Merge pull request #3140 from edx/arbab/ops-1593

OPS-1593 As an operator, I want sudo_user converted to become user in…

playbooks/roles/jenkins_admin/tasks/nat_monitor.yml

@@ -24,7 +24,7 @@
     owner="{{ jenkins_user }}"
     group="{{ jenkins_group }}"
     mode="755"
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
   notify: restart nat monitor
 
 - name: create a supervisor config
@@ -32,7 +32,7 @@
     src="nat-monitor.conf.j2" dest="{{ jenkins_supervisor_available_dir }}/nat-monitor.conf"
     owner="{{ jenkins_user }}"
     group="{{ jenkins_group }}"
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
   notify: restart nat monitor
 
 - name: enable the supervisor config
@@ -42,7 +42,7 @@
     state=link
     force=yes
     mode=0644
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
   when: not disable_edx_services
   notify: restart nat monitor
 

playbooks/roles/jenkins_analytics/tasks/main.yml

@@ -154,8 +154,8 @@
     repo: https://github.com/jenkinsci/job-dsl-plugin.git
     depth: 1
     dest: "{{ jenkins_seed_job_root }}"
-  sudo: yes
-  sudo_user: "{{ jenkins_user }}"
+  become: yes
+  become_user: "{{ jenkins_user }}"
   tags:
     - jenkins-seed-job
 
@@ -173,8 +173,8 @@
   shell: >
     cd {{ jenkins_seed_job_root }} &&
     GRADLE_OPTS="-Dorg.gradle.daemon=true" ./gradlew run -Pargs={{ jenkins_seed_job_script }}
-  sudo: yes
-  sudo_user: "{{ jenkins_user }}"
+  become: yes
+  become_user: "{{ jenkins_user }}"
   tags:
     - jenkins-seed-job
 

playbooks/roles/jenkins_worker/tasks/python_platform_worker.yml

@@ -11,7 +11,7 @@
     dest={{ jenkins_home }}/shallow-clone
     version={{ jenkins_edx_platform_version }}
     depth=1
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
 
 # pip-accel skipped due to conflicting versions of pip required
 # by the pip-accel package and edx-platform
@@ -20,7 +20,7 @@
 #     name="{{ item }}"
 #     virtualenv={{ jenkins_home }}/edx-venv
 #     virtualenv_command=virtualenv-2.7
-#   sudo_user: "{{ jenkins_user }}"
+#   become_user: "{{ jenkins_user }}"
 #   with_items: pip_accel_reqs
 
 # Install the platform requirements using pip.
@@ -42,7 +42,7 @@
     - github.txt
     - base.txt
     - paver.txt
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
 
 
 # These and the pip install below it can be removed some time after
@@ -50,7 +50,7 @@
 # This will keep us from breaking after that gets merged.
 - stat: path="{{ jenkins_home }}/shallow-clone/requirements/edx/post.txt"
   register: post_requirements
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
 
 - name: Install edx-platform post requirements using pip
   pip: >
@@ -61,7 +61,7 @@
     executable=pip
   with_items:
     - post.txt
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
   when: post_requirements.stat.exists
 
 # Archive the current state of the virtualenv
@@ -72,7 +72,7 @@
   command: >
     tar -cpzf edx-venv_clean.tar.gz edx-venv
     chdir={{ jenkins_home }}
-  sudo_user: "{{ jenkins_user }}"
+  become_user: "{{ jenkins_user }}"
 
 # Remove the shallow-clone directory now that we are
 # done with it

playbooks/roles/jenkins_worker/tasks/system.yml

@@ -49,7 +49,7 @@
 # Edit the /etc/hosts file so that the Preview button will work in Studio
 - name: add preview.localhost to /etc/hosts
   shell: sed -i -r 's/^127.0.0.1\s+.*$/127.0.0.1 localhost preview.localhost/' /etc/hosts
-  sudo: yes
+  become: yes
 
 # Npm registry must be pre-loaded or else setting it
 # with the Jenkins user will fail

playbooks/roles/local_dev/tasks/main.yml

@@ -103,4 +103,4 @@
 # Edit the /etc/hosts file so that the Preview button will work in Studio
 - name: add preview.localhost to /etc/hosts
   shell: sed -i -r 's/^127.0.0.1\s+.*$/127.0.0.1 localhost preview.localhost/' /etc/hosts
-  sudo: yes
+  become: yes

playbooks/roles/locust/tasks/main.yml

@@ -43,7 +43,7 @@
     requirements="{{ locust_requirements_base }}/{{ item }}"
     virtualenv="{{ locust_home }}/venvs/{{ locust_service_name }}"
     state=present
-  sudo_user: "{{ locust_user }}"
+  become_user: "{{ locust_user }}"
   with_items: locust_requirements
 
