Ansible local_action privilege de-escalation or: how to wait for a reboot

I increasingly use Ansible not only for glorious tasks like setting up my various VMs I use for prototyping but also for mundane things like resetting my personal laptop every time I get a new one or break it (dedicated readers of this blog will know me to do that a lot [2],[3],[4]).

Most of these tasks require root privileges since they install software and change system settings and since I find Ansible to be rather verbose, I try to avoid repeating privilege escalation via the become [5] module for every task and declare instead the entire play book to run as root.

Occasionally a play book needs to wait for a VM to reboot before it can carry on. There are plenty of examples [6] around how to do that, but surprisingly they fail at a crucial point when the play book runs with a root user: the local_action will fail claiming that it couldn’t provide a password for sudo. There is a bug report [7] with some controversy around if that is a valid behaviour or not; at the time of this writing a solution hasn’t made it into the Ansible 2.0.2.0 package which is the official release in the Ubuntu 14.04 repositories.

Somewhat surprisingly it is possible to de-escalate global sudo privileges which were obtained with become by specifying sudo: no at the task level. Ansible will warn about the deprecation of sudo, but hey, it works 🙂

...

  become: yes
  become_user: root
  become_method: sudo

...

    - name: waiting for VM to come back online
      sudo: no
      local_action:
        module: wait_for
          host={{ ansible_host }}
          port=22
          delay=2
          state=started