Avoid conflicting delegation with authorized_keys

When delegating with the authorized_key module, writes of multiple keys
against the same host's file can occur at the same time, leading to
missing keys.[0]

To avoid conflicting delegation between hosts, the registered
'keystone_pubkey' fact now contains a list of SSH keys of all hosts the
current batch of the play, rather than only the key of the current host.
The first host within each batch will handle distribution of that
batch's keys to all hosts within the play.

[0] https://github.com/ansible/ansible/issues/29693

Change-Id: I386e84eba46aa164db22618b7a6ac53b86eeeaf0

tasks/keystone_key_distribute.yml

@@ -17,6 +17,6 @@
   authorized_key:
     user: "{{ keystone_system_user_name }}"
     key: "{{ keystone_pubkey | b64decode }}"
-  when: keystone_pubkey is defined
+  when: inventory_hostname == ansible_play_batch[0]
   delegate_to: "{{ item }}"
   with_items: "{{ ansible_play_hosts }}"

tasks/keystone_key_populate.yml

@@ -21,4 +21,5 @@
 
 - name: Register a fact for the keystone pub key
   set_fact:
-     keystone_pubkey: "{{ keystone_pub.content }}"
+     keystone_pubkey: "{{ ansible_play_batch | map('extract', hostvars, 'keystone_pub') | map(attribute='content') | map('b64decode') | join('\n') | b64encode }}"
+  when: inventory_hostname == ansible_play_batch[0]