2

Is there a way to use remote_user inside a playbook for a particular task? This is for a corporate environment, so I have very limited access (i.e. no access to /etc/sudoers) or those kind of files.

I need a solution to this:

control node is = myserver@xyz | can ssh without password(keybased) into weblogic@server1 and chandru@server1

task 1 : has to be run by weblogic

task 2 : has to be run by chandru

right now I am using two playbooks to achieve a simple task

playbook1.yml -u weblogic ( for the first task)
playbook2.yml -u chandru ( for the second task)

Once I am into the weblogic user, I can't become_user or become_sudo to chandru.

My control node can ssh without password to both the ids (chandru and weblogic) without needing a password.

2
  • 1
    If you can't become_user or become_sudo, how do you intend to escalate without a new login session?
    – Chris Down
    Feb 16, 2021 at 21:04
  • Fix the title. You don't want to "become a user for a particular task". What you describe is logging as a different remote_user for a particular task. Feb 16, 2021 at 23:24

1 Answer 1

3

Keyword remote_user can be used also in tasks. Test it e.g.

  - command: whoami
    register: result
    remote_user: weblogic
    become: false
  - debug:
      var: result.stdout

  - command: whoami
    register: result
    remote_user: chandru
    become: false
  - debug:
      var: result.stdout

There are three entities involved in the process

  1. A user who is running the playbook (No1)
  2. A user who is logging into the remote host (No2)
  3. A user who No2 can become (No3)
  • The variable remote_user defines No2. If remote_user is not defined No2 is No1
  • Setting "become: true" says No2 shall escalate to become_user No3 (default: root). If "become: false" Ansible is running as No2 at the remote host.

As a result, what you want is to log as a different remote_user (No2) to the remote host and not become (escalate) to a different become_user (No3). This also explains "become: false" in the tasks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .