Fix CIS play skipping kolla user on non-Kolla hosts

[bbezak]

For example non-hyperconverged Ceph nodes are not member of kolla inventory, at it fails there:

PRE PATCH:

TASK [Ensure service accounts have no expiry options set] *********************************************************************************************************************************
Thursday 27 November 2025  13:00:42 +0000 (0:00:00.075)       0:00:12.333 *****
ok: [ctrl-02] => (item=stack)
ok: [ctrl-03] => (item=stack)
ok: [ctrl-01] => (item=stack)
ok: [ceph-03] => (item=stack)
ok: [ceph-02] => (item=stack)
ok: [ceph-04] => (item=stack)
ok: [ceph-01] => (item=stack)
ok: [ctrl-02] => (item=kolla)
ok: [ctrl-03] => (item=kolla)
ok: [ctrl-01] => (item=kolla)
failed: [ceph-03] (item=kolla) =>
    ansible_loop_var: item
    changed: false
    cmd:
    - chage
    - -m
    - '0'
    - -M
    - '99999'
    - -W
    - '7'
    - -I
    - '-1'
    - kolla
    delta: '0:00:00.007108'
    end: '2025-11-27 14:00:42.557068'
    item: kolla
    msg: non-zero return code
    rc: 1
    start: '2025-11-27 14:00:42.549960'
    stderr: 'chage: user ''kolla'' does not exist in /etc/passwd'
    stderr_lines: <omitted>
    stdout: ''
    stdout_lines: <omitted>


POST PATCH:

TASK [Ensure service accounts have no expiry options set] *********************************************************************************************************************************
Thursday 27 November 2025  20:31:47 +0100 (0:00:00.074)       0:00:01.471 *****
ok: [ctrl-01] => (item=stack)
ok: [ctrl-02] => (item=stack)
ok: [ctrl-03] => (item=stack)
ok: [os-seed] => (item=stack)
ok: [ceph-04] => (item=stack)
ok: [ceph-01] => (item=stack)
ok: [ceph-02] => (item=stack)
ok: [ceph-03] => (item=stack)
skipping: [ceph-04] => (item=kolla)
skipping: [ceph-01] => (item=kolla)
skipping: [ceph-02] => (item=kolla)
skipping: [ceph-03] => (item=kolla)
ok: [ctrl-01] => (item=kolla)
ok: [ctrl-02] => (item=kolla)
ok: [ctrl-03] => (item=kolla)
ok: [os-seed] => (item=kolla)

inspired by https://github.com/openstack/kayobe/blob/645a3074063f9df8c958c2b241d62b3fa4aef9ea/ansible/kolla-ansible-user.yml#L19

[gemini-code-assist]

Code Review

This pull request fixes an issue where the CIS hardening playbook would fail on hosts that are not part of the Kolla inventory, because it tried to modify the kolla user which does not exist on those hosts. The fix introduces a condition to skip the task for the kolla user on such hosts.

The approach taken is to build a list of hosts in the Kolla inventory and check against it. While this works, I've suggested a more robust and idiomatic Ansible approach using the getent module to check for user existence directly on the target host. This simplifies the code and removes a dependency on inventory structure variables.

[bbezak]

/gemini review

[gemini-code-assist]

Code Review

This pull request correctly fixes an issue where the CIS hardening playbook would fail on hosts where the kolla user does not exist. The approach of using ansible.builtin.getent to gather user information and then conditionally running the chage command is clean and idiomatic for Ansible. The changes are logical and well-implemented. I have one suggestion to improve future maintainability.