GitHub Action sudo permission issue fix

molecule/colocated_cluster/vars.yml

@@ -6,3 +6,4 @@ wildfly_enable_yml_config: True
 wildfly_yml_configs:
   - yaml_configuration.yml.j2
   - configure_tcp_ping.yml.j2
+root_permission: false

molecule/colocated_cluster/verify.yml

@@ -31,7 +31,7 @@
         loop_var: app_port
 
     - name: "Get eap-0 log"
-      become: true
+      become: "{{ root_permission | default(true) }}"
       ansible.builtin.shell:
         cmd: "cat {{ wildfly_instances_home }}/wildfly-0/standalone/log/server.log"
       changed_when: False

molecule/custom_config_file/vars.yml

@@ -6,3 +6,4 @@ wildfly_install_download_url: "{{ wildfly_download_baseurl }}/{{ wildfly_version
 wildfly_install_download_controller_download_dir: "/tmp"
 wildfly_offline_install: true
 wildfly_archive_filename_local: "{{ wildfly_install_download_controller_download_dir }}/{{ wildfly_archive_filename }}"
+root_permission: false

molecule/default/vars.yml

@@ -0,0 +1,2 @@
+---
+root_permission: false

molecule/group_vars/all/vars.yml

@@ -0,0 +1,11 @@
+---
+root_permission: false
+wildfly_systemd_require_privilege_escalation: false
+wildfly_install_require_privileges_escalation: false
+wildfly_validation_logfile_require_privilege_escalation: false
+wildfly_validation_folders_exists_requires_privileges_escalation: false
+wildfly_migration_jdk_package_install_requires_privileges_escalation: false
+wildfly_uninstall_require_privileges_escalation: false
+wildfly_apps_requires_privilege_escalation: false
+wildfly_utils_jboss_cli_require_privilege_escalation: false
+wildfly_driver_become: false

molecule/install_options/vars.yml

@@ -0,0 +1,2 @@
+---
+root_permission: false

molecule/prepare.yml

@@ -3,6 +3,7 @@
   hosts: all
   gather_facts: true
   vars_files:
+    - group_vars/all/vars.yml
     - apps.yml
   vars:
     sudo_pkg_name: 'sudo'
@@ -35,7 +36,7 @@
           - sudo_pkg_name in ansible_facts.packages
 
     - name: "Ensure required packages are installed."
-      become: true
+      become: "{{ root_permission | default(true) }}"
       ansible.builtin.yum:
         name:
           - java-11-openjdk

molecule/prospero/converge.yml

@@ -2,6 +2,7 @@
 - name: Converge
   hosts: all
   vars_files:
+    - vars.yml
     - ../apps.yml
   vars:
     wildfly_install_user: 'wildfly'

molecule/prospero/vars.yml

@@ -0,0 +1,2 @@
+---
+root_permission: false

molecule/prospero/verify.yml

@@ -7,6 +7,8 @@
     wildfly_prospero_install_dir: /opt/prospero
     wildfly_validation_install_use_prospero: true
     wildfly_validation_check_prospero_install: false
+  vars_files:
+    - vars.yml
   collections:
     - middleware_automation.wildfly
   tasks:

molecule/uninstall/vars.yml

@@ -2,3 +2,4 @@
 wildfly_uninstall_service_name: wildfly
 wildfly_uninstall_home: /opt/wildfly/wildfly-34.0.0.Final
 wildfly_uninstall_path_to_archive: /opt/wildfly/wildfly-34.0.0.Final.zip
+root_permission: false

molecule/uninstall/verify.yml

@@ -21,7 +21,7 @@
         quiet: True
 
     - name: "Load metadata on server home: {{ wildfly_uninstall_home }}"
-      become: true
+      become: "{{ root_permission | default(true) }}"
       ansible.builtin.stat:
         path: "{{ wildfly_uninstall_home }}"
       register: wfly_home

molecule/yaml_config_validation/vars.yml

@@ -6,3 +6,4 @@ wildfly_enable_yml_config: True
 wildfly_yml_configs:
   - yaml_configuration.yml.j2
   - configure_tcp_ping.yml.j2
+root_permission: false

playbooks/vars/vars.yml

@@ -4,6 +4,7 @@
 # through this list
 # wildfly_apps:
 #   - { path: /path/to/war, unmanaged: true }
+root_permission: false
 wildfly_systemd_wait_for_port: true
 postgres_driver_version: 9.4.1212
 mariadb_driver_version: 3.2.0

roles/wildfly_firewalld/tasks/firewalld.yml

@@ -6,13 +6,13 @@
     quiet: true
 
 - name: "Ensure firewalld is available."
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.package:
     name: "{{ wildfly_firewalld_package_name }}"
     state: present
 
