Fix linters and metadata

With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Depends-On: https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/888223
Change-Id: Id92330b3c709201a74612c8353cefa75778eac0c

defaults/main.yml

@@ -20,7 +20,11 @@ debug: False
 # for the service setup. The host must already have
 # clouds.yaml properly configured.
 keystone_service_setup_host: "{{ openstack_service_setup_host | default('localhost') }}"
-keystone_service_setup_host_python_interpreter: "{{ openstack_service_setup_host_python_interpreter | default((keystone_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable'])) }}"
+keystone_service_setup_host_python_interpreter: >-
+  {{
+    openstack_service_setup_host_python_interpreter | default(
+      (keystone_service_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable']))
+  }}
 
 # Set the package install state for distribution packages
 # Options are 'present' and 'latest'
@@ -39,7 +43,8 @@ keystone_shibboleth_repo: {}
 
 keystone_git_repo: https://opendev.org/openstack/keystone
 keystone_git_install_branch: master
-keystone_upper_constraints_url: "{{ requirements_git_url | default('https://releases.openstack.org/constraints/upper/' ~ requirements_git_install_branch | default('master')) }}"
+keystone_upper_constraints_url: >-
+  {{ requirements_git_url | default('https://releases.openstack.org/constraints/upper/' ~ requirements_git_install_branch | default('master')) }}
 keystone_git_constraints:
   - "--constraint {{ keystone_upper_constraints_url }}"
 
@@ -97,13 +102,19 @@ keystone_bind_address: "{{ openstack_service_bind_address | default('0.0.0.0') }
 
 ## Database info
 keystone_db_setup_host: "{{ openstack_db_setup_host | default('localhost') }}"
-keystone_db_setup_python_interpreter: "{{ openstack_db_setup_python_interpreter | default((keystone_db_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable'])) }}"
+keystone_db_setup_python_interpreter: >-
+  {{
+    openstack_db_setup_python_interpreter | default(
+      (keystone_db_setup_host == 'localhost') | ternary(ansible_playbook_python, ansible_facts['python']['executable']))
+  }}
 keystone_galera_address: "{{ galera_address | default('127.0.0.1') }}"
 keystone_galera_user: keystone
 keystone_galera_database: keystone
 keystone_galera_port: "{{ galera_port | default('3306') }}"
 keystone_database_connection_string: >-
-  mysql+pymysql://{{ keystone_galera_user }}:{{ keystone_container_mysql_password }}@{{ keystone_galera_address }}:{{keystone_galera_port}}/{{ keystone_galera_database }}?charset=utf8{% if keystone_galera_use_ssl | bool %}&ssl_verify_cert=true{% if keystone_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ keystone_galera_ssl_ca_cert }}{% endif %}{% endif %}
+  mysql+pymysql://{{ keystone_galera_user }}:{{ keystone_container_mysql_password }}@{{ keystone_galera_address }}:{{ keystone_galera_port }}/{{
+    keystone_galera_database }}?charset=utf8{% if keystone_galera_use_ssl | bool %}&ssl_verify_cert=true{%
+      if keystone_galera_ssl_ca_cert | length > 0 %}&ssl_ca={{ keystone_galera_ssl_ca_cert }}{% endif %}{% endif %}
 ## Database SSL
 keystone_galera_use_ssl: "{{ galera_use_ssl | default(False) }}"
 keystone_galera_ssl_ca_cert: "{{ galera_ssl_ca_cert | default('') }}"
@@ -131,7 +142,8 @@ keystone_oslomsg_rpc_ssl_ca_file: "{{ oslomsg_rpc_ssl_ca_file | default('') }}"
 
 # Notify
 keystone_oslomsg_notify_host_group: "{{ oslomsg_notify_host_group | default('rabbitmq_all') }}"
-keystone_oslomsg_notify_setup_host: "{{ (keystone_oslomsg_notify_host_group in groups) | ternary(groups[keystone_oslomsg_notify_host_group][0], 'localhost') }}"
+keystone_oslomsg_notify_setup_host: >-
+  {{ (keystone_oslomsg_notify_host_group in groups) | ternary(groups[keystone_oslomsg_notify_host_group][0], 'localhost') }}
 keystone_oslomsg_notify_transport: "{{ oslomsg_notify_transport | default('rabbit') }}"
 keystone_oslomsg_notify_servers: "{{ oslomsg_notify_servers | default('127.0.0.1') }}"
 keystone_oslomsg_notify_port: "{{ oslomsg_notify_port | default('5672') }}"
@@ -244,7 +256,8 @@ keystone_pki_setup_host: "{{ openstack_pki_setup_host | default('localhost') }}"
 keystone_pki_keys_path: "{{ keystone_pki_dir ~ '/certs/private/' }}"
 keystone_pki_certs_path: "{{ keystone_pki_dir ~ '/certs/certs/' }}"
 keystone_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name }}"
-keystone_pki_intermediate_cert_path: "{{ keystone_pki_dir ~ '/roots/' ~ keystone_pki_intermediate_cert_name ~ '/certs/' ~ keystone_pki_intermediate_cert_name ~ '.crt' }}"
+keystone_pki_intermediate_cert_path: >-
+  {{ keystone_pki_dir ~ '/roots/' ~ keystone_pki_intermediate_cert_name ~ '/certs/' ~ keystone_pki_intermediate_cert_name ~ '.crt' }}
 keystone_pki_regen_cert: ''
 
