Bootstrap FreeKB - Ansible - become directives in ansible.cfg
Ansible - become directives in ansible.cfg

Updated:   |  Ansible articles

If you are not familiar with "become", check out Ansible - Understanding Become Privilege Escalation.

Let's say John Doe has been granted access to issue the reboot command using sudo. Let's say john.doe attempts to reboot server1 using the shell module and sudo.

---
- hosts: all
  tasks:
  - shell: sudo reboot
...

 

Assuming the following option is commented out in ansible.cfg or set to true . . .

# command_warnings = False

 

. . . and you are not using the warn parameter, like this . . .

---
- hosts: all
  tasks:
  - shell: sudo reboot
    args:
      warn: false
...

 

Invoking the play should return the following warning. 

[WARNING]: Consider using 'become', 'become_method', and 'become_user' rather than running sudo

 

As the warning suggests, "become" should be used. There are different ways to use "become":

 

Here is how to use the become parameters in ansible.cfg. 

However, you may want to avoid this approach, as this would enable become for any playbook, which may be too permissive. 

Likewise, there will probably be cases where you want to use become a user other than John Doe, thus is usually is preferred to use the become command line flags or become parameters.

become_user: john.doe
become_method: sudo
become_pass: your_password

 

Notice in this example that "sudo" is still used. This is because this example is using the shell module.

---
- hosts: all
  tasks:
  - shell: sudo reboot
...

 

When using some other module, such as the file module, there is no need (or way) to use sudo without become.

---
- hosts: all
  tasks:
  - file:
      path: /tmp/example
      state: directory
...

 




Did you find this article helpful?

If so, consider buying me a coffee over at Buy Me A Coffee



Comments


Add a Comment


Please enter d3648c in the box below so that we can be sure you are a human.