58

In my system provisioning with Ansible, I don't want to specify become=yes in every task, so I created the following ansible.cfg in the project main directory, and Ansible automatically runs everything as root:

[privilege_escalation]
become = True

But as the project kept growing, some new roles should not be run as root. I would like to know if it is possible to have some instruction inside the role that all tasks whithin that role should be run as root (eg. something in vars/), instead of the global ansible.cfg solution above!

1

6 Answers 6

93

I have found a solution, although I think a better solution should be implemented by the Ansible team. Rename main.yml to tasks.yml, and then write the following to main.yml:

---
- { include: tasks.yml, become: yes }

Another solution is to pass the parameter directly in site.yml, but the main idea of the question was reusing the role in other projects without forgetting it needs root:

---
- hosts: localhost
  roles:
    - { role: name, become: yes }
4
  • This actually looks like an excellent way to go, which doesn't bring in the same gotcha that my solution does of risking the ansible_become var propagating too far down. However, includes have performance implications. I'm not sure to what degree it's been resolved, but as of the end of last year, using includes took significantly longer than not because of the way Ansible evaluates them.
    – MillerGeek
    Commented Aug 30, 2016 at 14:35
  • 1
    @smiller171 I have not noticed any performance difference between any of the solutions (ansible.cfg, include:, roles:, and defaults/main.yml). But most of my roles are small, although I have a reasonable amount of roles. Commented Aug 31, 2016 at 18:55
  • Giving the become option in the specific role is IMHO the best solution. Thank you.
    – YSC
    Commented Apr 28, 2021 at 13:58
  • This method is the only method I've had success with when using NewRelic's role via include_role within my own roles directory - become in other contexts doesn't appear to have any effect
    – Larry
    Commented Aug 26, 2022 at 22:23
59

You can also wrap your tasks in a block and put become: yes on the block. So, inside your roles/role_name/tasks/main.yml, you'd do this:

- block:

  - name: Tasks go here as normal
    ...

  become: yes

This will run all the tasks inside the block as root. More details of Ansible's blocks here (latest docs).

4
  • I think this is the best answer - the linked documentation even uses this exact use case as its first example! Commented Aug 3, 2017 at 13:12
  • 3
    Why does "become" have to come at the end of the block? I would expect to be able to put it at the beginning before the "- name" but then I get YAML syntax error. Commented Aug 7, 2017 at 18:45
  • 1
    I think if you do that, it probably assumes that the block has ended, then you follow it with an badly indented task - which is a yaml syntax error. Commented Aug 27, 2017 at 21:34
  • 4
    While I like this approach better than mine, I have found the hard way that blocks have some limitations: you can't use blocks inside blocks and you can't loop blocks, both of which can be done with includes. Commented Jun 8, 2018 at 11:53
17

Not really a fundamentally different answer, rather a cosmetic reformatting of what's already been said. Looks the shortest, cleanest and YAML-ishest to me:

- name: My play
  hosts: myhosts
  roles:
    - role: role1
      become: yes

    - role: role2

Role1 will be run as root while role2 won't.

0
4

In Ansible documentation for 2.4, you can find a way to define connection variables, such as ansible_become and ansible_user. They are defined as usual variables. Below is a snippet.

The first role prepare_user connects to hosts using user root without elevation rights. The second role register connects to hosts using the remote_user set via ansible.cfg (looked for in a defined order; search for "in the following order").

---
- hosts: all
  name: Prepare VMs for cluster
  roles:
    - role: prepare_user
      vars:
        - ansible_become: false
        - ansible_user: root

    - role: register
...
1
  • 1
    To answer the question, please include an example of how this may be set inside the role (not in a global site.yml), so the become instruction can be, for example, included in an Ansible Galaxy role. smiller171's answer says that if you try to set ansible_become from within a role, it will be inherited by all other roles. Commented Sep 20, 2018 at 16:14
3

There is a way to do what you are asking, but you need to be careful with how you use it, because Ansible evaluates most vars before running any tasks. If you use this trick, you must be sure to use it consistently or you could unintentionally use become where you don't want to.

Under the hood, Ansible uses the variable ansible_become to determine whether to use become for that task. Within your role, you can create a defaults/main.yml and set ansible_become: [true/false] This will cause that entire role to accept that value, unless overwritten by a higher-precedence definition (important to understand variable precedence)

The critical "gotcha" here is that if you use a role where this is defined, it will affect all other roles called below it in the play, unless they also have it defined.

Examples:

role_default_become_true has ansible_become: true defined as true in defaults role_default_become_false has ansible_become: false defined as true in defaults role_no_default has no default ansible_become value

---
- name: test1
  hosts: localhost
  connection: local
  roles:
  - role_default_become_true
  - role_default_become_false
  - role_no_default

- name: test2
  hosts: localhost
  connection: local
  roles:
  - role_default_become_false
  - role_default_become_true
  - role_no_default

- name: test3
  hosts: localhost
  connection: local
  roles:
  - role_default_become_false
  - role_default_become_true
  - { role: role_no_default, become: false }

In test1, role_no_default will run without become, because the previous role defined it as false, and it does not have its own definition.

In test2, role_no_default will run with become, because the previous role defined it as true, and it does not have its own definition.

In test3, role_no_default will run without become, because it has its own definition.

2
  • From what I could understand from your answer, the variable propagation is not considered a bug because ansible_become is an internal variable that the user is not expected to change, right? If that is the case, although it answers exactly what I wanted, and I think I could put a workaround at the end of the role to reset the variable, I would rather avoid it not to break any roles in the future! Commented Aug 31, 2016 at 19:06
  • 1
    correct, it uses a variable that is not intended to be used in this way (though it is documented for use in inventory if you need host-specific settings) I think your answer is superior, and should be marked as the accepted answer.
    – MillerGeek
    Commented Aug 31, 2016 at 19:15
2

This is also possible using the include_task module

Create a main.yaml which includes the yaml with the tasks

---
- name: main
  include_tasks:
    file: "my_tasks_that_needs_become_true.yaml"
    apply:
      become: true

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.