# looping within loops

**URL:** <https://forum.ansible.com/t/looping-within-loops/22242>\
**Category:** Ansible Project\
**Created:** [August 9, 2016, 11:56am UTC](https://forum.ansible.com/t/looping-within-loops/22242 "2016-08-09T11:56:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\
**Post date:** [August 9, 2016, 11:56am UTC](https://forum.ansible.com/t/looping-within-loops/22242/1 "2016-08-09T11:56:41Z")

</div>

I've got a bunch of user groups to create, each users information is a dict.  
Since each group maps to a team, I want to control access on a per-team  
level.

so the natural 'shape' for this data is eg.

users:  
&nbsp;&nbsp;dbas:  
&nbsp;&nbsp;&nbsp;&nbsp;- user: bobby\_tables  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Bob Tables  
&nbsp;&nbsp;&nbsp;&nbsp;- user: joinmaster  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Dave The Joiner  
&nbsp;&nbsp;devs:  
&nbsp;&nbsp;&nbsp;&nbsp;- user: googler  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Fred Google  
&nbsp;&nbsp;&nbsp;&nbsp;- user: overflower  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Stack OverFlow Searcher

and so on (this list is about 80+ users at least)

Ideally I want a list of groups as a var (either set per group or per inventory)  
that a role can use to create accounts, setup pubkeys and sudoers, etc.

let's say a var like

&nbsp;&nbsp;&nbsp;&nbsp;ssh\_groups:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- users.dbas  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- users.devs

In which case I want to be able to loop over the ssh\_groups list with  
with\_items,  
and then loop \_again\_ with the sublist with with\_dict to create the users.

Is there a construct in Ansible to do this? I can't find one.

I can only do what I want with this sort of structure:

users:  
&nbsp;&nbsp;&nbsp;&nbsp;- user: bobby\_tables  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Bob Tables  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;group: dbas  
&nbsp;&nbsp;&nbsp;&nbsp;- user: joinmaster  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Dave The Joiner  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;group: dbas  
&nbsp;&nbsp;&nbsp;&nbsp;- user: googler  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Fred Google  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;group: devs  
&nbsp;&nbsp;&nbsp;&nbsp;- user: overflower  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gecos: Stack OverFlow Searcher  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;group: devs

and have every task in the role check each user with a clause like

&nbsp;&nbsp;&nbsp;when: item.group in ssh\_groups

I mean it works, but there's a good chance we'll see typos etc.

Is there any way to do what I want with the original users: layout?

---

<div class="post-metadata">

**Author:** ![Dick\_Davies](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Dick\_Davies](https://forum.ansible.com/u/Dick_Davies)\
**Post date:** [August 12, 2016, 9:08am UTC](https://forum.ansible.com/t/looping-within-loops/22242/2 "2016-08-12T09:08:30Z")

</div>

For the record, I figured this out using an include loop and  
loop\_control / loop\_var - see:

&nbsp;&nbsp;&nbsp;&nbsp;[http://docs.ansible.com/ansible/playbooks\_loops.html#loops-and-includes-in-2-0](http://docs.ansible.com/ansible/playbooks_loops.html#loops-and-includes-in-2-0)

Takes a bit to get your head around how it works (which is a red flag  
for me usually in Ansible) but  
it lets the data structure (which we'll be editing far more often than  
the role) have a more easily  
maintainable 'shape'.

If anyone else would find it useful, i've put it here

&nbsp;&nbsp;&nbsp;&nbsp;[https://github.com/rasputnik/ansible-loops/tree/master/loop\_within\_loop](https://github.com/rasputnik/ansible-loops/tree/master/loop_within_loop)