feat: add MAAS deploy workflow and dynamic inventory integration

Add scripts/maas_deploy.sh with --os, --profile, --status, --release,
and --tags-only flags for repeatable VM deploy/tag/test/redeploy cycles.
Reads config from config/maas-inventory.yml (no hardcoded secrets).

Update maas_inventory.py to exit gracefully when MAAS is not configured
(returns empty inventory instead of error), enabling dual inventory in
ansible.cfg without breaking non-MAAS users.

Wire ansible.cfg for dual inventory (static + dynamic). Add machines
field to config.example/maas-inventory.yml. Add test-playbooks skill.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Douglas Holt <dholt@nvidia.com>

Author: dholt

.claude/skills/test-playbooks.md

@@ -0,0 +1,40 @@
+---
+name: test-playbooks
+description: Test Ansible playbooks across Ubuntu versions on target machines
+---
+
+## Prerequisites
+- Virtualenv activated (`source .venv/bin/activate` or `source /opt/deepops/env/bin/activate`)
+- Target machines provisioned and accessible via SSH
+- Inventory configured: either `config/inventory` (static) or `config/maas-inventory.yml` (MAAS dynamic)
+
+## Steps
+1. Verify connectivity: `ansible -m ping all`
+2. Run playbook: `ansible-playbook playbooks/<playbook>.yml`
+3. Verify results (check playbook output, run smoke tests on targets)
+4. To test another OS version: reprovision targets with the new OS, re-run playbook, verify again
+
+## Test Matrix
+| Playbook | Inventory groups needed | Test on 24.04 | Test on 22.04 |
+|----------|------------------------|---------------|---------------|
+| k8s-cluster.yml | kube_control_plane, kube_node, etcd | yes | yes |
+| slurm-cluster.yml | slurm-master, slurm-node | yes | yes |
+| ngc-ready-server.yml | (any host group) | yes | yes |
+
+## MAAS Users
+If using MAAS dynamic inventory (`scripts/maas_inventory.py`), the deploy script automates provisioning:
+```bash
+./scripts/maas_deploy.sh --status                      # check VM state
+./scripts/maas_deploy.sh --os noble --profile k8s      # deploy + tag for K8s
+./scripts/maas_deploy.sh --os jammy --profile slurm    # deploy + tag for Slurm
+./scripts/maas_deploy.sh --profile k8s --tags-only     # re-tag without redeploying
+./scripts/maas_deploy.sh --release                     # release VMs
+```
+Profiles assign MAAS tags that the dynamic inventory maps to Ansible groups:
+- **k8s**: first machine = `kube_control_plane` + `etcd`, remaining = `kube_node`
+- **slurm**: first machine = `slurm-master`, remaining = `slurm-node`
+
+## Group Naming
+- K8s groups use underscores: `kube_control_plane`, `kube_node`, `k8s_cluster`
+- Slurm groups use hyphens: `slurm-master`, `slurm-node`, `slurm-cluster`
+- Old hyphenated K8s names (`kube-master`, `kube-node`) are accepted via TAG_ALIASES

ansible.cfg

@@ -2,7 +2,7 @@
 collections_paths = ./collections
 roles_path = ./roles/galaxy:./roles:./submodules/kubespray/roles
 library = ./submodules/kubespray/library
-inventory = ./config/inventory
+inventory = ./config/inventory,./scripts/maas_inventory.py
 host_key_checking = False
 gathering = smart
 fact_caching = jsonfile

config.example/maas-inventory.yml

@@ -26,3 +26,7 @@ ssh_user: "ubuntu"
 # Only needed if target machines are on a private network that requires
 # jumping through a bastion host. Leave commented out for direct access.
 #ssh_bastion: "user@bastion-host"
+
+# Machines to manage (hostnames as they appear in MAAS)
+# Used by maas_deploy.sh for deploy/release operations
+#machines: "maas-worker maas-worker-2 maas-worker-3"