Force limit parameter to be set in ansible

Question

Is there a way to force commands ansible-playbook, ansible-variable, etc... to be executed with a --limit option (otherwise to deny it) ?

I discovered that, on a cluster it can easily run a playbook to all nodes if you mistakenly run it without limit, I'd like to prevent it from ansible users.

Answer 1

Use the ansible_limit variable (added in ansible 2.5). You can test like this:

tasks:
  - fail:
      msg: "you must use -l or --limit"
    when: ansible_limit is not defined
    run_once: true

Answer 2

It's the opposite of the task I've solved recently. My goal was to detect there is a --limit and to skip some plays.

https://medium.com/opsops/how-to-detect-if-ansible-is-run-with-limit-5ddb8d3bd145

In your case you can check this in the play and fail if it "full run":

- hosts: all
  gather_facts: no
  tasks:
    - set_fact:
         full_run: '{{play_hosts == groups.all}}'
    - fail:
        msg: 'Use --limit, Luke!'
      when: full_run

You can use a different group instead of all, of course (change it in both hosts and set_fact lines).