 - name: "Ensure firewalld is running."
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.service:
     name: "{{ wildfly_firewalld_service_name | default('firewalld') }}"
     state: started

roles/wildfly_install/handlers/main.yml

@@ -3,7 +3,7 @@
   ansible.builtin.command: "restorecon -F -R -v {{ wildfly_install_workdir }}"
   register: selinux_output
   changed_when: selinux_output.stdout_lines | length > 0
-  become: true
+  become: "{{ root_permission | default(true) }}"
   when:
     - new_version_downloaded.changed or not path_to_workdir.stat.exists
     - wildfly_selinux_enabled

roles/wildfly_install/tasks/install.yml

@@ -24,7 +24,7 @@
   ansible.builtin.stat:
     path: "{{ full_path_to_archive }}"
   register: archive_path
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: "Retrieve archive from website: {{ wildfly_download_baseurl }}"
   ansible.builtin.include_tasks: install/web.yml
@@ -68,7 +68,7 @@
     - not archive_path.stat.exists
     - local_archive_path.stat is defined
     - local_archive_path.stat.exists
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: Perform installation
   when:
@@ -78,7 +78,7 @@
       ansible.builtin.stat:
         path: "{{ full_path_to_archive }}"
       register: is_archive_file_created
-      become: true
+      become: "{{ root_permission | default(true) }}"
 
     - name: "Verify target archive state: {{ full_path_to_archive }}"
       ansible.builtin.assert:
@@ -91,11 +91,11 @@
     - name: "Read target directory information: {{ wildfly_install.home }}"
       ansible.builtin.stat:
         path: "{{ wildfly_install.home }}/bin"
-      become: true
+      become: "{{ root_permission | default(true) }}"
       register: path_to_workdir
 
     - name: "Extract files from {{ full_path_to_archive }} into {{ wildfly_install.workdir }}."
-      become: true
+      become: "{{ root_permission | default(true) }}"
       ansible.builtin.unarchive:
         src: "{{ full_path_to_archive }}"
         dest: "{{ wildfly_install.workdir }}"
@@ -121,7 +121,7 @@
 - name: "Read information on server home directory: {{ wildfly_install.home }}"
   ansible.builtin.stat:
     path: "{{ wildfly_install.home }}"
-  become: true
+  become: "{{ root_permission | default(true) }}"
   register: is_wfly_home
 
 - name: "Check state of server home directory: {{ wildfly_install.home }}"
@@ -145,7 +145,7 @@
     serole: object_r
     setype: usr_t
     seuser: system_u
-  become: true
+  become: "{{ root_permission | default(true) }}"
   when: wildfly_install.config_custom | length > 0
   notify:
     - exec_restorecon
@@ -163,7 +163,7 @@
     serole: object_r
     setype: usr_t
     seuser: system_u
-  become: true
+  become: "{{ root_permission | default(true) }}"
   notify:
     - exec_restorecon
 

roles/wildfly_install/tasks/prereqs.yml

@@ -85,7 +85,7 @@
   ansible.builtin.package:
     name: "{{ wildfly_prereqs_packages }}"
     state: present
-  become: true
+  become: "{{ root_permission | default(true) }}"
   when:
     - wildfly_prereqs_packages | length > 0
     - not wildfly_install_skip_prereqs is defined

roles/wildfly_install/tasks/user.yml

@@ -10,12 +10,12 @@
     group_name: "{{ wildfly_install.group | default(wildfly_install.user) }}"
 
 - name: "Ensure group {{ group_name }} exists."
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.group:
     name: "{{ group_name }}"
 
 - name: "Ensure user {{ wildfly_install.user }} exists."
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.user:
     name: "{{ wildfly_install.user }}"
     group: "{{ group_name }}"

roles/wildfly_migration/tasks/run_server_migration.yml

@@ -7,7 +7,7 @@
     target_path: "{{ lookup('env', 'PATH') }}"
 
 - name: "Run migration tool"
-  become: yes
+  become: "{{ root_permission | default(true) }}"
   become_user: wildfly
   ansible.builtin.command: "{{ wildfly_migration_server_tool_path_to_script }} --non-interactive --source {{ previous_wildfly_home }} --environment {{ wildfly_migration_path_to_env_properties }} --target {{ target_wildfly_home }}"
   register: migration_results

roles/wildfly_systemd/handlers/main.yml

@@ -6,12 +6,12 @@
   listen: "restart_wildfly"
 
 - name: "Perform daemon-reload"
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.systemd:
     daemon_reload: true
 
 - name: Execute restorecon
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.command: "restorecon -R -v {{ wildfly_install_workdir }}"
   register: selinux_output
   changed_when: selinux_output.stdout_lines | length > 0

roles/wildfly_systemd/tasks/main.yml

@@ -25,13 +25,13 @@
     tasks_from: user.yml
 
 - name: 'Check if PID directory exists'
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.stat:
     path: "{{ wildfly_systemd.selinux.pid_path }}"
   register: pid_directory
 
