# applying sudo\_user to a list of tasks **URL:** \ **Category:** Ansible Project\ **Created:** [June 28, 2013, 3:35pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036 "2013-06-28T15:35:21Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [June 28, 2013, 3:35pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/1 "2013-06-28T15:35:21Z")
Hello, My playbook is run with sudo: yes Inside this playbook, I would like to run a task list several times. Each time it would be for a different user. for simplification, the task list could be: tasks: - ping: - ping: - ping I managed to write the task list as tasks: - ping: sudo\_user: {{ u }} - ping: sudo\_user: {{ u }} - ping sudo\_user: {{ u }} and reuse this task list. But this does not seem right. I wish I could parametrize the sudo\_user outside of the task list. the “include” directive does not seem to accept a sudo\_user parameter. of course, the sudo\_user can be set at the play level - hosts: all sudo: yes sudo\_user: john roles: - developer but is there any way i can “loop” over a play ; something in the order of : - hosts: all sudo: yes sudo\_user: {{ item }} roles: - developer with\_items: - john - dave thank you very much for your insight ! Jerome ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [June 28, 2013, 3:39pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/2 "2013-06-28T15:39:19Z")
No, you can’t do this. You should do any looping inside of the task files. Also, stuff like sudo\_user: {{ item}} needs to be quoted, like so, sudo\_user: “{{ item }}” since YAML will think the “{” is starting a hash. ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [June 28, 2013, 3:48pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/3 "2013-06-28T15:48:45Z")
ok thank you I will try that. it seems to me that in this case, each task will have to change the sudo user in a loop. It sounds like a lot of sudo user switching ( Number of task \* Number of users in the loop) but why not. what is the rationale behind your sentence “you should do any looping inside of the task files” ? is that a strong design decision to protect something else in the architecture or could it evolve at some point ? thanks Jerome ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [June 28, 2013, 4:29pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/4 "2013-06-28T16:29:36Z")
I’m not really sure why you need to ping as a sudo user from 3 different accounts, can you explain the use case before we start to figure out how to model it? 🙂 ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [June 28, 2013, 8:32pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/5 "2013-06-28T20:32:20Z")
Hello, no 😉 the 3 pings where just for a simplified example of what I was trying to achieve. I confirm they are useless ! given a list of users (john, dave, …) I want to setup several configs / applications in their /home dir. I have 2 options : - install everything with sudo=yes and then try to correctly change all the ownership modes so that it appears as if the user had actually set up the environment - install everything with sudo=yes and sudo\_user=item, so that the configuration / installation takes place under the correct user and all the ownership modes are immediatly correct for example i want each user to start with its own installation of [nvm](https://github.com/creationix/nvm) with a pre-installed set of node.js versions I hope this clarifies my use case. Maybe there are other ways to do this ? ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [June 28, 2013, 8:57pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/6 "2013-06-28T20:57:29Z")
I think this is ultimately about being able to pass sudo\_user to a role and have it automatically apply that to all tasks in the role that don’t have the “sudo\_user” set. Can’t do that now, but then you could just have: roles: - { role: install\_things, user: bob, sudo\_user: bob } - { role: install\_things, user: sam, sudo\_user: sam } ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [June 29, 2013, 12:02pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/7 "2013-06-29T12:02:33Z")
Hello, yes, sudo\_user at the role level could be a solution. Are you open for a patch on something like that ? however, is there a way to iterate over the addition of roles in a play ? something like roles: - { role: install\_things, user: “{{item}}”, sudo\_user: “{{item}}” } with\_items: userlist in order to avoid repeating the same line with N users ? Thank you Jerome ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [June 29, 2013, 6:25pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/8 "2013-06-29T18:25:37Z")
Totally fine with sudo\_user being acceptable as a role parameter and doing the right thing. Include + with\_items was a patch we got a long time ago that caused a lot of user questions because everybody wanted to use it with inventory variables, and tasks must exist prior to inventory being parsed, so no, I’m not ok with with\_items being applied to roles like that. The solution is to either list all the items out flat, or do the looping inside the tasks files. ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [June 29, 2013, 8:09pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/9 "2013-06-29T20:09:28Z")
ok thank you for the clarification I will try to understand how the roles are implemented. I appreciate that you are totally fine with a patch as long as it does the right thing 😉 thanks a lot for creating ansible and nurturing a great community btw ! Jerome ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [July 5, 2013, 8:09pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/10 "2013-07-05T20:09:30Z")
Hello, I had a look at the code in order to see how we could add the sudo & sudo\_user options at the role level just like so : roles: - { role: install\_things, user: bob, sudo\_user: bob } - { role: install\_things, user: sam, sudo\_user: sam } extract from the code: if os.path.isfile(task): nt = dict(include=task, vars=has\_dict) if when: nt[‘when’] = when if with\_items: nt[‘with\_items’] = with\_items new\_tasks.append(nt) The problem I see is that the tasks of the role are injected in the play as an “include” task. So basically if we add the sudo/sudo\_user at the role level, we would currently need to add it also at the “include” level in order for it to work. Since you seemed to be against adding sudo/sudo\_user at the include level, I prefer asking you what you think about this (and maybe I am wrong with my understanding of how the code actually works) Thank you Jerome ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [July 5, 2013, 8:52pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/11 "2013-07-05T20:52:55Z")
Yes! ---
**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\ **Post date:** [July 18, 2013, 10:59pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/12 "2013-07-18T22:59:29Z")
Hello, I understood the “Yes!” as a “go for it !”. Here is a pull request for the implementation of sudo/sudo\_user at the role level (and and include level because roles are implemented as include tasks) [https://github.com/ansible/ansible/pull/3579](https://github.com/ansible/ansible/pull/3579) Usage is pretty straight forward : - include: myfile.yml sudo: yes sudo\_user: tom or - hosts: all roles: - { role: myrole, sudo: yes, sudo\_user: jerry } As explained in the pull request comment, “the deepest setting encountered in the hierarchy of playbook/play/role/include/tasks is kept for any task below.” which is I think the intuitive expectation. I hope I didn’t break anything. Existing playbooks should be pretty safe since sudo/sudo\_user were failing at the “include” level, and not extracted from the dict at the “role” level. Best regards, Jerome ---
**Author:** ![Mark\_Mandel](https://avatars.discourse-cdn.com/v4/letter/m/bc79bd/32.png) [@Mark\_Mandel](https://forum.ansible.com/u/Mark_Mandel)\ **Post date:** [July 18, 2013, 11:23pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/13 "2013-07-18T23:23:54Z")
Nice! I’ve wanted this for a while! Thanks! Mark ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 18, 2013, 11:57pm UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/14 "2013-07-18T23:57:33Z")
Merging a ton of bits and doing a lot of bug fixing on things this weekend, so hope to get to this soon. Thanks! ---
**Author:** ![Lorin\_Hochstein1](https://avatars.discourse-cdn.com/v4/letter/l/ce73a5/32.png) [@Lorin\_Hochstein1](https://forum.ansible.com/u/Lorin_Hochstein1)\ **Post date:** [July 19, 2013, 12:54am UTC](https://forum.ansible.com/t/applying-sudo-user-to-a-list-of-tasks/13036/15 "2013-07-19T00:54:32Z")
+1, me too. Looking forward to this new functionality. Lorin