There was a question from Angus that he did not CC here but I think he kind of asked what
I/we are trying to do and told that Foreman is a bit like ansible.
I thought it would be fair to tell what is the goal here.
We are enrolling clients and we set the userclass attribute to a certain value to then
assign the host to host groups with automember rules. This host group is for the
environment, customer etc. so the correct users get the correct privileges to the hosts.
We have the ansible playbooks in bitbucket but currently the playbooks are ran on
peoples' workstations that may or may not be enrolled to the same IPA domain. Yes, I
know this is sub-optimal but this is the current situation. I, myself, want some kind of
centralized solution to this in the (preferably near) future.
I know that people could use kinit on their workstations to obtain a ticket. That would
require that me and my team would need to teach the various actors (who sometimes have
surprising lack of knowledge in basic IT stuff) the basic operations of Kerberos.
The current style works and we are refining it. Gonna take a look at ansible-freeipa
again. Looked at it ages ago.