 - name: write supervisord config
@@ -71,7 +71,7 @@
     config={{ supervisor_cfg }}
     name={{ locust_service_name }}
   when: not disable_edx_services
-  sudo_user: "{{ supervisor_service_user }}"
+  become_user: "{{ supervisor_service_user }}"
 
 - name: increase file descriptor limit of the system (Session Logout and Login would be required)
   lineinfile:

playbooks/roles/newrelic-npi/tasks/main.yml

@@ -38,27 +38,27 @@
   shell: >
     tar -xzf /tmp/{{ newrelic_npi_installer }} --strip-components=1 -C "{{NEWRELIC_NPI_PREFIX}}"
   when: download_npi_installer.changed
-  sudo_user: "{{ NEWRELIC_USER }}"
+  become_user: "{{ NEWRELIC_USER }}"
 
 - name: configure npi with the default user
   shell: >
     {{ NEWRELIC_NPI_PREFIX }}/bin/node {{ NEWRELIC_NPI_PREFIX }}/npi.js "set user {{ NEWRELIC_USER }}"
   args:
     chdir: "{{ NEWRELIC_NPI_PREFIX }}"
-  sudo_user: "{{ NEWRELIC_USER }}"
+  become_user: "{{ NEWRELIC_USER }}"
 
 - name: configure npi with the license key
   shell: >
      ./npi set license_key {{ NEWRELIC_LICENSE_KEY }}
   args:
     chdir: "{{ NEWRELIC_NPI_PREFIX }}"
-  sudo_user: "{{ NEWRELIC_USER }}"
+  become_user: "{{ NEWRELIC_USER }}"
 
 - name: configure npi with the distro
   shell: >
      ./npi set distro {{ NEWRELIC_NPI_DISTRO }}
   args:
     chdir: "{{ NEWRELIC_NPI_PREFIX }}"
-  sudo_user: "{{ NEWRELIC_USER }}"
+  become_user: "{{ NEWRELIC_USER }}"
 
 

playbooks/roles/nginx/tasks/main.yml

@@ -241,7 +241,7 @@
 - local_action:
     module: stat
     path: "{{ NGINX_SSL_CERTIFICATE }}"
-  sudo: False
+  become: False
   register: ssl_cert
   tags:
     - install
@@ -250,7 +250,7 @@
 - local_action:
     module: stat
     path: "{{ NGINX_SSL_KEY }}"
-  sudo: False
+  become: False
   register: ssl_key
   tags:
     - install

playbooks/roles/notifier/tasks/deploy.yml

@@ -5,8 +5,8 @@
     dest={{ NOTIFIER_CODE_DIR }} repo={{ NOTIFIER_SOURCE_REPO }}
     version={{ NOTIFIER_VERSION }}
     accept_hostkey=yes
-  sudo: true
-  sudo_user: "{{ notifier_user }}"
+  become: true
+  become_user: "{{ notifier_user }}"
   notify:
     - restart notifier-scheduler
     - restart notifier-celery-workers
@@ -37,7 +37,7 @@
     version={{ NOTIFIER_THEME_VERSION }}
     accept_hostkey=yes
   when: NOTIFIER_THEME_NAME != ''
-  sudo_user: "{{ notifier_user }}"
+  become_user: "{{ notifier_user }}"
   environment:
     GIT_SSH: "{{ notifier_git_ssh }}"
 
@@ -54,8 +54,8 @@
   pip:
     requirements="{{ NOTIFIER_REQUIREMENTS_FILE }}"
     virtualenv="{{ NOTIFIER_VENV_DIR }}" state=present
-  sudo: true
-  sudo_user: "{{ notifier_user }}"
+  become: true
+  become_user: "{{ notifier_user }}"
   notify:
     - restart notifier-scheduler
     - restart notifier-celery-workers
@@ -67,7 +67,7 @@
   file: >
     path={{ NOTIFIER_DB_DIR }}/notifier.db state=touch owner={{ notifier_user }} group={{ NOTIFIER_WEB_USER }}
     mode=0664
-  sudo: true
+  become: true
   notify:
     - restart notifier-scheduler
     - restart notifier-celery-workers
@@ -77,8 +77,8 @@
 - name: syncdb
   shell: >
     cd {{ NOTIFIER_CODE_DIR }} && {{ NOTIFIER_VENV_DIR }}/bin/python manage.py syncdb
-  sudo: true
-  sudo_user: "{{ notifier_user }}"
+  become: true
+  become_user: "{{ notifier_user }}"
   environment: notifier_env_vars
   notify:
     - restart notifier-scheduler

