21.2. 在单个 Ansible 任务中管理多个 IdM sudo 规则

流程

1. 进入 ~/MyPlaybooks/ 目录：

   $ cd ~/MyPlaybooks/

2. 使用以下内容创建 ensure-presence-of-multiple-sudorules-in-a-task.yml 文件：

   ---
   - name: Playbook to handle sudorules
     hosts: ipaserver
     become: true
   
     tasks:
     # Ensure sudo command name: /usr/sbin/dmidecode is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/sbin/dmidecode
   
     # Ensure sudo command /usr/sbin/reboot is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/sbin/reboot
   
     # Ensure sudo command /usr/bin/yum is present
     - freeipa.ansible_freeipa.ipasudocmd:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: /usr/bin/yum
   
     # Ensure a sudo command group is present
     - freeipa.ansible_freeipa.ipasudocmdgroup:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: sudogroup01
         sudocmd:
         - /usr/sbin/dmidecode
         - /usr/sbin/reboot
   
     - name: Ensure multiple sudo rules are present using batch mode
       freeipa.ansible_freeipa.ipasudorule:
         ipaadmin_password: "{{ ipaadmin_password }}"
         sudorules:
           - name: testrule01
             user:
               - user01
               - user02
             group:
               - usergroup01
             allow_sudocmd:
               - /usr/bin/yum
             allow_sudocmdgroup:
               - sudogroup01
           - name: testrule02
             hostgroup:
               - hostgroup01
               - hostgroup02

   注意

   使用 sudorules 选项，您可以指定多个仅适用于特定 sudo 规则的 sudo 规则变量。此 sudo 规则由 name 变量定义，它是 sudorules 选项的唯一强制的变量。在示例中，用户、组、allow_sudocmd 和 allow_sudocmdgroup 变量应用到 testrule01 sudo 规则。

3. 保存该文件。

4. 运行 Ansible playbook。指定 playbook 文件、存储保护 secret.yml 文件的密码，以及清单文件：

   $ ansible-playbook --vault-password-file=password_file -v -i inventory ensure-presence-of-multiple-sudorules-in-a-task.yml