8 files changed, 32 insertions, 20 deletions
diff --git a/molecule/archlinux/Dockerfile.j2 b/molecule/archlinux/Dockerfile.j2
index b1e8c143..3dc35f2d 100644
--- a/molecule/archlinux/Dockerfile.j2
+++ b/molecule/archlinux/Dockerfile.j2
@@ -18,10 +18,6 @@ RUN (cd /lib/systemd/system/sysinit.target.wants/; \
 # https://gitlab.archlinux.org/archlinux/archlinux-docker/-/issues/59
 RUN cp -r /usr/share/i18n/locales/en_US /usr/share/i18n/locales/de_DE;
 
-# Enable passwordless sudo for test_group (created by the user role)
-RUN echo '%test_group ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/test_group && \
-  chmod 0440 /etc/sudoers.d/test_group
-
 VOLUME ["/sys/fs/cgroup"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/archlinux/converge.yml b/molecule/archlinux/converge.yml
index 408bdd6d..1a29f5a7 100644
--- a/molecule/archlinux/converge.yml
+++ b/molecule/archlinux/converge.yml
@@ -16,6 +16,13 @@
     - role: "user"
     - role: "ssh"
     - role: "password_policy"
+  tasks:
+    - name: "Configure passwordless sudo for testing"
+      ansible.builtin.copy:
+        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/test_group"
+        mode: "0440"
+        validate: 'visudo -cf %s'
 
 - name: "Configure"
   hosts: "archlinux"
@@ -24,7 +31,7 @@
   environment:
     PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
   vars:
-    ansible_become_method: su
+    ansible_become_method: sudo
     locales:
       - "en_US.UTF-8 UTF-8"
     timezone: "GMT"
diff --git a/molecule/debian/Dockerfile.j2 b/molecule/debian/Dockerfile.j2
index 3a5642a9..2e047439 100644
--- a/molecule/debian/Dockerfile.j2
+++ b/molecule/debian/Dockerfile.j2
@@ -20,10 +20,6 @@ RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
 RUN systemctl enable avahi-daemon \
     && touch /etc/locale.gen
 
-# Enable passwordless sudo for test_group (created by the user role)
-RUN echo '%test_group ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/test_group && \
-  chmod 0440 /etc/sudoers.d/test_group
-
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/debian/converge.yml b/molecule/debian/converge.yml
index 7fcfbce6..86e9e059 100644
--- a/molecule/debian/converge.yml
+++ b/molecule/debian/converge.yml
@@ -16,6 +16,13 @@
     - role: "user"
     - role: "ssh"
     - role: "password_policy"
+  tasks:
+    - name: "Configure passwordless sudo for testing"
+      ansible.builtin.copy:
+        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/test_group"
+        mode: "0440"
+        validate: 'visudo -cf %s'
 
 - name: "Configure"
   hosts: "debian"
@@ -24,7 +31,7 @@
   environment:
     PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
   vars:
-    ansible_become_method: su
+    ansible_become_method: sudo
     locales:
       - "en_US.UTF-8 UTF-8"
     timezone: "GMT"
diff --git a/molecule/raspberrypi/Dockerfile.j2 b/molecule/raspberrypi/Dockerfile.j2
index 51d6b0dd..b65d05ae 100644
--- a/molecule/raspberrypi/Dockerfile.j2
+++ b/molecule/raspberrypi/Dockerfile.j2
@@ -20,10 +20,6 @@ RUN rm -f /lib/systemd/system/multi-user.target.wants/getty.target
 RUN systemctl enable avahi-daemon \
     && touch /etc/locale.gen
 
-# Enable passwordless sudo for test_group (created by the user role)
-RUN echo '%test_group ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/test_group && \
-  chmod 0440 /etc/sudoers.d/test_group
-
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/raspberrypi/converge.yml b/molecule/raspberrypi/converge.yml
index e308f332..ddaaede9 100644
--- a/molecule/raspberrypi/converge.yml
+++ b/molecule/raspberrypi/converge.yml
@@ -16,6 +16,13 @@
     - role: "user"
     - role: "ssh"
     - role: "password_policy"
+  tasks:
+    - name: "Configure passwordless sudo for testing"
+      ansible.builtin.copy:
+        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/test_group"
+        mode: "0440"
+        validate: 'visudo -cf %s'
 
 - name: "Configure"
   hosts: "raspberrypi"
@@ -24,7 +31,7 @@
   environment:
     PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
   vars:
-    ansible_become_method: su
+    ansible_become_method: sudo
     locales:
       - "en_US.UTF-8 UTF-8"
     timezone: "GMT"
diff --git a/molecule/ubuntu/Dockerfile.j2 b/molecule/ubuntu/Dockerfile.j2
index 4c8e5c8c..64070d4d 100644
--- a/molecule/ubuntu/Dockerfile.j2
+++ b/molecule/ubuntu/Dockerfile.j2
@@ -25,10 +25,6 @@ RUN rm -f /lib/systemd/system/getty.target
 # Mimic Ubuntu OS default boot (for testing)
 RUN systemctl enable avahi-daemon
 
-# Enable passwordless sudo for test_group (created by the user role)
-RUN echo '%test_group ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/test_group && \
-  chmod 0440 /etc/sudoers.d/test_group
-
 VOLUME ["/sys/fs/cgroup", "/tmp", "/run", "/opt"]
 
 CMD ["/lib/systemd/systemd"]
diff --git a/molecule/ubuntu/converge.yml b/molecule/ubuntu/converge.yml
index 1052b483..92e3c12a 100644
--- a/molecule/ubuntu/converge.yml
+++ b/molecule/ubuntu/converge.yml
@@ -16,6 +16,13 @@
     - role: "user"
     - role: "ssh"
     - role: "password_policy"
+  tasks:
+    - name: "Configure passwordless sudo for testing"
+      ansible.builtin.copy:
+        content: "%test_group ALL=(ALL) NOPASSWD: ALL\n"
+        dest: "/etc/sudoers.d/test_group"
+        mode: "0440"
+        validate: 'visudo -cf %s'
 
 - name: "Configure"
   hosts: "ubuntu"
@@ -24,7 +31,7 @@
   environment:
     PATH: "{{ ansible_env.HOME }}/.local/bin:{{ ansible_env.PATH }}"
   vars:
-    ansible_become_method: su
+    ansible_become_method: sudo
     locales:
       - "en_US.UTF-8 UTF-8"
     timezone: "GMT"