- name: Configure Kerberos for Hadoop Users
hosts: hadoop_servers
become: no
gather_facts: no
vars:
kerberos_server: hadoop1.xuexi.com
keytab_file_path: /home/hadoop/keys/hadoop.keytab
principals:
nn/
dn/
yarn/
starrock/
tasks:
- name: Ensure key directory exists
ansible.builtin.file:
path: /home/hadoop/hxy
state: directory
mode: '0755'
- name: Create Kerberos principals
ansible.builtin.command: >
kadmin.local -q 'addprinc -randkey { { item }}{ { inventory_hostname }}@XUEXI.COM'
register: addprinc_output
ignore_errors: yes
delegate_to: "{ { kerberos_server }}"
loop: "{ { principals }}"
loop_control:
extended: yes # Ensure extended loop variables are available
- name: Check principal creation status
ansible.builtin.fail:
msg: "Failed to create principal for { { item.item }}: { { item.stderr }}"
when: "'Principal already exists' not in item.stderr and item.rc != 0"
loop: "{ { addprinc_output.results }}"
loop_control:
label: "{ { item.item }}{ { inventory_hostname }}@XUEXI.COM"
- name: Generate keytab file for each principal
ansible.builtin.command: >
kadmin.local -q 'xst -k { { keytab_file_path }}.tmp -norandkey { { item }}{ { inventory_hostname }}@XUEXI.COM'
register: xst_output
delegate_to: "{ { kerberos_server }}"
loop: "{ { principals }}"
when: "'Principal already exists' in (addprinc_output.results | selectattr('item', 'equalto', item) | first).stderr or (addprinc_output.results | selectattr('item', 'equalto', item) | first).rc == 0"
Note: The above when condition is simplified and may need adjustment.
It assumes that if 'Principal already exists', it's okay to proceed.
However, a more robust solution would involve tracking success/failure per principal.
- name: Move keytab file to final location (on Kerberos server)
ansible.builtin.command: mv { { keytab_file_path }}.tmp { { keytab_file_path }}
delegate_to: "{ { kerberos_server }}"
when: xst_output is changed # This might not be perfect, as 'changed' depends on file existence, not Kerberos operation.
- name: Fetch the keytab file to the control machine
ansible.builtin.fetch:
src: "{ { keytab_file_path }}"
dest: "./hadoop.keytab"
flat: yes
delegate_to: "{ { kerberos_server }}"
run_once: yes # Ensure this task runs only once.
- name: Distribute keytab files to each target host
ansible.builtin.copy:
src: ./hadoop.keytab
dest: /data1/tmp/hadoop.keytab
loop: "{ { groups['hadoop_servers'] }}"
delegate_to: "{ { item }}"
- name: Clean up local keytab file
ansible.builtin.file:
path: ./hadoop.keytab
state: absent
run_once: yes
ansible批量生产kerberos票据,并批量分发到所有其他主机脚本
蘑菇丁2025-01-24 8:05
相关推荐
Han.miracle43 分钟前
数据结构——二叉树的从前序与中序遍历序列构造二叉树Le1Yu2 小时前
分布式事务以及Seata(XA、AT模式)寒山李白3 小时前
关于Java项目构建/配置工具方式(Gradle-Groovy、Gradle-Kotlin、Maven)的区别于选择无妄无望3 小时前
docker学习(4)容器的生命周期与资源控制MC丶科4 小时前
【SpringBoot 快速上手实战系列】5 分钟用 Spring Boot 搭建一个用户管理系统(含前后端分离)!新手也能一次跑通!千码君20164 小时前
React Native:从react的解构看编程众多语言中的解构假装我不帅4 小时前
wsl+vscode开发.net项目夜白宋5 小时前
【word多文档docx合并】@yanyu6665 小时前
idea中配置tomcat2501_916766545 小时前
【项目部署】JavaWeb、MavenJavaWeb项目部署至 Tomcat 的实现方式