如何在任务层级覆盖主机文件中设置的ansible_become_user？

我在主机文件中设置了ansible_become: yes、ansible_become_user: root，因为部署新机器时大多以root操作。但我需要以服务账号ganymede克隆Git仓库，于是在任务块中设置vars: ansible_become: no，同时在块外配置become: yes和become_user: ganymede。然而执行后whoami显示当前用户是ubuntu，Git任务因无法访问ganymede的SSH密钥报错，请问如何让任务层级的become_user生效？

主机文件配置 #

all:
  hosts:
    ganymede:
      ansible_host: ganymede.xcv.org

  vars:
    ansible_user: ubuntu
    ansible_become: yes
    ansible_become_user: root

任务配置（原错误版本） #

- name: Git
  vars:
    ansible_become: no
  block:
    - name: whoami
      command: whoami
      register: a
    - debug:
      msg: {{ a.stdout }}
    - git:
        repo: "git@github.com:fakerepo/ganymede.git"
        dest: "/opt/"
        force: yes
        key_file: ~ganymede/.ssh/id_ed25519
  become: yes
  become_user: ganymede

执行结果 #

TASK [debug] ***********************************************
ok: [ganymede] => {
    "msg": "ubuntu"
}

Git任务报错信息 #

TASK [git] *************************************************
fatal: [ganymede]: FAILED! => {
    "changed": false, 
    "cmd": "/usr/bin/git ls-remote git@github.com:fakerepo/ganymede.git -h refs/heads/HEAD", 
    "msg": 
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied."
        "Host key verification failed."
        "fatal: Could not read from remote repository."
        "Please make sure you have the correct access rights and the repository exists.",
    "rc": 128, 
    "stderr": 
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied."
        "Host key verification failed."
        "fatal: Could not read from remote repository."
        "Please make sure you have the correct access rights and the repository exists.", 
    "stderr_lines": [
        "Warning: Identity file /home/ganymede/.ssh/id_ed25519 not accessible: Permission denied.", 
        "Host key verification failed.", 
        "fatal: Could not read from remote repository.", 
        "", 
        "Please make sure you have the correct access rights and the repository exists."
    ], 
    "stdout": "", 
    "stdout_lines": []
}

解决方案 #

问题根源 #

你在任务块的vars中设置了ansible_become: no，这个变量会优先覆盖块外的become: yes配置，导致整个任务块都不会执行用户切换操作，所以当前用户始终是初始登录的ubuntu，自然无法访问ganymede的SSH密钥。

修正后的任务配置 #

直接移除任务块中的vars: ansible_become: no，保留块外的become: yes和become_user: ganymede即可，任务级别的become配置会自动覆盖主机文件中的全局root配置：

- name: Git
  block:
    - name: whoami
      command: whoami
      register: a
    - debug:
        msg: "{{ a.stdout }}"  # 修正语法错误：msg值需用引号包裹
    - git:
        repo: "git@github.com:fakerepo/ganymede.git"
        dest: "/opt/"
        force: yes
        key_file: ~/.ssh/id_ed25519  # 切换到ganymede后，~代表其家目录
  become: yes
  become_user: ganymede

额外注意事项 #

1. 语法修正：原debug任务的msg未用引号包裹，会触发Ansible语法错误，需修正为msg: "{{ a.stdout }}"。
2. 密钥路径简化：切换到ganymede用户后，~直接指向其家目录/home/ganymede，所以key_file可以简化为~/.ssh/id_ed25519，避免手动写绝对路径带来的权限问题。
3. 目录权限检查：确保ganymede用户对/opt/目录有写入权限，否则Git克隆时会提示权限不足。
4. 切换逻辑说明：任务级别的become是从初始登录用户（ubuntu）直接切换到目标用户（ganymede），而非先切换到root再转用户，这是Ansible默认行为，足够满足当前需求。

内容的提问来源于stack exchange，提问作者Vishal