 # By default, CA creation is controlled using the CA 'condition' field
@@ -322,9 +335,11 @@ keystone_pki_install_certificates:
 
 keystone_ssl_protocol: "{{ ssl_protocol | default('ALL -SSLv2 -SSLv3 -TLSv1 -TLSv1.1') }}"
 # TLS v1.2 and below
-keystone_ssl_cipher_suite_tls12: "{{ keystone_ssl_cipher_suite | default(ssl_cipher_suite_tls12 | default('ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM')) }}"
+keystone_ssl_cipher_suite_tls12: >-
+  {{ keystone_ssl_cipher_suite | default(ssl_cipher_suite_tls12 | default('ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES256:ECDH+AES128:!aNULL:!SHA1:!AESCCM')) }}
 # TLS v1.3
-keystone_ssl_cipher_suite_tls13: "{{ ssl_cipher_suite_tls13 | default('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256') }}"
+keystone_ssl_cipher_suite_tls13: >-
+  {{ ssl_cipher_suite_tls13 | default('TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256') }}
 
 # Set these variables to deploy custom certificates
 # keystone_user_ssl_cert: <path to cert on ansible deployment host>
@@ -370,7 +385,6 @@ keystone_ldap: {}
 keystone_ldap_domain_config_dir: /etc/keystone/domains
 
 
-
 ## Policy vars
 # Provide a list of access controls to update the default policy.json with. These changes will be merged
 # with the access controls in the default policy.json. E.g.
@@ -581,7 +595,7 @@ keystone_optional_oslomsg_amqp1_pip_packages:
 #                  template engine and copied to the target host.
 # keystone_sso_callback_file_path: "/etc/openstack_deploy/keystone/sso_callback_template.html"
 
-#: Tunable file-based overrides
+## Tunable file-based overrides
 # The contents of these files, if they exist, are read from the
 # specified path on the deployment host, interpreted by the
 # template engine and copied to the target host. If they do
@@ -589,7 +603,7 @@ keystone_optional_oslomsg_amqp1_pip_packages:
 shibboleth_cert_user_file_path: "/etc/openstack_deploy/keystone/sp-cert.pem"
 shibboleth_key_user_file_path: "/etc/openstack_deploy/keystone/sp-key.pem"
 
-#: Tunable var-based overrides
+## Tunable var-based overrides
 # The contents of these are templated over the default files.
 keystone_keystone_conf_overrides: {}
 keystone_keystone_default_conf_overrides: {}

handlers/main.yml

@@ -101,6 +101,7 @@
       debian: nc -q 1 $(awk '/^\-l/ {print $2}' "/etc/memcached.conf" | awk -F, '{print $1}') $(awk '/^\-p/ {print $2}' "/etc/memcached.conf")
       redhat: nc $(awk -F '-l' '/^OPTIONS/ {print $2}' "/etc/sysconfig/memcached" | awk -F ',' '{gsub(/"/, "", $1); print $1}' | awk -F '-' '{print $1}') 11211
   shell: "echo 'flush_all' | {{ nc_command.get(ansible_facts['os_family'] | lower) }}"
+  changed_when: false
   delegate_to: "{{ item }}"
   with_items: "{{ groups.memcached_all }}"
   listen: flush cache

meta/main.yml

@@ -18,19 +18,21 @@ galaxy_info:
   description: Installation and setup of keystone
   company: Rackspace
   license: Apache2
-  min_ansible_version: 2.4
+  role_name: os_keystone
+  namespace: openstack
+  min_ansible_version: "2.10"
   platforms:
     - name: Debian
       versions:
-        - buster
+        - bullseye
     - name: Ubuntu
       versions:
-        - bionic
         - focal
+        - jammy
     - name: EL
       versions:
-        - 8
+        - "9"
-  categories:
+  galaxy_tags:
     - cloud
     - python
     - keystone

tasks/keystone_apache.yml

@@ -31,6 +31,7 @@
     state: directory
     owner: "{{ keystone_apache_default_log_owner }}"
     group: "{{ keystone_apache_default_log_grp }}"
+    mode: "0755"
 
