From 696cf4c8fe66e7e95d2ac45526135296e17fa31c Mon Sep 17 00:00:00 2001
From: Paul Breugnot <paul.breugnot@inria.fr>
Date: Sat, 24 Oct 2026 10:12:36 +0200
Subject: [PATCH] feat: Kerberos principals for nfs server and client hosts

---
 create-client-host.yml            | 10 ++++++++++
 rainbowsheep-cloud.yml            |  1 +
 roles/kerberos_nfs/tasks/main.yml | 16 ++++++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 create-client-host.yml
 create mode 100644 roles/kerberos_nfs/tasks/main.yml

diff --git a/create-client-host.yml b/create-client-host.yml
new file mode 100644
index 0000000..23a613c
--- /dev/null
+++ b/create-client-host.yml
@@ -0,0 +1,10 @@
+
+- name: Set up NFS client host (server side)
+  hosts: server
+  tasks:
+  - name: Create kerberos principal for client host
+    ansible.builtin.command:
+      cmd: "kadmin.local add_principal -nokey {{ nfs_client_host }}"
+    failed_when: _task.result.rc != 0 and _task.result.rc != 1
+    changed_when: _task.result.rc == 0
+
diff --git a/rainbowsheep-cloud.yml b/rainbowsheep-cloud.yml
index 379afc4..0e5bfa1 100644
--- a/rainbowsheep-cloud.yml
+++ b/rainbowsheep-cloud.yml
@@ -5,4 +5,5 @@
     - chrony
     - kerberos
     - nfs
+    - kerberos_nfs
     - vault
diff --git a/roles/kerberos_nfs/tasks/main.yml b/roles/kerberos_nfs/tasks/main.yml
new file mode 100644
index 0000000..08aaef9
--- /dev/null
+++ b/roles/kerberos_nfs/tasks/main.yml
@@ -0,0 +1,16 @@
+
+- name: Create nfs kerberos principal
+  ansible.builtin.command:
+    cmd: "kadmin.local add_principal -nokey nfs/{{ ansible_facts['hostname'] }}"
+  failed_when: _task.result.rc != 0 and _task.result.rc != 1
+  changed_when: _task.result.rc == 0
+
+- name: Check keytab
+  ansible.builtin.command:
+    cmd: "k5srvutil list"
+  register: keytab
+
+- name: Add nfs kerberos to keytab
+  ansible.builtin.command:
+    cmd: "kadmin.local ktadd nfs/{{ kerberos_realm}}"
+  when: keytab.stdout is not search("nfs/" ~ ansible_facts['hostname'])