Setup things so arm03 socs get nopasswd sudo so we don't need 2fa there.

inventory/group_vars/arm-packager

@@ -2,4 +2,5 @@
 fas_client_groups: packager
 freezes: false
 sudoers: "{{ private }}/files/sudo/arm-packager"
+sudoers-main: nopasswd
 host_group: cloud

inventory/group_vars/arm-qa

@@ -2,5 +2,6 @@
 fas_client_groups: sysadmin-qa,arm-qa,qa
 freezes: false
 sudoers: "{{ private }}/files/sudo/arm-qa-sudoers"
+sudoers-main: nopasswd
 libdir: /usr/lib
 host_group: cloud

playbooks/groups/arm-qa.yml

@@ -21,7 +21,6 @@
   # this is how you include other task lists
   - include: "{{ tasks }}/hosts.yml"
   - include: "{{ tasks }}/yumrepos.yml"
-  - include: "{{ tasks }}/2fa_client.yml"
   - include: "{{ tasks }}/motd.yml"
   - include: "{{ tasks }}/sudo.yml"
 

tasks/sudo.yml

@@ -10,6 +10,15 @@
   action: copy src="{{ private }}/files/sudo/sysadmin-main" dest=/etc/sudoers.d/ owner=root group=root mode=0600
   tags:
   - config
+  when: sudoers-main is not defined
+#
+# Put in place the default sysadmin-main sudoers file. (nopasswd edition)
+#
+- name: setup /etc/sudoers.d/sysadmin-main (nopasswd)
+  action: copy src="{{ private }}/files/sudo/sysadmin-main-nopassword" dest=/etc/sudoers.d/ owner=root group=root mode=0600
+  tags:
+  - config
+  when: sudoers-main == 'nopasswd'
 #
 # This will move a /etc/sudoers.d/ file in place 
 #