title: Ansible: how to run a play with hosts with different passwords?
body: <p>I'm currently learning how to use Ansible. Right now, I've got a bunch of servers, both new and legacy, that have different logins or passwords or both. All have key access to run the plays.</p>
  
  <p>Here's what I started with.  Example <strong>hosts</strong> file:</p>
  
  <pre><code># legacy and new have different logins (like root and deploy)
  [legacy]
  serv1
  serv2
  
  [new]
  serv3
  serv4
  
  # different has a different login and password altogether
  [different]
  serv5
  </code></pre>
  
  <p>So to keep things simple, I originally had a playbook run the equivalent of <code>sudo apt-get update &amp;&amp; sudo apt-get upgrade</code> on all the machines, but because of the different login/passwd, I had created multiple playbooks for each host. But now I want to DRY it out and am looking at Roles, per their docs.</p>
  
  <p>Right now I have something like this. The test/roles/common/tasks/main.yml file:</p>
  
  <pre><code>---
  - name: run apt-get update
    apt: update_cache=yes
  - name: run apt-get upgrade
    apt: upgrade=yes
  </code></pre>
  
  <p>The site.yml file:</p>
  
  <pre><code>- name: apply common configuration to all nodes
    hosts: all
  
    roles:
    - common
  </code></pre>
  
  <p>I understand that I can actually define the different logins with <code>ansible_ssh_user=root</code> or <code>...=deploy</code> in my hosts file. Or put them in group vars. But what do I do about the different sudo passwords? <code>[legacy]</code> is root so I don't need <code>sudo</code>, but <code>[new]</code> and <code>[different]</code> need it, and have different passwords.  How do I do this?  Group vars?  Do I create these: test/group_vars/new/some_file_with_a_passwd.yml and test/group_vars/different/some_other_passwd.yml (ignoring security issues)?  </p>
  
  <p>How does the site.yml recognize that there are hosts with different passwords or some hosts with no passwords?</p>
  
  <p>Edit for clarity's sake: I have SSH access, so doing the 'pre-tasks' step during the play always work (I connect via key access and never via a password). I'm not worried about security as that's the next step. For now, I want to get the group_vars thing right....It's the <code>sudo</code> escalation I have issues with. E.g. serv1 sudo might be root/password1, serv3 sudo: deploy/password2, serv5: anotherdeploy/password3</p>