Help with issuing a new keytab needed #13162

New issue

Closed

opened 2026-02-24 08:07:53 +00:00 by praiskup · 8 comments

praiskup commented

2026-02-24 08:07:53 +00:00

Member

Description of request

I'm trying to fix use-cases when users krb5-login into Copr while having dns_canonicalize_hostname = false set.
It seems that it's common to use

- include_role:
    name: keytab/service
  vars:
    service: HTTP
    host: "<<public facing hostname>>"
    kt_location: keytab location

Hence, I am experimenting with infra/ansible@9aa451c062 .. but playbook doesn't seem to succeed for me.

Namely:


TASK [ipa/service : Create host entry] *****************************************************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:19 +0000 (0:00:00.227)       0:06:05.536 ****** 
Tuesday 24 February 2026  07:53:19 +0000 (0:00:00.227)       0:06:05.536 ****** 
ok: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]

TASK [ipa/service : Create service entry] **************************************************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:21 +0000 (0:00:01.733)       0:06:07.269 ****** 
Tuesday 24 February 2026  07:53:21 +0000 (0:00:01.733)       0:06:07.269 ****** 
fatal: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]: FAILED! => {"changed": false, "msg": "service_add: HTTP/copr.stg.fedoraproject.org: service with name \"HTTP/copr.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG\" already exists, service_add_principal: HTTP/copr.stg.fedoraproject.org: no such entry"}
...ignoring

TASK [ipa/service : Fail only when krbprincipalname isn't already defined] *****************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:23 +0000 (0:00:01.954)       0:06:09.224 ****** 
Tuesday 24 February 2026  07:53:23 +0000 (0:00:01.954)       0:06:09.224 ****** 
skipping: [copr-fe-dev.aws.fedoraproject.org]

TASK [keytab/service : Get admin ticket] ***************************************************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:23 +0000 (0:00:00.176)       0:06:09.401 ****** 
Tuesday 24 February 2026  07:53:23 +0000 (0:00:00.176)       0:06:09.401 ****** 
ok: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]

TASK [keytab/service : Grant host and admin access to keytab] ******************************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:24 +0000 (0:00:00.352)       0:06:09.754 ****** 
Tuesday 24 February 2026  07:53:24 +0000 (0:00:00.352)       0:06:09.753 ****** 
skipping: [copr-fe-dev.aws.fedoraproject.org]

TASK [keytab/service : Grant host and admin access to keytab] ******************************************************************************************************************************************************************************
Tuesday 24 February 2026  07:53:24 +0000 (0:00:00.096)       0:06:09.850 ****** 
Tuesday 24 February 2026  07:53:24 +0000 (0:00:00.096)       0:06:09.850 ****** 
fatal: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]: FAILED! => {"changed": false, "cmd": ["ipa", "service-allow-retrieve-keytab", "HTTP/copr.stg.fedoraproject.org", "--hosts=copr-fe-dev.aws.fedoraproject.org", "--users=admin"], "delta": "0:00:01.100635", "end": "2026-02-24 07:53:25.396977", "failed_when_result": true, "msg": "non-zero return code", "rc": 2, "start": "2026-02-24 07:53:24.296342", "stderr": "ipa: ERROR: no such entry", "stderr_lines": ["ipa: ERROR: no such entry"], "stdout": "", "stdout_lines": []}

Would anyone help me to proceed?

### Description of request I'm trying to fix use-cases when users krb5-login into Copr while having `dns_canonicalize_hostname = false` set. It seems that it's common to use ``` - include_role: name: keytab/service vars: service: HTTP host: "<<public facing hostname>>" kt_location: keytab location ``` Hence, I am experimenting with https://forge.fedoraproject.org/infra/ansible/commit/9aa451c06288dd52511eb15704c2c945f3c5e763 .. but playbook doesn't seem to succeed for me. Namely: ``` TASK [ipa/service : Create host entry] ***************************************************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:19 +0000 (0:00:00.227) 0:06:05.536 ****** Tuesday 24 February 2026 07:53:19 +0000 (0:00:00.227) 0:06:05.536 ****** ok: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org] TASK [ipa/service : Create service entry] ************************************************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:21 +0000 (0:00:01.733) 0:06:07.269 ****** Tuesday 24 February 2026 07:53:21 +0000 (0:00:01.733) 0:06:07.269 ****** fatal: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]: FAILED! => {"changed": false, "msg": "service_add: HTTP/copr.stg.fedoraproject.org: service with name \"HTTP/copr.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG\" already exists, service_add_principal: HTTP/copr.stg.fedoraproject.org: no such entry"} ...ignoring TASK [ipa/service : Fail only when krbprincipalname isn't already defined] ***************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:23 +0000 (0:00:01.954) 0:06:09.224 ****** Tuesday 24 February 2026 07:53:23 +0000 (0:00:01.954) 0:06:09.224 ****** skipping: [copr-fe-dev.aws.fedoraproject.org] TASK [keytab/service : Get admin ticket] *************************************************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:23 +0000 (0:00:00.176) 0:06:09.401 ****** Tuesday 24 February 2026 07:53:23 +0000 (0:00:00.176) 0:06:09.401 ****** ok: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org] TASK [keytab/service : Grant host and admin access to keytab] ****************************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:24 +0000 (0:00:00.352) 0:06:09.754 ****** Tuesday 24 February 2026 07:53:24 +0000 (0:00:00.352) 0:06:09.753 ****** skipping: [copr-fe-dev.aws.fedoraproject.org] TASK [keytab/service : Grant host and admin access to keytab] ****************************************************************************************************************************************************************************** Tuesday 24 February 2026 07:53:24 +0000 (0:00:00.096) 0:06:09.850 ****** Tuesday 24 February 2026 07:53:24 +0000 (0:00:00.096) 0:06:09.850 ****** fatal: [copr-fe-dev.aws.fedoraproject.org -> ipa01.stg.rdu3.fedoraproject.org]: FAILED! => {"changed": false, "cmd": ["ipa", "service-allow-retrieve-keytab", "HTTP/copr.stg.fedoraproject.org", "--hosts=copr-fe-dev.aws.fedoraproject.org", "--users=admin"], "delta": "0:00:01.100635", "end": "2026-02-24 07:53:25.396977", "failed_when_result": true, "msg": "non-zero return code", "rc": 2, "start": "2026-02-24 07:53:24.296342", "stderr": "ipa: ERROR: no such entry", "stderr_lines": ["ipa: ERROR: no such entry"], "stdout": "", "stdout_lines": []} ``` Would anyone help me to proceed?

praiskup added the

copr

label

2026-02-24 08:07:53 +00:00

praiskup commented

2026-02-24 08:10:04 +00:00

Author

Member

So far I've been playing with the stage IPA, but I'd eventually like to fix the production Copr instance, too.

zlopez commented

2026-02-27 09:06:11 +00:00

Owner

In staging IPA I can see service HTTP/copr.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG, so try the whole name with the kerberos domain when retrieving keytab.

In staging IPA I can see service `HTTP/copr.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG`, so try the whole name with the kerberos domain when retrieving keytab.