Is there anyway to run multiple Ansible playbooks as multiple users more efficiently?

Question

Currently my playbook structure is like this:

~/test_ansible_roles ❯❯❯ tree .
.
├── checkout_sources
│   └── tasks
│       └── main.yml
├── install_dependencies
│   └── tasks
│       └── main.yml
├── make_dirs
│   └── tasks
│       └── main.yml
├── setup_machine.yml

One of the roles that I have is to install dependencies on my box, so for this I need sudo. Because of that all of my other tasks I need to include the stanza:

   become: yes
   become_user: my_username

Is there a better way to do this ?

you are right, it's deprecated but you can also use become_user per task. See this [stackoverflow question](http://stackoverflow.com/questions/21344777/how-to-switch-a-user-per-task-or-set-of-tasks) — Nasr, May 13 '16 at 05:30
I am already doing that. Just wanted to know if there is a better way. — Muhammad Lukman Low, May 13 '16 at 05:34
You may run install_dependencies role as another user while including it like this [stackoverflow question](http://stackoverflow.com/questions/31663592/applying-a-role-under-sudo-user) — Nasr, May 13 '16 at 05:40

udondan · Answer 1 · 2021-06-12T14:35:16.053

11

You can set the become options per:

play
role
task

Per play:

- hosts: whatever
  become: true
  become_user: my_username
  roles:
    - checkout_sources
    - install_dependencies
    - make_dirs

Per role:

- hosts: whatever
  roles:
    - checkout_sources
    - role: install_dependencies
      become: true
      become_user: my_username
    - make_dirs

Per task:

- shell: do something
  become: true
  become_user: my_username

You can combine this however you like. The play can run as user A, a role as user B and finally a task inside the role as user C.

Defining become per play or role is rarely needed. If a single task inside a role requires sudo it should only be defined for that specific task and not the role.

If multiple tasks inside a role require become, blocks come in handy to avoid recurrence:

- block:
    - shell: do something
    - shell: do something
    - shell: do something
  become: true
  become_user: my_username

edited Jun 12 '21 at 14:35

answered May 13 '16 at 10:02

udondan

57,263
20
190
175

When I run the playbook with -K, the beginning user that I am starting with is "root" is that correct ? – Muhammad Lukman Low May 13 '16 at 11:36
I don't think so. `--ask-sudo-pass` (or now `--ask-become-pass`) should only prompt for the password used for sudo/become, but not automatically force a user for the complete playbook. – udondan May 13 '16 at 11:43
I have tried this, and in my checkout_sources, it checkout out the sources as root. – Muhammad Lukman Low May 13 '16 at 23:12

Is there anyway to run multiple Ansible playbooks as multiple users more efficiently?

1 Answers1

Linked