openstack-ansible-security/doc/source/developer-notes/V-38448.rst

Although the /etc/gshadow file is group-owned by root by default, the Ansible tasks will ensure that it is configured that way.