playbooks/roles/notifier/tasks/main.yml

@@ -69,8 +69,8 @@
 
 - name: ensure .bashrc exists
   shell: touch {{ notifier_app_dir }}/.bashrc
-  sudo: true
-  sudo_user: "{{ notifier_user }}"
+  become: true
+  become_user: "{{ notifier_user }}"
 
 - name: add source of notifier_env to .bashrc
   lineinfile:
@@ -110,26 +110,26 @@
     src=notifier-celery-workers-supervisor.sh.j2
     dest="{{ notifier_app_dir }}/notifier-celery-workers-supervisor.sh"
     mode=0775
-  sudo_user: "{{ notifier_user }}"
+  become_user: "{{ notifier_user }}"
 
 - name: write supervisord wrapper for scheduler
   template: >
     src=notifier-scheduler-supervisor.sh.j2
     dest="{{ notifier_app_dir }}/notifier-scheduler-supervisor.sh"
     mode=0775
-  sudo_user: "{{ notifier_user }}"
+  become_user: "{{ notifier_user }}"
 
 - name: write supervisord config for celery workers
   template: >
     src=edx/app/supervisor/conf.d/notifier-celery-workers.conf.j2
     dest="{{ supervisor_available_dir }}/notifier-celery-workers.conf"
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
 
 - name: write supervisord config for scheduler
   template: >
     src=edx/app/supervisor/conf.d/notifier-scheduler.conf.j2
     dest="{{ supervisor_available_dir }}/notifier-scheduler.conf"
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
 
 - name: enable supervisord config for celery workers
   file: >
@@ -137,7 +137,7 @@
     dest="{{ supervisor_cfg_dir }}/notifier-celery-workers.conf"
     state=link
     force=yes
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   notify: restart notifier-celery-workers
   when: not disable_edx_services
 
@@ -147,7 +147,7 @@
     dest="{{ supervisor_cfg_dir }}/notifier-scheduler.conf"
     state=link
     force=yes
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   notify: restart notifier-scheduler
   when: not disable_edx_services
 

playbooks/roles/oauth_client_setup/tasks/main.yml

@@ -32,7 +32,7 @@
     --client_id {{ item.id }}
     --client_secret {{ item.secret }}
     --trusted
-  sudo_user: "{{ edxapp_user }}"
+  become_user: "{{ edxapp_user }}"
   environment: "{{ edxapp_environment }}"
   with_items: oauth_client_setup_oauth2_clients
   when: item.name != 'None'

playbooks/roles/programs/tasks/main.yml

@@ -25,7 +25,7 @@
   template:
     src: edx/app/programs/programs_gunicorn.py.j2
     dest: "{{ programs_home }}/programs_gunicorn.py"
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
 
 - name: install application requirements
   pip:
@@ -33,25 +33,25 @@
     # Ansible will initialize this virtualenv if it's missing.
     virtualenv: "{{ programs_venv_dir }}"
     state: present
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   with_items: "{{ programs_requirements }}"
 
 - name: create nodeenv
   shell: >
     creates={{ programs_nodeenv_dir }}
     {{ programs_venv_dir }}/bin/nodeenv {{ programs_nodeenv_dir }} --prebuilt
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
 
 - name: install node dependencies
   npm: executable={{ programs_nodeenv_bin }}/npm path={{ programs_code_dir }} production=yes
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   environment: "{{ programs_environment }}"
 
 - name: install bower dependencies
   shell: >
     chdir={{ programs_code_dir }}
     . {{ programs_nodeenv_bin }}/activate && {{ programs_node_bin }}/bower install --production --config.interactive=false
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
 
 - name: migrate
   shell: >
@@ -59,7 +59,7 @@
     DB_MIGRATION_USER={{ COMMON_MYSQL_MIGRATE_USER }}
     DB_MIGRATION_PASS={{ COMMON_MYSQL_MIGRATE_PASS }}
     {{ programs_venv_dir }}/bin/python ./manage.py migrate --noinput
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   environment: "{{ programs_environment }}"
   when: migrate_db is defined and migrate_db|lower == "yes"
 
