ansible - Repo will not clone, "Permission Denied", using git module -

i've looked @ similar questions, not found answer yet.

i can ssh in server (ubuntu 16.04) , clone git repo manually. leaves me believe isn't sshforwardagent issue.

the error pretty typical:

"cloning bare repository '/home/deploy/apps/myproject/production/cached-copy'...",  "permission denied (publickey).",  "fatal: not read remote repository.", 

ansible.cnf:

[ssh_connection] ssh_args = -o forwardagent=yes 

the role looks this:

- name: update bare git repository   become_user: "{{ deploy_user }}"   git:     repo: "git@github.com:myuser/myproject.git"     dest: "{{ deploy_to }}/cached-copy"     version: "{{ branch }}"     bare: yes     update: yes     accept_hostkey: yes     ssh_opts: "-o stricthostkeychecking=no -o forwardagent=yes" 

the verbose output ansible is:

"changed": false,  "cmd": "/usr/bin/git clone --bare '' /home/deploy/apps/myproject/production/cached-copy",  "failed": true,  "invocation": { "module_args": { "accept_hostkey": true,  "bare": true,  "clone": true,  "depth": null,  "dest": "/home/deploy/apps/myproject/production/cached-copy",  "executable": null,  "force": false,  "key_file": null,  "recursive": true,  "reference": null,  "refspec": null,  "remote": "origin",  "repo": "git@github.com:myuser/myproject.git",  "ssh_opts": "-o stricthostkeychecking=no -o forwardagent=yes",  "track_submodules": false,  "umask": null,  "update": true,  "verify_commit": false,  "version": "master" 

use of myuser , myproject retract such information.

one thing looks suspect cmd not contain repo url, normal?

if change -o forwardagent=yes -a different error: timeout (12s) waiting privilege escalation prompt.

also know agentforward working because if ssh in server , ssh -t git@github.com expected "you've authenticated, github not provide shell access.".

please note not want install private key on server.

update: here gist of verbose output: https://gist.github.com/krisleech/8bfbf817c237258a672b3b3393fea8dd

on other hand seems work fine:

- name: "test github"   command: ssh -t git@github.com 

from verbose output see that:

• first, ssh remote box admin user , forwardagent=yes
• then, sudo deploy run ansible task (git module)

this scenario described in comments, when doing sudo (with usual settings) disable ssh agent access.

to make work, either need ssh deploy user directly (and not admin->deploy), or setup sudo on destination box allow keeping environment variables, see this answer details.

add defaults env_keep+=ssh_auth_sock sudoers