Stargate Controller Hardening and Ansible Collection Dependency Mapping

SSH Key Rotation on the Ansible Control Host

The stargate.research.bitsmasher.net controller node handles all ansible-test execution and lab.franklin collection management. Its SSH key material was audited for rotation compliance. All agent service accounts use ed25519 keys with 90-day expiry markers; host keys on target nodes were cross-referenced against the authorized_keys registry to identify stale entries from decommissioned hosts (head2, netlab1/2, ns1).

Collection Dependency Mapping

A comprehensive dependency graph across all 43 lab.franklin roles was mapped today. Key findings:

• dns_master and dns_slave both depend on a base-bind9 role (missing from the current collection — needs to be authored).
• The ntp_server role has a hard dependency on a ntpd-service-role that only exists in an external Galaxy collection.
• common role is a transitive dependency for 31 of 43 roles, making it the highest-impact target for testing coverage expansion.

Manifest Reconciliation

The manifest file (META-INF/main.yml) was reconciled against the actual role directory structure. Three orphaned role references were identified in the collection manifest — these roles either moved directories during previous restructuring or were dropped without manifest updates. The manifest will be regenerated from scratch using ansible-galaxy collection build metadata rather than manual editing.

Ansible Collection Release Readiness

• Molecule dependencies removed from stargate controller role — confirmed all target roles use native ansible-test.
• Pinned collection to pypi_internal package source (approved).
• Remaining: fix the three orphaned references and regenerate META-INF/main.yml.