 - name: 'Create PID directory path if not exists'
-  become: true
+  become: "{{ root_permission | default(true) }}"
   ansible.builtin.file:
     path: "{{ wildfly_systemd.selinux.pid_path }}"
     state: directory

roles/wildfly_systemd/tasks/service.yml

@@ -12,4 +12,4 @@
     state: "{{ instance_state }}"
     enabled: "{{ wildfly_systemd.enabled | default(omit) }}"
     daemon_reload: true
-  become: true
+  become: "{{ root_permission | default(true) }}"

roles/wildfly_utils/tasks/apply_cp.yml

@@ -22,7 +22,7 @@
     path: "{{ patch_archive }}"
   register: patch_archive_path
   when: eap_patch_version is defined
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: Check local download archive path
   ansible.builtin.stat:
@@ -57,7 +57,7 @@
 
     - name: Determine patch versions list
       ansible.builtin.set_fact:
         filtered_versions: "{{ rhn_products.results | map(attribute='file_path') | select('match', '^[^/]*/jboss-eap-.*[0-9]*[.][0-9]*[.][0-9]*.*$') | map('regex_replace','[^/]*/jboss-eap-([0-9]*[.][0-9]*[.][0-9]*)-.*','\\1' ) | list | unique }}"
       when: eap_patch_version is not defined or eap_patch_version | length == 0
       delegate_to: localhost
       run_once: true
@@ -91,7 +91,7 @@
       ansible.builtin.stat:
         path: "{{ patches_repository }}/{{ patch_bundle }}"
       register: remote_archive_path
-      become: true
+      become: "{{ root_permission | default(true) }}"
 
     - name: Download Red Hat EAP patch
       middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
@@ -114,7 +114,7 @@
   ansible.builtin.stat:
     path: "{{ patch_archive }}"
   register: patch_info
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: Copy patch archive to target nodes
   ansible.builtin.copy:
@@ -130,14 +130,14 @@
   register: new_version_downloaded
   when:
     - not patch_info.stat.exists
-  become: true
+  become: "{{ root_permission | default(true) }}"
   notify: exec_restorecon
 
 - name: "Check patch state"
   ansible.builtin.stat:
     path: "{{ patch_archive }}"
   register: patch_info
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: "Set checksum file path for patch"
   ansible.builtin.set_fact:
@@ -149,7 +149,7 @@
   ansible.builtin.stat:
     path: "{{ patch_checksum_file }}"
   register: last_patch_status
-  become: true
+  become: "{{ root_permission | default(true) }}"
 
 - name: Print when patch has been applied already
   ansible.builtin.debug:
@@ -181,7 +181,7 @@
             serole: object_r
             setype: usr_t
             seuser: system_u
-          become: true
+          become: "{{ root_permission | default(true) }}"
           notify: exec_restorecon
         - name: "Start wildfly for patching"
           ansible.builtin.shell: |
@@ -196,7 +196,7 @@
           async: 180
           poll: 0
           register: apply_cp_process
-          become: true
+          become: "{{ root_permission | default(true) }}"
           become_user: "{{ wildfly_user }}"
         - name: "Wait for management interface is reachable"
           ansible.builtin.wait_for:
@@ -244,7 +244,7 @@
             seuser: system_u
           when:
             - not last_patch_status.stat.exists
-          become: true
+          become: "{{ root_permission | default(true) }}"
           notify: exec_restorecon
 
         - name: Set latest patch file
@@ -260,7 +260,7 @@
             seuser: system_u
           when:
             - not last_patch_status.stat.exists
-          become: true
+          become: "{{ root_permission | default(true) }}"
           notify: exec_restorecon
 
     - name: "Restart server to ensure patch content is running"

roles/wildfly_utils/tasks/keycloak_adapter.yml

@@ -62,7 +62,7 @@
       ansible.builtin.stat:
         path: "{{ path_to_patch }}"
       register: remote_archive_path
-      become: true
+      become: "{{ root_permission | default(true) }}"
 
     - name: Download Red Hat Single Sign-On Adapter
       middleware_automation.common.product_download: # noqa risky-file-permissions delegated, uses controller host user
@@ -99,7 +99,7 @@
     - not patch_archive_path.stat.exists
     - local_archive_path.stat is defined
     - local_archive_path.stat.exists
-  become: true
+  become: "{{ root_permission | default(true) }}"
   notify: exec_restorecon
 
 - name: Extract Adapter zipfile
@@ -114,7 +114,7 @@
     serole: object_r
     setype: usr_t
     seuser: system_u
-  become: true
+  become: "{{ root_permission | default(true) }}"
   notify: exec_restorecon
 
 - name: Perform installation
@@ -136,7 +136,7 @@
             mode: '0640'
             remote_src: true
             force: false
-          become: true
+          become: "{{ root_permission | default(true) }}"
         - name: "Start wildfly for adapter installation"
           ansible.builtin.shell: |
             set -o pipefail
@@ -149,7 +149,7 @@
           changed_when: True
           async: 180
           poll: 0
-          become: true
+          become: "{{ root_permission | default(true) }}"
           become_user: "{{ wildfly_user }}"
           register: adapter_install_process
         - name: "Wait for management interface is reachable"