation Playbook
In this step, you will run the playbook and inspect the account, file ownership, and cron entry.
cd /home/labex/project/rhce-ansible
ansible-playbook playbooks/users-files-cron.yml | tee reports/users-files-cron-run.txt
The first run should create the user, directory, status file, and cron entry. Saving the output helps you distinguish account changes from file and cron changes.
id rhce_ops
id confirms the account exists and has numeric user and group IDs.
sudo ls -ld /home/rhce_ops/reports && sudo ls -l /home/rhce_ops/reports/status.txt
The directory and file should be owned by rhce_ops. The status file should use mode 0640, which gives the owner read/write and the group read access.
sudo crontab -u rhce_ops -l
The crontab should include the named heartbeat entry and the command that appends dates to heartbeat.log.
Confirm the Playbook Converges
In this step, you will rerun the playbook. The account, files, and cron entry already match the desired state, so no change should be needed.
cd /home/labex/project/rhce-ansible
ansible-playbook playbooks/users-files-cron.yml | tee reports/users-files-cron-second.txt
The second run should report changed=0 because the account, file state, and crontab already match the variables and tasks.
grep -E 'host.*changed=0' reports/users-files-cron-second.txt
Summary
You automated a disposable user, owned files, permissions, and a cron job, then confirmed the playbook is idempotent.
