Search code examples
ansiblesudoaws-cloudformation

ansible sudo: sorry, you must have a tty to run sudo


I need to run playbooks on Vagrant boxes and on aws when I setup environment with cloud formation.

In Vagrant file I use ansible-local and everything works fine

name: Setup Unified Catalog Webserver  
    hosts: 127.0.0.1  
    connection: local  
  become: yes  
  become_user: root
  roles: generic

However when I create instance in AWS the ansible playbook fails with error:
sudo: sorry, you must have a tty to run sudo
This happen because it is run as root and it doesnt have tty. But I dont know how to fix it without making change in /etc/sudoers to allow !requiretty

Is there any flags I can setup in ansible.cfg or in my Cloud Formation template?

  "#!/bin/bash\n", "\n", "   
 echo 'Installing Git'\n","  
  yum --nogpgcheck -y install git ansible htop nano wget\n",
 "wget https://s3.eu-central-1.amazonaws.com/XXX -O /root/.ssh/id_rsa\n", 
"chmod 600 /root/.ssh/id_rsa\n", 
"ssh-keyscan 172.31.7.235 >> /root/.ssh/known_hosts\n",
 "git clone [email protected]:something/repo.git /root/repo\n", 
"ansible-playbook /root/env/ansible/test.yml\n

Solution

  • I have found the following solutions for myself:
    1. Change requiretty in /etc/sudoers with sed run playbooks and change it back.

     "#!/bin/bash\n", "\n", "  
     echo 'Installing Git'\n"," 
     yum --nogpgcheck -y install git ansible htop nano wget\n",  
     "wget https://s3.eu-central-1.amazonaws.com/xx/ansible -O /root/.ssh/id_rsa\n",  
     "chmod 600 /root/.ssh/id_rsa\n",   
      "ssh-keyscan 172.31.9.231 >> /root/.ssh/known_hosts\n",   
      "git clone [email protected]:somerepo/dev.git /root/dev\n",   
      "sed -i 's/Defaults    requiretty/Defaults    !requiretty/g' /etc/sudoers\n", 
      "\n", 
      "ansible-playbook /root/dev/env/ansible/uk.yml\n",   
      "\n",   
      "sed -i 's/Defaults    !requiretty/Defaults    requiretty/g' /etc/sudoers\n"   
    

    OR 2. In ansible playbook specify variable:

     - name: Setup 
     hosts: 127.0.0.1
     connection: local
     sudo: {{ require_sudo }}
     roles:
        - generic
    

    Run in AWS Cloud Formation template would be

       "ansible-playbook -e require_sudo=False /root/dev/env/ansible/uk.yml\n"  
    

    And for Vagrant in ansible.cfg it can be specified

      require_sudo=True
    
    1. Also in CF template may identify who is running and the pass variable

      ansible-playbook -e$(id -u |egrep '^0$' > /dev/null && require_sudo=False || require_sudo=True; echo "require_sudo=$require_sudo") /apps/ansible/uk.yml