42.5. Ensuring the absence of an IdM host entry using Ansible playbooks

Procedure

1. Create an Ansible playbook file with the fully-qualified domain name (FQDN) of the host whose absence from IdM you want to ensure. If your IdM domain has integrated DNS, use the updatedns: true option to remove the associated records of any kind for the host from the DNS.

   To simplify this step, you can copy and modify the example in the /usr/share/ansible/collections/ansible_collections/freeipa/ansible_freeipa/playbooks/host/delete-host.yml file:

   ---
   - name: Host absent
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Host host01.idm.example.com absent
       freeipa.ansible_freeipa.ipahost:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: host01.idm.example.com
         updatedns: true
         state: absent

2. Run the playbook:

   $ ansible-playbook --vault-password-file=password_file -v -i path_to_inventory_directory/inventory.file path_to_playbooks_directory/ensure-host-absent.yml

   注記

   The procedure results in:

   • The host not being present in the IdM Kerberos realm.
   • The host entry not being present in the IdM LDAP server.

   To remove the specific IdM configuration of system services, such as System Security Services Daemon (SSSD), from the client host itself, you must run the ipa-client-install --uninstall command on the client. For details, see Uninstalling an IdM client.

Verification

1. Log into ipaserver as admin:

   $ ssh admin@server.idm.example.com
   Password:
   [admin@server /]$

2. Display information about host01.idm.example.com:

   $ ipa host-show host01.idm.example.com
   ipa: ERROR: host01.idm.example.com: host not found