feat: Kerberos principals for nfs server and client hosts

create-client-host.yml

@@ -0,0 +1,10 @@
+
+- name: Set up NFS client host (server side)
+  hosts: server
+  tasks:
+  - name: Create kerberos principal for client host
+    ansible.builtin.command:
+      cmd: "kadmin.local add_principal -nokey {{ nfs_client_host }}"
+    failed_when: _task.result.rc != 0 and _task.result.rc != 1
+    changed_when: _task.result.rc == 0
+

rainbowsheep-cloud.yml

@@ -5,4 +5,5 @@
     - chrony
     - kerberos
     - nfs
+    - kerberos_nfs
     - vault

roles/kerberos_nfs/tasks/main.yml

@@ -0,0 +1,16 @@
+
+- name: Create nfs kerberos principal
+  ansible.builtin.command:
+    cmd: "kadmin.local add_principal -nokey nfs/{{ ansible_facts['hostname'] }}"
+  failed_when: _task.result.rc != 0 and _task.result.rc != 1
+  changed_when: _task.result.rc == 0
+
+- name: Check keytab
+  ansible.builtin.command:
+    cmd: "k5srvutil list"
+  register: keytab
+
+- name: Add nfs kerberos to keytab
+  ansible.builtin.command:
+    cmd: "kadmin.local ktadd nfs/{{ kerberos_realm}}"
+  when: keytab.stdout is not search("nfs/" ~ ansible_facts['hostname'])