# Hostvar not working as expected

**URL:** <https://forum.ansible.com/t/hostvar-not-working-as-expected/2765>\
**Category:** Get Help\
**Created:** [December 5, 2023, 8:47pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765 "2023-12-05T20:47:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bpadair](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bpadair/32/317_2.png) [@bpadair](https://forum.ansible.com/u/bpadair)\
**Post date:** [December 5, 2023, 8:47pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/1 "2023-12-05T20:47:47Z")

</div>

I know that I am just missing something, but I think that I have been staring at this too long to figure out what I am missing. I have the following in my host vars file:

```auto
certs: [
   myfishbowl.com: {
    csr_path: "/etc/pki/myfishbowl.com/csr.pem",
    common_name: "myfishbowl.com",
    san: ["*.myfishbowl.com"],
    cert_path: "/etc/pki/myfishbowl.com/cert.pem",
    fullchain_dest: "/etc/pki/myfishbowl.com/fullchain.pem",
    chain_dest: "/etc/pki/myfishbowl.com/chain.pem"
  }
]

```

and then I am trying to reference it in a task like:

```auto
- name: Generate CSR
  community.crypto.openssl_csr:
    path: "{{ item['csr_path'] }}"
    private_key_path: "{{ hostvars[inventory_hostname].private_key_path }}"
    common_name: "{{ item.common_name }}"
    owner: root
    group: root
    mode: 0640
    subject_alt_name: "{{ item.san |default(omit) }}"
  loop: "{{ hostvars[inventory_hostname]['certs'] }}" 

```

and I am getting an error that things such as csr\_path are undefined.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [December 5, 2023, 9:05pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/2 "2023-12-05T21:05:48Z")

</div>

What you missing is the `myfishbowl.com` level.

```yaml
- name: Generate CSR
  community.crypto.openssl_csr:
    path: "{{ item['myfishbowl.com']['csr_path'] }}" # or "{{ item['myfishbowl.com'].csr_path }}" 
    private_key_path: "{{ hostvars[inventory_hostname].private_key_path }}"
    common_name: "{{ item['myfishbowl.com'].common_name }}"
    owner: root
    group: root
    mode: 0640
    subject_alt_name: "{{ item['myfishbowl.com'].san |default(omit) }}"
  loop: "{{ hostvars[inventory_hostname]['certs'] }}" 

```

---

<div class="post-metadata">

**Author:** ![bpadair](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bpadair/32/317_2.png) [@bpadair](https://forum.ansible.com/u/bpadair)\
**Post date:** [December 5, 2023, 9:18pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/3 "2023-12-05T21:18:27Z")

</div>

Ok, so how can I loop that, since each machine could have more than one cert? I thought that using certs as the subscript for the hostvars would make the [myfishbowl.com](http://myfishbowl.com) the “item”.

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [December 5, 2023, 9:35pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/4 "2023-12-05T21:35:27Z")

</div>

You’ve got a weird mix of yaml and json going on there. I started to mention that at first but didn’t want to confuse the issue. Your `certs` is exactly the same as

```yaml
    certs:
      - myfishbowl.com:
          csr_path: "/etc/pki/myfishbowl.com/csr.pem"
          common_name: "myfishbowl.com"
          san:
            - "*.myfishbowl.com"
          cert_path: "/etc/pki/myfishbowl.com/cert.pem"
          fullchain_dest: "/etc/pki/myfishbowl.com/fullchain.pem"
          chain_dest: "/etc/pki/myfishbowl.com/chain.pem"

```

which I find easier to read, but you do you.  
So `"{{ certs[0].keys() }}"` will give the single-element list: `['myfishbowl.com']`. Maybe that’s what you want, but since you’ve got the same value in `common_name` maybe not? Maybe you want this:

```yaml
    certs:
      - csr_path: "/etc/pki/myfishbowl.com/csr.pem"
        common_name: "myfishbowl.com"
        san:
          - "*.myfishbowl.com"
        cert_path: "/etc/pki/myfishbowl.com/cert.pem"
        fullchain_dest: "/etc/pki/myfishbowl.com/fullchain.pem"
        chain_dest: "/etc/pki/myfishbowl.com/chain.pem"
      - csr_path: "/etc/pki/yourfishbowl.com/csr.pem"
        common_name: "yourfishbowl.com"
        san:
          - "*.yourfishbowl.com"
        cert_path: "/etc/pki/yourfishbowl.com/cert.pem"
        fullchain_dest: "/etc/pki/yourfishbowl.com/fullchain.pem"
        chain_dest: "/etc/pki/yourfishbowl.com/chain.pem"
      - [… another cert …]
      - [… and yet another cert …]

```

---

<div class="post-metadata">

**Author:** ![bpadair](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bpadair/32/317_2.png) [@bpadair](https://forum.ansible.com/u/bpadair)\
**Post date:** [December 5, 2023, 9:38pm UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/5 "2023-12-05T21:38:20Z")

</div>

That is what I want. Thank you! I knew that I stared at this too long and overthought the whole thing.

---

<div class="post-metadata">

**Author:** ![flowerysong](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/flowerysong/32/2305_2.png) [@flowerysong](https://forum.ansible.com/u/flowerysong)\
**Post date:** [December 6, 2023, 1:09am UTC](https://forum.ansible.com/t/hostvar-not-working-as-expected/2765/6 "2023-12-06T01:09:16Z")

</div>

`hostvars[inventory_hostname]` is an anti-pattern; variables from the inventory host should be accessed directly, since that’s the default source of variables.

```yaml
  loop: "{{ certs }}"

```