Get sudoers file instantly work after reboot in Ubuntu 20.04

Question

I'm trying to execute an ansible command as a user-level cron job which looks as follows:

@reboot /home/jon/.local/bin/ansible-playbook /home/jon/deactivate.yml where deactivate.yml is doing something which is going to need root privileges. Consequently I've edited my sudoers file via sudo visudo to look like this, in order to execute the command without the need to pass the sudo password:

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

jon ALL=(root) NOPASSWD: /home/jon/.local/bin/ansible-playbook /home/jon/deactivate_proxy.yml` 

After adding this to the sudoers file, the user jon is able to execute the command succesfully. When doing a reboot, the cron job isnt executed succesfully. Moreover, I'm not able to execute the command itself after performing a reboot as I get warned that the sudo password is required. However, when executing another command with sudo (like sudo visudo or sudo -i) and passing the correct credentials, I'm able to execute the former command. It seems like the line I've added to the sudoers file only works after passing the sudo password at any time before executing my ansible-playbook command.

What is the reason for this behavior? What can I do to successfully execute my command after a reboot?

Edit: the user jon is part of the group sudo.

Answer 1

This is not enough

jon ALL=(root) NOPASSWD: /home/jon/.local/bin/ansible-playbook playbook.yml

Quoting from Can’t limit escalation to certain commands:

Privilege escalation permissions have to be general. ...

Fix sudoers, e.g.

jon ALL=NOPASSWD: ALL