[ocp4_workload_ols] Grant lightspeed-operator-query-access to non-admin users

[stencell]

Summary

• Automatically discover non-admin users from the active auth provider and grant them lightspeed-operator-query-access
• Supports both htpasswd and keycloak auth providers with provider-specific discovery logic
• No manual user list configuration required — the role reads directly from the auth system

Changes

roles/ocp4_workload_ols/defaults/main.yaml

Added a new User Access Configuration section with 5 variables that mirror ocp4_workload_authentication defaults:

Variable	Purpose
ocp4_workload_ols_auth_provider	htpasswd or keycloak
ocp4_workload_ols_admin_username	Excluded from grants
ocp4_workload_ols_htpasswd_secret_name	htpasswd secret name in openshift-config
ocp4_workload_ols_keycloak_namespace	Keycloak install namespace
ocp4_workload_ols_keycloak_realm	Keycloak realm to query (default: sso)

roles/ocp4_workload_ols/tasks/workload.yaml

Added tasks at the end of the workload to build a user list and grant ClusterRoleBinding per user:

• htpasswd path: reads and parses the htpasswd secret in openshift-config — captures all configured users (numbered users, cluster accounts, any naming convention) automatically
• keycloak path: fetches the Keycloak admin token from the keycloak-initial-admin secret, then queries /admin/realms/{realm}/users via the REST API
• Admin user is excluded from grants in both paths
• ClusterRoleBinding creation is idempotent (state: present)
• Sensitive Keycloak API responses use no_log: true