1. make an user with sudo privs on the hosts.
2. in /etc/ansible/group_vars/all (if this apply to all hosts)
 ansible_user: ansible_user
 ansible_become: True
 ansible_become_pass: super-sercret-password
3. encrypt with vault (not done yet, only in test)
4. in /etc/ansible/ansible.cfg
[defaults]
private_key_file = /etc/ansible/keys/id_rsa
retry_files_save_path = /tmp/.ansible/
[ssh_connection]
control_path_dir = /tmp/.ansible/cp