That role uses the RestAPI and /domain-types/user_config/collections/all" and needs the secret for the automation user, so catch-22 
I ended up doing what I wrote in my previous post, just rsync some files from Ansible files from an existing automation user in another site and that seems to work fine. Minimal effort.
I guess I could do some fancy HTTP POST to the web ui, using the cmkadmin user but seems complicated.
I hope Checkmk will add the possibility to create an API user using the cmk command or something else