您可以为一个组或所有服务器设置密码:

[all:vars]
ansible_sudo_pass=default_sudo_password_for_all_hosts

[group1:vars]
ansible_sudo_pass=default_sudo_password_for_group1

我的黑客自动化这是使用一个环境变量，并通过——extralvars =“ansible_become_pass='{{lookup('env'， ' ansible_become_pass ')}}'”访问它。

导出一个env变量，但避免bash/shell历史记录(前面有一个空格或其他方法)。例如:

     export ANSIBLE_BECOME_PASS='<your password>'

查找env变量，同时将额外的ansible_become_pass变量传递到ansible-playbook中，例如:

ansible-playbook playbook.yml -i inventories/dev/hosts.yml -u user --extra-vars="ansible_become_pass='{{ lookup('env', 'ANSIBLE_BECOME_PASS') }}'"

好的替代答案:

@toast38coza: simply use a vaulted value for ansible_become_pass. This is decent. However, for the paranoid teams that need to share ansible vault passwords, and execute ansible plays with induvidual accounts, they coudld use the shared vault password to reverse each others operating system password (identiy theft). Arguably, you need to trust your own team? @slm's bash subshell output generated to temp file descriptor and using the @ prefix to read the ansible variable from the file desriptor. Avoids bash history at least. Not sure, but hopefully subshell echo doesn't get caught and exposed in audit logging (e.g. auditd).

文档强烈建议不要将sudo密码设置为明文:

提醒一下，密码永远不应该以纯文本的形式存储。有关使用Ansible Vault加密您的密码和其他秘密的信息，请参见使用Ansible Vault加密内容。

相反，当运行ansible-playbook时，你应该在命令行上使用——ask-become-pass

之前版本的Ansible使用——ask-sudo-pass和sudo来代替become。

非常简单，只需在变量file中添加:

例子:

$ vim group_vars/all

加上这些:

Ansible_connection: ssh
Ansible_ssh_user: rafael
Ansible_ssh_pass: password123
Ansible_become_pass: password123

以上@toast38coza的解决方案对我来说很管用;只是sudo: yes现在在Ansible中被弃用了。 请使用become和become_user。

tasks:
 - name: Restart apache service
   service: name=apache2 state=restarted
   become: yes
   become_user: root

如果你愿意将密码保存在纯文本文件中，另一种选择是使用带有——extra-vars参数的JSON文件(确保将该文件排除在源代码控制之外):

ansible-playbook --extra-vars "@private_vars.json" playbook.yml 

Ansible从1.3开始就支持这个选项。