DBSU SSH key exchange assumes pg_cluster is an inventory group

[Vonng]

Problem

The DBSU SSH key exchange task currently derives its delegation targets from the Ansible inventory group named by pg_cluster:

with_nested:
  - "{{ [dbsu_ssh_keys.stdout] }}"
  - "{{ groups[pg_cluster] }}"

However, pg_cluster is the logical PostgreSQL cluster identity calculated from instance metadata. It is not guaranteed to be an Ansible group name.

This is visible in Citus inventories: logical clusters such as pg-citus1 and pg-citus2 are members of a broader inventory group, so groups[pg_cluster] may be undefined. As a result, the DBSU SSH key exchange cannot reliably enumerate or delegate to all members of the same logical PostgreSQL cluster.

Expected behavior

The task should exchange each DBSU public key among the members of the same logical PostgreSQL cluster, independently of how hosts are arranged into Ansible inventory groups.

Scope

The issue is limited to DBSU SSH key exchange. Ordinary inventories often hide the problem because their logical cluster name happens to match an inventory group name.

[Vonng]

The minimal fix is to use the canonical member list already calculated by pg_id:

delegate_to: "{{ item[1] }}"
with_nested:
  - "{{ [dbsu_ssh_keys.stdout] }}"
  - "{{ pg_cluster_members }}"

Why this is the correct source:

• pg_cluster_members is built from pg_meta[].inventory_hostname for the current logical PostgreSQL cluster.
• It therefore follows PostgreSQL cluster identity instead of assuming that the logical pg_cluster name is also an Ansible group.
• It preserves the existing behavior for ordinary inventories and fixes Citus-style inventories where those two namespaces differ.

No default should be added. The supported PGSQL entrypoints run pg_id before the PGSQL role, including targeted pg_ssh / pg_dbsu runs, so this variable is an invariant at this point. Falling back to inventory_hostname would silently reduce a cluster-wide exchange to the current host and hide a broken task-ordering invariant.

Validation performed:

• Checked all 48 bundled inventories; the relevant name mismatches are the six logical Citus clusters.
• Verified the calculated members for ordinary HA and Citus inventories.
• Verified that the exact nested delegation targets every member of a Citus logical cluster.
• Passed syntax checks for pgsql.yml, deploy.yml, and slim.yml, plus inventory validation for conf/ha/citus.yml.

The implementation is prepared in commit 8c194918 (fix(pgsql): exchange dbsu keys by cluster identity).