keytab: Prefix variable names with keytab_

playbooks/adm.yml

@@ -28,7 +28,7 @@
     - ansible_host
     - certbot
     - role: keytab
-      principals:
+      keytab_principals:
         - "host/{{ inventory_hostname }}@{{ kerberos_realm }}"
     - nfs_client
     - sssd

playbooks/collab.yml

@@ -28,9 +28,9 @@
     - collab
     - mod_auth_gssapi
     - role: keytab
-      keytab: /etc/httpd/httpd.keytab
+      keytab_path: /etc/httpd/httpd.keytab
-      principals: HTTP/collab.foo.sh@FOO.SH
+      keytab_principals: HTTP/collab.foo.sh@FOO.SH
-      group: apache
+      keytab_group: apache
     - ldap
 
   tasks:

playbooks/mail.yml

@@ -26,7 +26,7 @@
   roles:
     - base
     - role: keytab
-      principals:
+      keytab_principals:
         - "host/{{ inventory_hostname }}@{{ kerberos_realm }}"
         - "smtp/{{ mail_server }}@{{ kerberos_realm }}"
     - nfs_client

playbooks/nas.yml

@@ -38,7 +38,7 @@
     - sssd
     - nfs_server
     - role: keytab
-      principals: "nfs/{{ inventory_hostname }}@FOO.SH"
+      keytab_principals: "nfs/{{ inventory_hostname }}@FOO.SH"
 
   tasks:
     - name: Copy exports file

playbooks/print.yml

@@ -50,5 +50,5 @@
       ansible.builtin.import_role:
         name: keytab
       vars:
-        keytab: /etc/cups/cups.keytab
+        keytab_path: /etc/cups/cups.keytab
-        principals: "HTTP/print.foo.sh@{{ kerberos_realm }}"
+        keytab_principals: "HTTP/print.foo.sh@{{ kerberos_realm }}"

playbooks/shell.yml

@@ -15,7 +15,7 @@
   roles:
     - base
     - role: keytab
-      principals:
+      keytab_principals:
         - "host/{{ inventory_hostname }}@{{ kerberos_realm }}"
         - "nfs/{{ inventory_hostname }}@{{ kerberos_realm }}"
     - nfs_client

playbooks/static.yml

@@ -15,7 +15,7 @@
   roles:
     - base
     - role: keytab
-      principals:
+      keytab_principals:
         - "host/{{ inventory_hostname }}@FOO.SH"
         - "nfs/{{ inventory_hostname }}@FOO.SH"
     - nfs_client

playbooks/zm.yml

@@ -27,9 +27,9 @@
     - base
     - mod_auth_gssapi
     - role: keytab
-      keytab: /etc/httpd/httpd.keytab
+      keytab_path: /etc/httpd/httpd.keytab
-      principals: HTTP/zm.foo.sh@FOO.SH
+      keytab_principals: HTTP/zm.foo.sh@FOO.SH
-      group: apache
+      keytab_group: apache
 
   tasks:
     - name: Run handlers to get interfaces configured

roles/dovecot/tasks/main.yml

@@ -8,10 +8,10 @@
   ansible.builtin.include_role:
     name: keytab
   vars:
-    keytab: /etc/dovecot/dovecot.keytab
+    keytab_path: /etc/dovecot/dovecot.keytab
-    principals:
+    keytab_principals:
       - "imap/{{ mail_server }}@{{ kerberos_realm }}"
-    group: dovecot
+    keytab_group: dovecot
 
 - name: Install privatekey
   ansible.builtin.copy:

roles/keytab/defaults/main.yml

@@ -1,3 +1,3 @@
 ---
-keytab: /etc/krb5.keytab
+keytab_path: /etc/krb5.keytab
-group: "{{ ansible_wheel }}"
+keytab_group: "{{ ansible_wheel }}"

roles/keytab/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 - name: Check if keytab exists
   ansible.builtin.stat:
-    path: "{{ keytab }}"
+    path: "{{ keytab_path }}"
   register: keytab_status
   check_mode: false
 
@@ -15,7 +15,7 @@
       - -k
       - "/tmp/{{ inventory_hostname }}.kt"
       - "{{ item }}"
-  with_items: "{{ principals }}"
+  with_items: "{{ keytab_principals }}"
   delegate_to: ldap01.home.foo.sh
   when: not keytab_status.stat.exists
 
@@ -39,12 +39,12 @@
   ansible.builtin.shell: >-
     set -o pipefail &&
     umask 077 &&
-    echo '{{ keytab_data.stdout }}' | base64 -d > "{{ keytab }}"
+    echo '{{ keytab_data.stdout }}' | base64 -d > "{{ keytab_path }}"
   when: not keytab_status.stat.exists
 
 - name: Check keytab permissions
   ansible.builtin.file:
-    path: "{{ keytab }}"
+    path: "{{ keytab_path }}"
-    mode: "{% if group == ansible_wheel %}0600{% else %}0640{% endif %}"
+    mode: "{% if keytab_group == ansible_wheel %}0600{% else %}0640{% endif %}"
     owner: root
-    group: "{{ group }}"
+    group: "{{ keytab_group }}"