@@ -67,21 +67,21 @@
   shell: >
     chdir={{ programs_code_dir }}
     . {{ programs_nodeenv_bin }}/activate && {{ programs_node_bin }}/gulp css
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   when: not devstack
 
 - name: run r.js optimizer
   shell: >
     chdir={{ programs_code_dir }}
     . {{ programs_nodeenv_bin }}/activate && {{ programs_node_bin }}/r.js -o build.js
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   when: not devstack
 
 - name: run collectstatic
   shell: >
     chdir={{ programs_code_dir }}
     {{ programs_venv_dir }}/bin/python manage.py {{ item }}
-  sudo_user: "{{ programs_user }}"
+  become_user: "{{ programs_user }}"
   environment: "{{ programs_environment }}"
   with_items:
     - "collectstatic --noinput"
@@ -157,4 +157,4 @@
     config: "{{ supervisor_cfg }}"
     name: "{{ programs_service_name }}"
   when: not disable_edx_services
-  sudo_user: "{{ supervisor_service_user }}"
+  become_user: "{{ supervisor_service_user }}"

playbooks/roles/rbenv/tasks/main.yml

@@ -66,7 +66,7 @@
     repo=https://github.com/sstephenson/rbenv.git
     dest={{ rbenv_dir }}/.rbenv version={{ rbenv_version }}
     accept_hostkey=yes
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   tags:
     - install
     - install:base
@@ -74,7 +74,7 @@
 - name: ensure ruby_env exists
   template: >
     src=ruby_env.j2 dest={{ rbenv_dir }}/ruby_env
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   tags:
     - install
     - install:base
@@ -100,7 +100,7 @@
 - name: create temporary directory
   command: mktemp -d
   register: tempdir
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   when: rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers)
   tags:
     - install
@@ -111,7 +111,7 @@
     repo=https://github.com/sstephenson/ruby-build.git dest={{ tempdir.stdout }}/ruby-build
     accept_hostkey=yes
   when: tempdir.stdout is defined and (rbuild_present|failed or (installable_ruby_vers is defined and rbenv_ruby_version not in installable_ruby_vers))
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   tags:
     - install
     - install:base
@@ -133,7 +133,7 @@
 - name: check ruby {{ rbenv_ruby_version }} installed
   shell: "rbenv versions | grep {{ rbenv_ruby_version }}"
   register: ruby_installed
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   ignore_errors: yes
   tags:
@@ -143,7 +143,7 @@
 - name: install ruby {{ rbenv_ruby_version }}
   shell: "rbenv install {{ rbenv_ruby_version }} creates={{ rbenv_dir }}/.rbenv/versions/{{ rbenv_ruby_version }}"
   when: ruby_installed|failed
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   tags:
     - install
@@ -151,7 +151,7 @@
 
 - name: set global ruby {{ rbenv_ruby_version }}
   shell: "rbenv global {{ rbenv_ruby_version }}"
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   tags:
     - install
@@ -159,7 +159,7 @@
 
 - name: install bundler
   shell: "gem install bundler -v {{ rbenv_bundler_version }}"
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   tags:
     - install
@@ -174,7 +174,7 @@
 
 - name: install rake gem
   shell: "gem install rake -v {{ rbenv_rake_version }}"
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   when: jenkins_worker is not defined or not jenkins_worker
   tags:
@@ -183,7 +183,7 @@
 
 - name: update rubygems
   shell: "gem install rubygems-update && update_rubygems"
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   tags:
     - install
@@ -191,7 +191,7 @@
     
 - name: rehash
   shell: "rbenv rehash"
-  sudo_user: "{{ rbenv_user }}"
+  become_user: "{{ rbenv_user }}"
   environment: "{{ rbenv_environment }}"
   tags:
     - install

playbooks/roles/snort/tasks/main.yml

@@ -25,7 +25,7 @@
 
 - name: update snort
   shell: oinkmaster -C /etc/oinkmaster.conf -o /etc/snort/rules/ 
-  sudo: yes
+  become: yes
 