 ## NOTE(cloudnull):
 ## Module enable/disable process is only functional on Debian
@@ -51,6 +52,7 @@
     dest: "{{ item.dest }}"
     owner: "root"
     group: "root"
+    mode: "0644"
   with_items: "{{ keystone_apache_configs }}"
   notify:
     - Restart web server

tasks/keystone_credential.yml

@@ -13,10 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- include_tasks: keystone_credential_create.yml
+- name: Including keystone_credential_create tasks
+  include_tasks: keystone_credential_create.yml
   when: _keystone_is_first_play_host
 
-- include_tasks: keystone_credential_distribute.yml
+- name: Including keystone_credential_distribute tasks
+  include_tasks: keystone_credential_distribute.yml
   when: _keystone_is_first_play_host
 
-- include_tasks: keystone_credential_autorotate.yml
+- name: Including keystone_credential_autorotate tasks
+  include_tasks: keystone_credential_autorotate.yml

tasks/keystone_credential_create.yml

@@ -70,7 +70,7 @@
   register: drop_existing_credential_keys
   with_indexed_items: "{{ collected_existing_credential_keys.results | map(attribute='content') | list | unique }}"
 
-- name: Create credential keys for Keystone
+- name: Create credential keys for Keystone # noqa: no-changed-when
   command: >
     {{ keystone_bin }}/keystone-manage credential_setup
                                        --keystone-user "{{ keystone_system_user_name }}"
@@ -82,7 +82,7 @@
     - not _credential_keys.stat.exists
     - not drop_existing_credential_keys  is changed
 
-- name: Ensure newest key is used for credential in Keystone
+- name: Ensure newest key is used for credential in Keystone # noqa: no-changed-when
   command: >
     {{ keystone_bin }}/keystone-manage credential_migrate
                                        --keystone-user "{{ keystone_system_user_name }}"
@@ -91,7 +91,7 @@
   become_user: "{{ keystone_system_user_name }}"
   when: create_credential_keys is skipped
 
-- name: Rotate credential keys for Keystone
+- name: Rotate credential keys for Keystone # noqa: no-changed-when
   command: >
     {{ keystone_bin }}/keystone-manage credential_rotate
                                        --keystone-user "{{ keystone_system_user_name }}"

tasks/keystone_db_sync.yml

@@ -28,6 +28,7 @@
     section: keystone
     option: "{{ item.name }}"
     value: "{{ item.state }}"
+    mode: "0644"
   with_items:
     - name: "need_db_expand"
       state: "{{ (keystone_db_sync_check.rc | int == 2) | bool }}"
@@ -46,7 +47,7 @@
 # When keystone is initially built, the service does not yet exist on the
 # host this task is executed on. Detect the presence of the services.
 - name: Test if keystone service exists
-  service:
+  service: # noqa: args[module]
     name: "{{ item }}"
   check_mode: yes
   register: keystone_service_exists
@@ -70,6 +71,7 @@
 
 - name: Perform a Keystone DB sync expand
   command: "{{ keystone_bin }}/keystone-manage db_sync --expand"
+  changed_when: false
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   when:
@@ -79,6 +81,7 @@
 
 - name: Perform a Keystone DB sync migrate
   command: "{{ keystone_bin }}/keystone-manage db_sync --migrate"
+  changed_when: false
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   when:
@@ -88,6 +91,7 @@
 
 - name: Perform a Keystone DB sync contract
   command: "{{ keystone_bin }}/keystone-manage db_sync --contract"
+  changed_when: false
   become: yes
   become_user: "{{ keystone_system_user_name }}"
   when:

tasks/keystone_federation_sp_shib_setup.yml

@@ -29,7 +29,7 @@
 - name: Copy Shibboleth SP key-pair (if provided)
   copy:
     content: "{{ item.content }}"
-    dest: "{{ item.dest }}"  # noqa 206
+    dest: "{{ item.dest }}"
     mode: "{{ item.mode | default('0640') }}"
   when:
     - _keystone_is_first_play_host

tasks/keystone_fernet.yml

@@ -13,10 +13,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- include_tasks: keystone_fernet_keys_create.yml
+- name: Including keystone_fernet_keys_create tasks
+  include_tasks: keystone_fernet_keys_create.yml
   when: _keystone_is_first_play_host
 
