- name: Configure Kerberos for Hadoop Users
  hosts: hadoop_servers
  become: no
  gather_facts: no
  vars:
    kerberos_server: hadoop1.xuexi.com
    keytab_file_path: /home/hadoop/keys/hadoop.keytab
    principals:
      - nn/
      - dn/
      - yarn/
      - starrock/

  tasks:

    - name: Ensure key directory exists
      ansible.builtin.file:
        path: /home/hadoop/hxy
        state: directory
        mode: '0755'

    - name: Create Kerberos principals
      ansible.builtin.command: >
        kadmin.local -q 'addprinc -randkey { { item }}{ { inventory_hostname }}@XUEXI.COM'
      register: addprinc_output
      ignore_errors: yes
      delegate_to: "{ { kerberos_server }}"
      loop: "{ { principals }}"
      loop_control:
        extended: yes  # Ensure extended loop variables are available

    - name: Check principal creation status
      ansible.builtin.fail:
        msg: "Failed to create principal for { { item.item }}: { { item.stderr }}"
      when: "'Principal already exists' not in item.stderr and item.rc != 0"
      loop: "{ { addprinc_output.results }}"
      loop_control:
        label: "{ { item.item }}{ { inventory_hostname }}@XUEXI.COM"

    - name: Generate keytab file for each principal
      ansible.builtin.command: >
        kadmin.local -q 'xst -k { { keytab_file_path }}.tmp -norandkey { { item }}{ { inventory_hostname }}@XUEXI.COM'
      register: xst_output
      delegate_to: "{ { kerberos_server }}"
      loop: "{ { principals }}"
      when: "'Principal already exists' in (addprinc_output.results | selectattr('item', 'equalto', item) | first).stderr or (addprinc_output.results | selectattr('item', 'equalto', item) | first).rc == 0"
      # Note: The above when condition is simplified and may need adjustment.
      # It assumes that if 'Principal already exists', it's okay to proceed.
      # However, a more robust solution would involve tracking success/failure per principal.

    - name: Move keytab file to final location (on Kerberos server)
      ansible.builtin.command: mv { { keytab_file_path }}.tmp { { keytab_file_path }}
      delegate_to: "{ { kerberos_server }}"
      when: xst_output is changed  # This might not be perfect, as 'changed' depends on file existence, not Kerberos operation.

    - name: Fetch the keytab file to the control machine
      ansible.builtin.fetch:
        src: "{ { keytab_file_path }}"
        dest: "./hadoop.keytab"
        flat: yes
      delegate_to: "{ { kerberos_server }}"
      run_once: yes  # Ensure this task runs only once.

    - name: Distribute keytab files to each target host
      ansible.builtin.copy:
        src: ./hadoop.keytab
        dest: /data1/tmp/hadoop.keytab
      loop: "{ { groups['hadoop_servers'] }}"
      delegate_to: "{ { item }}"

    - name: Clean up local keytab file
      ansible.builtin.file:
        path: ./hadoop.keytab
        state: absent
      run_once: yes