From d945d88b5d79ac1f5a7159a0266623af6b7a6bf4 Mon Sep 17 00:00:00 2001 From: chrisfu Date: Wed, 27 May 2026 21:10:26 -0700 Subject: [PATCH] =?UTF-8?q?fix(ansible):=20workstations=20group=20vars=20?= =?UTF-8?q?=E2=80=94=20become=5Fask=5Fpass=20+=20no=20pipelining?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Personal Macs require a sudo password; the global become_ask_pass=False and pipelining=True combination silently swallows the prompt and fails. - ansible_become_ask_pass: true → Ansible prompts for sudo password - ansible_pipelining: false → sudo can read stdin for the password; pipelining replaces stdin with a pipe which sudo treats as non-interactive and refuses to ask for a password at all. Applies to [workstations] group (mac + linux). Has no effect on [workstations_windows] (WinRM auth is separate from become). Co-Authored-By: Claude Sonnet 4.6 --- .../inventory/group_vars/workstations.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 infrastructure/inventory/group_vars/workstations.yml diff --git a/infrastructure/inventory/group_vars/workstations.yml b/infrastructure/inventory/group_vars/workstations.yml new file mode 100644 index 0000000..b58e41c --- /dev/null +++ b/infrastructure/inventory/group_vars/workstations.yml @@ -0,0 +1,13 @@ +# Workstation-specific Ansible connection overrides. +# +# Servers (k3s nodes, VMs) run passwordless sudo and have pipelining=True +# in ansible.cfg for performance. Personal Macs/Linux workstations: +# 1. Require a sudo password (become_ask_pass: true) +# 2. Cannot use SSH pipelining with password-based sudo — pipelining +# replaces stdin with a pipe, which sudo interprets as a non-interactive +# session and refuses to prompt for a password. +# +# ansible_become_ask_pass applies to macOS/Linux (ssh + local connections). +# It is silently ignored for Windows WinRM targets in workstations_windows. +ansible_become_ask_pass: true +ansible_pipelining: false