To Reproduce Steps to reproduce the behavior:

1. create a custom list of password to rotate, including some passwords from the DO_NOT_ROTATE_LIST
2. ansible-playbook -e @password_list.yaml -e stack=central -i ~/tripleo-deploy/undercloud/tripleo-ansible-inventory.yaml /usr/share/ansible/tripleo-playbooks/rotate-passwords.yaml

Expected behavior

• password_list takes precedence over DO_NOT_ROTATE (as it does in 16.2)

Known workaround

• in the password file (e.g ~/overcloud-deploy/central/central-passwords.yaml in this case) manually remove the passwords that are not correctly rotated to force regeneration