Ansible unarchive模块权限拒绝问题求助

错误根源 #

你的Ansible Playbook中存在权限逻辑问题：

• 虽然启用了sudo，但become_user: disasterman让任务以普通用户disasterman身份运行，该用户本身没有创建/opt/java子目录、修改文件属主为buildmaster的权限——即使disasterman能sudo到root，Ansible也不会自动触发这个提升，必须明确指定切换到root身份执行高权限操作。
• 手动执行sudo chown能成功，是因为你手动触发了sudo切换到root，但Ansible任务默认不会为普通用户自动提升权限。

修复方案 #

方案1：全局切换到root执行（推荐） #

直接将become_user改为root，让所有需要高权限的任务以root身份运行，彻底解决权限问题：

- name: Install ZULU Java package
  hosts: jenkins
  become: true
  become_user: root  # 切换到root获取完整权限

  gather_facts: false

  tasks:
    - name: Ensure /opt/java directory exists
      ansible.builtin.file:
        path: /opt/java/
        state: directory
        owner: buildmaster
        group: buildmaster
        mode: '775'

    - name: Download ZULU Java JDK
      delegate_to: localhost
      ansible.builtin.get_url:
        url: "{{ zulu_url }}"
        dest: /tmp/
      register: downloaded_file

    - name: Print downloaded file path
      ansible.builtin.debug:
        var: downloaded_file.dest

    - name: Deliver and extract the package
      ansible.builtin.unarchive:
        src: "{{ downloaded_file.dest }}"
        dest: /opt/java/
        remote_src: false
        owner: buildmaster
        group: buildmaster
        mode: '775'

方案2：仅在高权限任务中切换到root #

如果必须以disasterman身份执行大部分任务，可单独为需要权限的任务指定切换到root：

- name: Install ZULU Java package
  hosts: jenkins
  become: true
  become_user: disasterman

  gather_facts: false

  tasks:
    - name: Ensure /opt/java directory exists
      ansible.builtin.file:
        path: /opt/java/
        state: directory
        owner: buildmaster
        group: buildmaster
        mode: '775'
      become: true
      become_user: root  # 该任务单独用root执行

    - name: Download ZULU Java JDK
      delegate_to: localhost
      ansible.builtin.get_url:
        url: "{{ zulu_url }}"
        dest: /tmp/
      register: downloaded_file

    - name: Print downloaded file path
      ansible.builtin.debug:
        var: downloaded_file.dest

    - name: Deliver and extract the package
      ansible.builtin.unarchive:
        src: "{{ downloaded_file.dest }}"
        dest: /opt/java/
        remote_src: false
        owner: buildmaster
        group: buildmaster
        mode: '775'
      become: true
      become_user: root  # 该任务单独用root执行

关键修改说明 #

1. 提前创建目标目录：新增file任务确保/opt/java目录存在，避免unarchive模块因目录不存在且无权限创建而报错，同时提前设置好目录属主和权限。
2. 切换到root身份：无论是全局还是单独任务设置，都通过become_user: root获得创建系统目录、修改文件属主的完整权限，解决Permission denied和无法修改属主的问题。

内容的提问来源于stack exchange，提问作者adminkc