Ansible使用systemd模块无法启停服务权限问题求助

问题现象 #

使用Ansible的systemd模块启停inubit.service时返回超时错误：

"Unable to stop service inubit.service: Failed to stop inubit.service: Connection timed out
See system logs and 'systemctl status inubit.service' for details."

但以下操作均正常：

• 目标机器上integration用户手动执行sudo systemctl start/stop inubit.service
• 通过Ansible的command模块执行上述sudo命令

相关配置 #

/etc/sudoers配置 #

integration ALL=NOPASSWD:/bin/systemctl restart inubit
integration ALL=NOPASSWD:/bin/systemctl start inubit
integration ALL=NOPASSWD:/bin/systemctl stop inubit
integration ALL=NOPASSWD:/bin/systemctl status inubit
integration ALL=NOPASSWD:/bin/systemctl restart inubit.service
integration ALL=NOPASSWD:/bin/systemctl start inubit.service
integration ALL=NOPASSWD:/bin/systemctl stop inubit.service
integration ALL=NOPASSWD:/bin/systemctl status inubit.service

出错的Ansible任务 #

- name: Stop inubit service if running
  ansible.builtin.systemd:
    name: inubit.service
    state: stopped
  become: true
  become_user: integration

排查方向及解决方法 #

1. 修正become提权逻辑 #

当前任务的become: true + become_user: integration是切换到integration用户，但systemd模块需要root权限操作服务。正确的提权应该是以integration用户执行sudo切换到root：

- name: Stop inubit service if running
  ansible.builtin.systemd:
    name: inubit.service
    state: stopped
  become: true
  become_user: root
  become_method: sudo

2. 强制systemd模块使用exec模式 #

systemd模块默认通过D-Bus接口直接操作systemd，可能因权限或环境问题导致超时。开启daemon_exec: true可强制模块通过执行systemctl命令来操作：

- name: Stop inubit service if running
  ansible.builtin.systemd:
    name: inubit.service
    state: stopped
    daemon_exec: true
  become: true
  become_user: integration

3. 指定systemctl路径及环境变量 #

Ansible执行时的环境变量可能与手动登录不同，明确指定systemctl路径可避免路径查找问题：

- name: Stop inubit service if running
  ansible.builtin.systemd:
    name: inubit.service
    state: stopped
    systemctl_path: /bin/systemctl
  become: true
  become_user: integration

4. 调整模块超时时间 #

如果服务本身启停耗时较长，超出Ansible systemd模块默认的90秒超时，可手动延长超时时间：

- name: Stop inubit service if running
  ansible.builtin.systemd:
    name: inubit.service
    state: stopped
    timeout: 120  # 单位：秒
  become: true
  become_user: integration

内容的提问来源于stack exchange，提问作者Dokksen