-- include_tasks: keystone_fernet_keys_distribute.yml
+- name: Including keystone_fernet_keys_distribute tasks
+  include_tasks: keystone_fernet_keys_distribute.yml
   when: _keystone_is_first_play_host
 
-- include_tasks: keystone_fernet_keys_autorotate.yml
+- name: Including keystone_fernet_keys_autorotate tasks
+  include_tasks: keystone_fernet_keys_autorotate.yml

tasks/keystone_fernet_keys_create.yml

@@ -18,7 +18,7 @@
     path: "{{ keystone_fernet_tokens_key_repository }}/0"
   register: _fernet_keys
 
-- name: Create fernet keys for Keystone
+- name: Create fernet keys for Keystone # noqa: no-changed-when
   command: >
     {{ keystone_bin }}/keystone-manage fernet_setup
                                        --keystone-user "{{ keystone_system_user_name }}"
@@ -27,7 +27,7 @@
   become_user: "{{ keystone_system_user_name }}"
   when: not _fernet_keys.stat.exists
 
-- name: Rotate fernet keys for Keystone
+- name: Rotate fernet keys for Keystone # noqa: no-changed-when
   command: >
     {{ keystone_bin }}/keystone-manage fernet_rotate
                                        --keystone-user "{{ keystone_system_user_name }}"

tasks/keystone_idp_setup.yml

@@ -18,6 +18,7 @@
     {{ keystone_bin }}/keystone-manage saml_idp_metadata > {{ keystone_idp.idp_metadata_path }}
   become: yes
   become_user: "{{ keystone_system_user_name }}"
+  changed_when: false
   when: keystone_idp != {}
   notify:
     - Restart uWSGI

tasks/keystone_install.yml

@@ -111,6 +111,7 @@
         section: keystone
         option: venv_tag
         value: "{{ keystone_venv_tag }}"
+        mode: "0644"
 
     - name: Initialise the upgrade facts
       ini_file:
@@ -118,6 +119,7 @@
         section: keystone
         option: "{{ item.name }}"
         value: "{{ item.state }}"
+        mode: "0644"
       with_items:
         - name: "need_db_expand"
           state: "True"

tasks/keystone_post_install.yml

@@ -107,6 +107,7 @@
   copy:
     src: "{{ keystone_sso_callback_file_path }}"
     dest: "/etc/keystone/sso_callback_template.html"
+    mode: "0644"
   when:
     - keystone_sso_callback_file_path is defined
   notify:

tasks/main.yml

@@ -53,11 +53,12 @@
 
 - name: Fact for apache module shibboleth to be installed
   set_fact:
-    keystone_sp_apache_mod_shib:
+    keystone_sp_apache_mod_shib: >-
-      "{{ (keystone_sp != {} and
+      {{
-      (keystone_sp.apache_mod is undefined or
+        (keystone_sp != {} and (keystone_sp.apache_mod is undefined or (
-      (keystone_sp.apache_mod is defined and keystone_sp.apache_mod != 'mod_auth_openidc'))
+          keystone_sp.apache_mod is defined and keystone_sp.apache_mod != 'mod_auth_openidc'))
-      ) | ternary('true', 'false') }}"
+        ) | ternary('true', 'false')
+      }}
   tags:
     - always
 
@@ -70,7 +71,8 @@
   tags:
     - always
 
-- include_role:
+- name: Including osa.db_setup role
+  include_role:
     name: openstack.osa.db_setup
     apply:
       tags:
@@ -91,7 +93,8 @@
   tags:
     - always
 
-- include_role:
+- name: Including osa.mq_setup role
+  include_role:
     name: openstack.osa.mq_setup
     apply:
       tags:
@@ -113,40 +116,46 @@
   tags:
     - always
 
-- import_tasks: keystone_install.yml
+- name: Importing keystone_install tasks
+  import_tasks: keystone_install.yml
   tags:
     - keystone-install
 
-- name: refresh local facts
+- name: Refresh local facts
   setup:
     filter: ansible_local
     gather_subset: "!all"
   tags:
     - keystone-config
 
-- import_tasks: keystone_post_install.yml
+- name: Importing keystone_post_install tasks
+  import_tasks: keystone_post_install.yml
   tags:
     - keystone-config
 
-- import_tasks: keystone_fernet.yml
+- name: Importing keystone_fernet tasks
+  import_tasks: keystone_fernet.yml
   when:
     - "'fernet' in keystone_token_provider"
     - keystone_service_setup | bool
   tags:
     - keystone-config
 
