Terraform: Add support to remote-exec for calls with "sudo" mode

[cbrinker]

I am coming to terraform from an ansible background. Ansible has a really slick way of specifying certain actions/scripts that need to be run with elevated privileges that the ssh client doesn't have by default. You can see a nice example at:

http://docs.ansible.com/playbooks_intro.html

- hosts: webservers
  remote_user: yourname
  sudo: yes
  sudo_user: postgres

I have many commands that I need to run as root (at least until I get Packer to pre-run these into images) The only way I can convince remote-exec to run all commands with root privs via sudo is something like this:

#!/bin/bash
sudo -s "
echo 'something' >>/etc/hosts
 ... many more things ...
"

but the downside of this technique are that I don't get to see the STDOUT of the commands being executed also I feel like this is the first steps down into shell quoting hell.

Is there an easier way to do what I need with the existing remote-exec? or is it trivial to add a sudo/sudo_user attribute to remote-exec?

Thanks,
Chris

[clstokes]

:+1:

I would like this as well.

[phobos182]

+1 on this request. Currently I am adding 'sudo' to each line.

[tomhogans]

+1 as well.

[OleksandrBerchenko]

I would like this as well.

[comerford]

:+1:

[apparentlymart]

@cbrinker in most cases writing "sudo" on the front of the command would work, but I notice this case is trickier because you're using I/O redirection, and so it's actually the non-root shell that's dealing with that interpolation. As a workaround in a couple places I use sudo bash -c ... but that's not too different than the workaround you mentioned.

So it looks like the subtlety of this request, that makes it different than just putting sudo on each line, is that you want the shell itself to be run under sudo, effectively having Terraform internally run sudo bash -c ....

[billf]

packer has an elegant way of handling this via execute_command attribute
https://www.packer.io/docs/provisioners/shell.html

it would be nice to lift some of the attributes from packer's shell provisioners for terraform's remote-exec.

[jumping]

:+1:

[gservat]

:+1:

[cmosetick]

@bliff That idea sounds good to me. :+1:

[Shruti29]

👍

[chris-redekop]

:+1:

[emptyhammond]

👍

[AlexShemeshWix]

+1

[agsmith]

👍

[terminalninja]

👍

[dimon222]

:thumbsup:

[saurabh-hirani]

👍

[gordcorp]

👍

[ghovat]

+1

[brendandebeasi]

plus one

[dot1q]

+1

[giladsh1]

+1

[rooty0]

👍

[vahubert]

+1

[mildwonkey]

Hi folks 👋 ! Thanks for the interest in this feature request.

Please do not post "+1" comments here, since it creates noise for others watching the issue and ultimately doesn't influence our prioritization because we can't actually report on these. Instead, react to the original issue comment with 👍, which we can and do report on during prioritization.

Thanks, and keep those 👍 coming!

[queglay]

yes, I would like to add that it would be helpful if support is added for sudo -i to get the root shell. this currently seems to hang my remote-exec calls.

[racbart]

There is a workaround which you can use until sudo support is implemented in remote-exec. Add this at the beginning of your script (it assumes bash) instead of sudo -i:

if [[ $EUID -ne 0 ]]; then
    sudo $(realpath "$0")
    exit
fi

It re-executes itself with sudo if the script was run by non-root user.

[sticky-note]

@racbart Thanks for the tips. Need to add "$@" to re-pass args on it too.
Here is a dash version of your solution. What do you think of it?

#!/bin/sh
if [ $(id -u) != 0 ]; then
  sudo -i $(realpath "$0") "$@"
  exit
fi