 - name: snort service 
   service: >

playbooks/roles/supervisor/tasks/main.yml

@@ -116,7 +116,7 @@
     virtualenv: "{{ supervisor_venv_dir }}"
     state: present
     extra_args: "-i {{ COMMON_PYPI_MIRROR_URL }}"
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   tags:
     - install
     - install:base
@@ -125,7 +125,7 @@
   pip: >
     name={{ item }} virtualenv="{{ supervisor_venv_dir }}" state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   with_items: supervisor_pip_pkgs
   tags:
     - install

playbooks/roles/tanaguru/tasks/main.yml

@@ -68,7 +68,7 @@
     src: xvfb.j2
     owner: root
     group: root
-    mode: 755
+    mode: 0755
   register: xvfb
   tags:
     - install

playbooks/roles/test_build_server/tasks/main.yml

@@ -25,7 +25,7 @@
     repo=https://github.com/edx/edx-platform.git
     dest={{ test_build_server_repo_path }}/edx-platform-clone
     version={{ test_edx_platform_version }}
-  sudo_user: "{{ test_build_server_user }}"
+  become_user: "{{ test_build_server_user }}"
 
 - name: get xargs limit
   shell: "xargs --show-limits"
@@ -40,7 +40,7 @@
   shell: "bash test-development-environment.sh {{ item }}"
   args:
     chdir: "{{ test_build_server_repo_path }}/"
-  sudo_user: "{{ test_build_server_user }}"
+  become_user: "{{ test_build_server_user }}"
   with_items:
     - "unit"
     - "js"

playbooks/roles/testcourses/tasks/deploy.yml

@@ -2,7 +2,7 @@
 - name: import the test courses from github
   shell: >
     {{ demo_edxapp_venv_bin }}/python /edx/bin/manage.edxapp lms git_add_course --settings=aws "{{ item.github_url }}"
-  sudo_user: "{{ common_web_user }}"
+  become_user: "{{ common_web_user }}"
   when: item.install == True
   with_items: TESTCOURSES_EXPORTS
 
@@ -10,7 +10,7 @@
   shell: >
     {{ demo_edxapp_venv_bin }}/python ./manage.py lms --settings=aws --service-variant lms enroll_user_in_course -e {{ item[0].email }} -c {{ item[1].course_id }}
     chdir={{ demo_edxapp_code_dir }}
-  sudo_user: "{{ common_web_user }}"
+  become_user: "{{ common_web_user }}"
   when: item[1].install == True
   with_nested:
     - demo_test_users

playbooks/roles/vhost/tasks/main.yml

@@ -36,5 +36,5 @@
     
 - name: restart ssh
   service: name=ssh state=restarted
-  sudo: True
+  become: True
   when: config_templates.changed

playbooks/roles/xqueue/tasks/deploy.yml

@@ -22,21 +22,21 @@
 - name: "add gunicorn configuration file"
   template: >
     src=xqueue_gunicorn.py.j2 dest={{ xqueue_app_dir }}/xqueue_gunicorn.py
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - install
     - install:configuration
 
 - name: create xqueue application config
   template: src=xqueue.env.json.j2 dest={{ xqueue_app_dir }}/xqueue.env.json mode=0644
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - install
     - install:configuration
 
 - name: create xqueue auth file
   template: src=xqueue.auth.json.j2 dest={{ xqueue_app_dir }}/xqueue.auth.json mode=0644
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - install
     - install:configuration
@@ -46,7 +46,7 @@
   git_2_0_1: >
     dest={{ xqueue_code_dir }} repo={{ xqueue_source_repo }} version={{ xqueue_version }}
     accept_hostkey=yes
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   register: xqueue_checkout
   tags:
     - install
@@ -58,7 +58,7 @@
   pip: >
     requirements="{{ xqueue_pre_requirements_file }}" virtualenv="{{ xqueue_venv_dir }}" state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w"
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - install
     - install:app-requirements
@@ -68,7 +68,7 @@
   pip: >
     requirements="{{ xqueue_post_requirements_file }}" virtualenv="{{ xqueue_venv_dir }}" state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }} --exists-action w"
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - install
     - install:app-requirements
@@ -78,7 +78,7 @@
 - name: migrate
   shell: >
     SERVICE_VARIANT=xqueue {{ xqueue_venv_bin }}/django-admin.py migrate --noinput --settings=xqueue.aws_migrate --pythonpath={{ xqueue_code_dir }}
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   environment:
     DB_MIGRATION_USER: "{{ COMMON_MYSQL_MIGRATE_USER }}"
     DB_MIGRATION_PASS: "{{ COMMON_MYSQL_MIGRATE_PASS }}"
@@ -90,7 +90,7 @@
 - name: create users
   shell: >
     SERVICE_VARIANT=xqueue {{ xqueue_venv_bin }}/django-admin.py update_users --settings=xqueue.aws_settings --pythonpath={{ xqueue_code_dir }}
-  sudo_user: "{{ xqueue_user }}"
+  become_user: "{{ xqueue_user }}"
   tags:
     - manage
     - manage:app-users

