yucca/ansible/ceph/roles/baseline/tasks/users.yml

---
# ops user - human-interactive account.
# Convergeable: running this again fixes drift in password, sudo, shell.

- name: Ensure ops user exists
  ansible.builtin.user:
    name: "{{ baseline_ops_user }}"
    uid: "{{ baseline_ops_uid }}"
    shell: /bin/bash
    groups: sudo
    append: true
    create_home: true
    state: present

- name: Assert ops_password is defined and non-empty
  ansible.builtin.assert:
    that:
      - ops_password is defined
      - ops_password | length > 0
    fail_msg: >-
      ops_password is undefined or empty. Run the play via
      scripts/ansible-play.sh (not bare ansible-playbook) so the cluster's
      secrets.yml.tpl is resolved via op inject into --extra-vars. If that's
      already what you did, verify vault_ops_password resolves:
      `op read op://<vault>/<CLUSTER>_CEPH_OPS_PASSWORD/password`.

- name: Set ops user password
  ansible.builtin.user:
    name: "{{ baseline_ops_user }}"
    # password_hash draws a RANDOM salt by default, so the hash differs every run
    # and the user module rewrites /etc/shadow (reporting 'changed') on every
    # converge. Derive a STABLE salt from the password (one-way sha256, so the
    # public salt in /etc/shadow leaks nothing) to make the hash deterministic and
    # the task idempotent, while still reconciling an out-of-band password change.
    password: "{{ ops_password | password_hash('sha512', salt=(ops_password | hash('sha256'))[:16]) }}"
  no_log: true

- name: Configure ops sudo
  ansible.builtin.copy:
    content: "{{ baseline_ops_user }} ALL=(ALL) {{ baseline_ops_sudo }}\n"
    dest: "/etc/sudoers.d/{{ baseline_ops_user }}"
    mode: '0440'
    validate: "visudo -cf %s"

# Operator SSH access to the shared ops account, sourced from the identity
# registry (rendered into group_vars/all/operators.yml). exclusive: true makes
# the registry the single source of truth -- keys not in it are removed. Skipped
# when the list is empty so ops stays password-only rather than getting wiped.
- name: Authorize operator SSH keys on the ops account
  ansible.posix.authorized_key:
    user: "{{ baseline_ops_user }}"
    key: "{{ ops_authorized_keys | join('\n') }}"
    exclusive: true
  when: ops_authorized_keys | length > 0