如何在任务级别使用 begin_user 覆盖主机文件中设置的 ansible_become_user ？

Question

我ansible_become在主机文件中进行了设置，因为在设置新机器时我以 root 身份执行大部分操作。

all:
  hosts:
    ganymede:
      ansible_host: ganymede.xcv.org

  vars:
    ansible_user: ubuntu
    ansible_become: yes
    ansible_become_user: root

我需要将 git 存储库克隆为服务帐户，但我不知道如何实现这一点

- name: Git
  vars:
    ansible_become: no
  block:
    - name: whoami
      command: whoami
      register: a
    - debug:
      msg: {{ a.stdout }}
    - git:
        repo: "git@github.com:fakerepo/ganymede.git"
        dest: "/opt/"
        force: yes
        key_file: ~ganymede/.ssh/id_ed25519
  become: yes
  become_user: ganymede

取消设置ansible_become似乎有效，因为用户是ubuntu.

设置become和become_user没有任何效果，我想知道如何才能使 git 正常工作。

TASK [debug] ***********************************************
ok: [ganymede] => {
    "msg": "ubuntu"
}

TASK [git] *************************************************
fatal: [ganymede]: FAILED! => {
    "changed": false, 
    "cmd": "/usr/bin/git ls-remote git@github.com:fakerepo/ganymede.git -h refs/heads/HEAD", 
    "msg": 
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied."
        "Host key verification failed."
        "fatal: Could not read from remote repository."
        "Please make sure you have the correct access rights and the repository exists.",
    "rc": 128, 
    "stderr": 
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied."
        "Host key verification failed."
        "fatal: Could not read from remote repository."
        "Please make sure you have the correct access rights and the repository exists.", 
    "stderr_lines": [
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied.", 
        "Host key verification failed.", 
        "fatal: Could not read from remote repository.", 
        "", 
        "Please make sure you have the correct access rights and the repository exists."
    ], 
    "stdout": "", 
    "stdout_lines": []
}

Answer 1

来自Ansible 开发团队成员之一sivel ：

此行为记录在优先规则下： https://docs.ansible.com/ansible/latest/reference_appendices/general_precedence.html#precedence-categories

任务/播放关键字对变量的优先级较低，因为它们对主机的特定性较低。

因此，库存变量的优先级高于您指定的任务become_user。正如您所发现的，您的配置的解决方法是ansible_become_user通过vars:单个任务来覆盖。

另请参阅： https://docs.ansible.com/ansible/latest/user_guide/playbooks_variables.html#understanding-variable-precedence

^{来源：Ansible 问题 74929}

因此，从该问题引用的文档页面来看：

Ansible 提供了四种控制其行为的来源。按照优先级从最低（最容易被覆盖）到最高（覆盖所有其他）的顺序，类别是：

• 配置设置
• 命令行选项
• 剧本关键词
• 变量

每个类别都会覆盖所有优先级较低的类别中的任何信息。例如，剧本关键字将覆盖任何配置设置。

^{来源：控制 Ansible 的行为方式：优先规则}

因此，您的修复方法是，如上所述，覆盖该任务的vars:部分中的ansible_become_user：

- git:
    repo: "git@github.com:fakerepo/ganymede.git"
    dest: "/opt/"
    force: yes
    key_file: ~ganymede/.ssh/id_ed25519
  vars:
    ansible_become_user: ganymede

为了解决您的进一步acl问题，您必须acl在托管节点上安装正确的 Python 包，这可以通过此任务来实现（运行方式root）：

- pip:
    name: acl