playbooks/roles/xqwatcher/tasks/deploy_watcher.yml

@@ -6,8 +6,8 @@
   pip: >
     requirements="{{ xqwatcher_requirements_file }}"
     virtualenv="{{ xqwatcher_app_dir }}/venvs/{{ xqwatcher_service_name }}" state=present
-  sudo: true
-  sudo_user: "{{ xqwatcher_user }}"
+  become: true
+  become_user: "{{ xqwatcher_user }}"
   tags:
     - install
     - install:app-requirements
@@ -56,7 +56,7 @@
     config={{ xqwatcher_supervisor_app_dir }}/supervisord.conf
     name={{ xqwatcher_service_name }}
   when: not disable_edx_services
-  sudo_user: "{{ xqwatcher_user }}"
+  become_user: "{{ xqwatcher_user }}"
   tags:
     - manage
     - manage:update

playbooks/roles/xserver/tasks/deploy.yml

@@ -14,7 +14,7 @@
 - name: "add gunicorn configuration file"
   template: >
     src=xserver_gunicorn.py.j2 dest={{ xserver_app_dir }}/xserver_gunicorn.py
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
   notify:
     - restart xserver
 
@@ -22,7 +22,7 @@
   git_2_0_1: >
     dest={{ xserver_code_dir }} repo={{ xserver_source_repo }} version={{xserver_version}}
     accept_hostkey=yes
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
   register: xserver_checkout
   notify: restart xserver
 
@@ -30,19 +30,19 @@
   pip: >
     requirements="{{ xserver_requirements_file }}" virtualenv="{{ xserver_venv_dir }}" state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
   notify: restart xserver
 
 - name: install sandbox requirements
   pip: >
     requirements="{{ xserver_requirements_file }}" virtualenv="{{ xserver_venv_sandbox_dir }}" state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
   notify: restart xserver
 
 - name: create xserver application config
   template: src=xserver.env.json.j2 dest={{ xserver_app_dir }}/env.json
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
   notify: restart xserver
 
 - name: install read-only ssh key for the content repo that is required for grading
@@ -65,7 +65,7 @@
     GIT_SSH: /tmp/git_ssh.sh
   notify: restart xserver
   register: xserver_grader_checkout
-  sudo_user: "{{ xserver_user }}"
+  become_user: "{{ xserver_user }}"
 
 - name: remove read-only ssh key for the content repo
   file: path={{ xserver_git_identity }} state=absent

playbooks/roles/xsy/tasks/main.yml

@@ -45,7 +45,7 @@
   git_2_0_1: >
     dest="{{ xsy_code_dir }}" repo="{{ xsy_source_repo }}"
     version="{{ xsy_version }}" accept_hostkey=yes
-  sudo_user: "{{ xsy_user }}"
+  become_user: "{{ xsy_user }}"
   register: xsy_checkout
   notify: restart xsy
 
@@ -55,7 +55,7 @@
     virtualenv="{{ xsy_venv_dir }}"
     state=present
     extra_args="-i {{ COMMON_PYPI_MIRROR_URL }}"
-  sudo_user: "{{ xsy_user }}"
+  become_user: "{{ xsy_user }}"
   notify: restart xsy
 
 - name: create the supervisor wrapper
@@ -63,7 +63,7 @@
     src="{{ xsy_supervisor_wrapper|basename }}.j2"
     dest="{{ xsy_supervisor_wrapper }}"
     mode=0755
-  sudo_user: "{{ xsy_user }}"
+  become_user: "{{ xsy_user }}"
   notify: restart xsy
 
 - name: create a supervisor config
@@ -71,7 +71,7 @@
     src=xsy.conf.j2 dest="{{ supervisor_available_dir }}/xsy.conf"
     owner="{{ supervisor_user }}"
     group="{{ supervisor_user }}"
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   notify: restart xsy
 
 - name: enable the supervisor config
@@ -81,7 +81,7 @@
     state=link
     force=yes
     mode=0644
-  sudo_user: "{{ supervisor_user }}"
+  become_user: "{{ supervisor_user }}"
   when: not disable_edx_services
   notify: restart xsy