Strictly specify become to only neccesary Ansible task

Registered by Duong Ha-Quang

Add "become" (Ansbile way to privilege escalation) to only necessary Ansible tasks. So, users do not need to escalate whole host in Ansible inventory or CLI due to there are some but not every tasks in a playbook need root privilege.

Blueprint information

Steven Dake
Duong Ha-Quang
Duong Ha-Quang
Series goal:
Accepted for ocata
Milestone target:
milestone icon queens-2
Started by
Duong Ha-Quang
Completed by
Jeffrey Zhang

Related branches



Hi Duong, I just did some test runs of this and see one or two issues:

* Task '[cinder : Copying over cinder-wsgi.conf]' fails (
* Task '[nova : Running Nova bootstrap container]' fails (
* I also see reference in the docs to config_owner_user and config_owner_group in globals.yml, but cant see these in globals.yml itself?

FYI, the way I set up my user was the following:

ansible -i ~/multinode -a 'useradd testuser' all
ansible -i ~/multinode -a 'usermod -a -G wheel testuser' all
ansible -i ~/multinode -a 'usermod -a -G docker testuser' all
< setup ssh keys >

These are the main things I tripped over, unsure if there's other lurking. To really round out this task do you think we could update the gates to run as non root? That way we can be sure we're testing it and using best practice.

- pbourke


Related document:

Gerrit topic:,topic:bp/ansible-specific-task-become,n,z

Addressed by:
    [wip] Add Ansible become to quick start guide

Addressed by:
    Check if ansible_user is in docker group

Addressed by:
    Specify 'become' to neccesary tasks (general roles)

Addressed by:
    Specify 'become' for only neccesary tasks (default roles)

Addressed by:
    Specify 'become' for only neccesary tasks (all other roles)

Addressed by:
    Use root as the default node config user

Addressed by:
    Add become for fluentd create config directory task

Addressed by:
    Specify 'become' for only necessary tasks (Queens roles)

Addressed by:
    Add documentation for Ansible become feature

Addressed by:
    Specify 'become' for all tasks that use kolla_docker module


Work Items

Work items:
[duonghq] Update document: DONE
[duonghq] Make sure ansible_ssh_user in docker group (only check): DONE
[duonghq] General roles (common, prechecks): DONE
[duonghq] General modules (memcached, iscsi, mariadb, mongodb): DONE
[duonghq] Core modules: (nova, neutron, keystone): DONE
[duonghq] Other modules: DONE
[duonghq] Change owner of configuration file to kolla/kolla or user specify: DONE

This blueprint contains Public information 
Everyone can see this information.