Why does Ansible need privilege escalation, and how does it work on RHEL-type systems?

Tasks like installing software need root, but Ansible usually logs in as an ordinary user, so it must "become" root afterwards, by default via sudo. On RHEL 8 and 9, members of the group wheel may use sudo after entering their password.

* Log in as an ordinary user, then become root only for the work that needs it. *

Logging in directly as root over SSH is usually disabled for good reason. So Ansible connects as a normal account and then escalates, exactly as an admin would type sudo dnf install httpd:

• become = true turns escalation on, become_method = sudo picks the mechanism, become_user = root names the target user.
• Who may use sudo is defined on the managed host in /etc/sudoers. RHEL's default line %wheel ALL=(ALL) ALL lets group wheel run any command as anyone, after typing their own password.
• To grant extra users or groups sudo rights, drop a file into /etc/sudoers.d/; it must be owned by root, or sudo ignores it.
• If sudo asks for a password, set become_ask_pass = true so Ansible prompts once at the start.

The commented variant %wheel ALL=(ALL) NOPASSWD: ALL drops the password prompt. That is convenient for automation, but means anyone who gets that account's SSH key is effectively root. Which method to use is a security trade-off each organisation decides for itself.

Go deeper:

• Understanding privilege escalation: become (official docs) — become, become_user, become_method at config, play and task level.
• Sudoers manual (sudo.ws) — the %group host=(runas) commands syntax and NOPASSWD.
• sudo (Wikipedia) — background on sudo and the wheel group.