Ansible "Missing sudo password" in CI

A task escalated with become and sudo on the target requires a password, but the run was started without one (no -K, no ansible_become_pass). Ansible reports "Missing sudo password" and the task fails immediately.

What this error means

An escalated task fails with "FAILED! => ... Missing sudo password" or "sudo: a password is required". Non-escalated tasks on the same host still run.

ansible

fatal: [app1]: FAILED! => {"msg": "Missing sudo password"}

Common causes

No become password passed to a non-interactive run

CI runs non-interactively, so the -K prompt cannot be answered and no ansible_become_pass was set, leaving sudo without a password.

The target account is not passwordless for sudo

sudoers requires a password for this user, so any escalated task needs one supplied explicitly.

How to fix it

Pass the become password non-interactively

Provide ansible_become_pass from a secret instead of the interactive -K prompt, which cannot work in CI.

.github/workflows/ci.yml

ansible-playbook -i inventory site.yml \
  -e "ansible_become_pass=${{ secrets.SUDO_PASS }}"

Configure passwordless sudo on the target

Grant the deploy user NOPASSWD sudo so escalated tasks need no password at all.

sudoers

deploy ALL=(ALL) NOPASSWD: ALL

How to prevent it

Never rely on the interactive -K prompt in CI.
Pass ansible_become_pass from a secret when sudo needs a password.
Prefer NOPASSWD sudo for automation accounts where allowed.