Ansible：即使成为 sudo 用户，也无法配置 sudo 命令

testuser 是 sudo 用户，

sudo cat /etc/sudoers.d/90-cloud-init-testuser
testuser ALL=(ALL) NOPASSWD:ALL

我可以手动登录 testuser 并在没有密码的情况下运行以下命令：

sudo -H apt-get update
sudo -H apt-get upgrade

但是如果我运行以下 ansible 代码，尽管我看到 whoami 命令返回 testuser，但代码会因致命错误而停止（请参阅下面的代码和错误）。

我必须将become_user设置为root才能运行（请参阅我注释掉的行）？注意我可以手动登录testuser并运行sudo命令，我不能使用become_user=testuser来安装apt吗？注意我认为remote_user并不重要，因为whoami命令只依赖于become_user。事实上我觉得remote_user没用，它只是让我登录。如果become_user未设置。然后whoami成为root，如果become_user设置为testuser，那么whoami成为testuser。

- hosts: all
  remote_user: ubuntu
  become: yes
  become_user: testuser
  gather_facts: yes
  become_method: sudo
  tasks:
  - name: test which user I am
    shell: whomami
    register: hello
  - debug: msg="{{ hello.stdout }}"
  - name: Update and upgrade apt.
#    become_user: root
#    become: yes
    apt: update_cache=yes upgrade=dist cache_valid_time=3600

TASK [Update and upgrade apt.]     
********************************
fatal: [XX.XX.XX.XX]: FAILED! => {"changed": false, "msg": 

"'/usr/bin/apt-get dist-upgrade' failed: E: Could not open lock file     
/var/lib/dpkg/lock - open (13: Permission denied)\nE: Unable to lock  
the administration directory (/var/lib/dpkg/), are you root?\n", "rc": 
100, "stdout": "", "stdout_lines": []}

您需要连接一个具有 sudo 权限的帐户 - 在您的情况下testuser― 然后使用提升的权限运行播放/任务（become: true, and become: root这是默认的），所以：

• 要么添加 sudo 权限ubuntu,
• 或连接testuser.

sudo不按照你在问题中暗示的方式工作。

任何命令都在特定用户的上下文中运行 - 或者testuser, or ubuntu, or root。不存在像“sudo”这样运行命令这样的事情testuser".

sudo以不同用户身份执行命令（root默认情况下）。用户执行sudo必须有适当的权限。

• If you log in as testuser and execute sudo -H apt-get update it is (almost^*) the same as if you logged in as root and ran apt-get update.

• If you log in as ubuntu and run sudo -u testuser apt-get update (which is a shell counterpart to the Ansible tasks in the question) ― it is (almost^*) the same as if you logged on with testuser and ran apt-get update.

  testuser跑步apt-get update会得到一个错误——这就是你得到的结果。

^* "almost", because it depends on settings regarding environment variables ― not relevant to the problem here.