Don't set password for root. Just lock account.

playbooks/include/vm-create.yml

@@ -40,16 +40,10 @@
       delegate_to: localhost
       when: inventory_hostname not in result.list_vms
 
-    - name: generate root password
-      command: "/srv/ansible/scripts/genpasswd {{ inventory_hostname }}"
-      register: root_password
-      delegate_to: localhost
-      when: inventory_hostname not in result.list_vms
-
     - name: create inject file
       copy:
         content: |
-          rootpw --iscrypted {{ root_password.stdout }}
+          rootpw --lock
           %post
           umask 077
           mkdir -p /root/.ssh