-- import_tasks: keystone_db_sync.yml
+- name: Importing keystone_db_sync tasks
+  import_tasks: keystone_db_sync.yml
   when:
     - "keystone_database_enabled | bool"
   tags:
     - keystone-config
 
-- import_tasks: keystone_credential.yml
+- name: Importing keystone_credential tasks
+  import_tasks: keystone_credential.yml
   when: keystone_service_setup | bool
   tags:
     - keystone-config
 
-- import_tasks: keystone_federation_sp_shib_setup.yml
+- name: Importing keystone_federation_sp_shib_setup tasks
+  import_tasks: keystone_federation_sp_shib_setup.yml
   when:
     - keystone_sp_apache_mod_shib
     - not (keystone_use_uwsgi | bool)
@@ -172,7 +181,8 @@
   tags:
     - keystone-config
 
-- import_tasks: "keystone_apache.yml"
+- name: Importing keystone_apache tasks
+  import_tasks: "keystone_apache.yml"
   when:
     - not (keystone_use_uwsgi | bool)
   tags:
@@ -191,7 +201,8 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- include_tasks: keystone_service_bootstrap.yml
+- name: Including keystone_service_bootstrap tasks
+  include_tasks: keystone_service_bootstrap.yml
   args:
     apply:
       tags:
@@ -225,7 +236,8 @@
   retries: 12
   delay: 5
 
-- include_role:
+- name: Including osa.service_setup role
+  include_role:
     name: openstack.osa.service_setup
     apply:
       tags:
@@ -259,7 +271,8 @@
   tags:
     - always
 
-- import_tasks: keystone_ldap_setup.yml
+- name: Including keystone_ldap_setup tasks
+  import_tasks: keystone_ldap_setup.yml
   when:
     - keystone_service_setup | bool
     - keystone_ldap != {}
@@ -269,7 +282,8 @@
 - name: Flush handlers
   meta: flush_handlers
 
-- include_tasks: keystone_idp_setup.yml
+- name: Including keystone_idp_setup tasks
+  include_tasks: keystone_idp_setup.yml
   args:
     apply:
       tags:

tasks/main_keystone_federation_sp_idp_setup.yml

@@ -1,4 +1,6 @@
-- include_tasks: keystone_federation_sp_idp_setup.yml
+---
+- name: Including keystone_federation_sp_idp_setup tasks
+  include_tasks: keystone_federation_sp_idp_setup.yml
   with_items: "{{ keystone_sp.trusted_idp_list }}"
   loop_control:
     loop_var: trusted_idp

tasks/main_pre.yml

@@ -13,19 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: create the system group
+- name: Create system groups
-  group:
-    name: "{{ keystone_system_group_name }}"
-    state: "present"
-    system: "yes"
-
-- name: create additional groups
   group:
     name: "{{ item }}"
     state: "present"
     system: "yes"
-  with_items:
+  with_items: "{{ [keystone_system_group_name] + keystone_system_additional_groups }}"
-    - "{{ keystone_system_additional_groups }}"
 
 - name: Create the keystone system user
   user:
@@ -71,6 +64,7 @@
       owner: root
       group: root
 
-- import_tasks: keystone_key_setup.yml
+- name: Importing keystone_key_setup tasks
+  import_tasks: keystone_key_setup.yml
   tags:
     - keystone-install

vars/main.yml

@@ -35,8 +35,16 @@ uwsgi_keystone_services: |-
   {% endfor %}
   {{ services }}
 
-_keystone_is_first_play_host: "{{ (keystone_services['keystone-wsgi-public']['group'] in group_names and inventory_hostname == ((groups[keystone_services['keystone-wsgi-public']['group']] | intersect(ansible_play_hosts)) | list)[0]) | bool }}"
+_keystone_is_first_play_host: >-
-_keystone_is_last_play_host: "{{ (keystone_services['keystone-wsgi-public']['group'] in group_names and inventory_hostname == ((groups[keystone_services['keystone-wsgi-public']['group']] | intersect(ansible_play_hosts)) | list)[-1]) | bool }}"
+  {{
+    (keystone_services['keystone-wsgi-public']['group'] in group_names and
+      inventory_hostname == ((groups[keystone_services['keystone-wsgi-public']['group']] | intersect(ansible_play_hosts)) | list)[0]) | bool
+  }}
+_keystone_is_last_play_host: >-
+  {{
+    (keystone_services['keystone-wsgi-public']['group'] in group_names and
+      inventory_hostname == ((groups[keystone_services['keystone-wsgi-public']['group']] | intersect(ansible_play_hosts)) | list)[-1]) | bool
+  }}
 _keystone_cache_backend_map:
   dogpile:
     - oslo_cache.memcache_pool