To run privileged tasks without resorting to passwordless-sudo (NOPASSWD),
you can use the libpam ssh_agent_auth module to authenticate based on SSH public
keys in a separate authorized keys file.
This module requires SSH connections to be made with the -A command line option, or the
ForwardAgent yes config option. You also need a local SSH agent running with the required key added.
I've presented this as an Ansible playbook + variables as it's a useful application