Applying a role under sudo user

Question

Is it possible to apply a specific role as sudo in Ansible?

Specifically, these are roles fetched from ansible-galaxy, so the source is not within my control.

This example suggests that passing sudo:yes to the role should work, but I presume the role must first be defined to expect the param.

This section of the changelog suggests that sudo true can be set at the role level, however, the following is not working:

---
- remote_user: "vagrant"
  tasks: []
  hosts: "all"
  roles:
  - role: "mysql"
    sudo: yes

However, applying sudo at the top level makes the role work:

---
- remote_user: "vagrant"
  tasks: []
  hosts: "all"
  sudo: yes
  roles:
  - role: "mysql"

Note -- I've tried with both sudo: true and sudo: yes, and the outcome is the same.

Answer 1

Yes, you can perform a role as another user, including root, but only at the "playbook" level.

If you want to run one role as yourself, and another role as, say, "root", then you'll have to write those up as separate plays (whether or not they are in separate files).

For example, assuming that you have this playbook, containing two plays, using the same role, but with different sudo users:

---
- hosts: localhost
  sudo: yes
  roles:
  - role: aks.whoami

- hosts: localhost
  sudo: no
  roles:
  - role: aks.whoami

And, this role: aks.whoami:

---
- name: "whoami?"
  shell: whoami
  register: whoami

- debug: var=whoami.stdout

This is the output:

PLAY [localhost] **************************************************************

GATHERING FACTS ***************************************************************
ok: [localhost]

TASK: [aks.whoami | whoami?] **************************************************
changed: [localhost]

TASK: [aks.whoami | debug var=whoami.stdout] **********************************
ok: [localhost] => {
    "var": {
        "whoami.stdout": "root"
    }
}

PLAY [localhost] **************************************************************

GATHERING FACTS ***************************************************************
ok: [localhost]

TASK: [aks.whoami | whoami?] **************************************************
changed: [localhost]

TASK: [aks.whoami | debug var=whoami.stdout] **********************************
ok: [localhost] => {
    "var": {
        "whoami.stdout": "aks"
    }
}

PLAY RECAP ********************************************************************
localhost                  : ok=6    changed=2    unreachable=0    failed=0

Answer 2

This works for me, but not the sudo: yes.

roles:
  - { role: packages, become: yes}
  - { role: geerlingguy.docker, become: yes }