roles/ipaclient/tasks/install.yml: ccache cleanup, new always clause

Add big block has been added that contains all steps where the ccache is
created an used. With the block it is possible to add an always clause to
remove the ccachae also in the error case. The cleanup of the ccache is
also done in the beginning to make sure that no ccache leftover will be
used.

roles/ipaclient/tasks/install.yml

@@ -21,6 +21,11 @@
     ipaadmin_principal: admin
   when: ipaadmin_principal is undefined and ipaclient_keytab is undefined
 
+- name: Install - Cleanup leftover ccache
+  file:
+    path: "/etc/ipa/.dns_ccache"
+    state: absent
+
 - block:
   - name: Install - Test if IPA client has working krb5.keytab
     ipatest:
@@ -38,13 +43,14 @@
       ipaclient_use_otp: "no"
     when: ipaclient_use_otp | bool and ipatest.krb5_keytab_ok
 
-# The following block is executed when using OTP to enroll IPA client
-# ie when ipaclient_use_otp is set.
-# It connects to ipaserver and add the host with --random option in order
-# to create a OneTime Password
-# If a keytab is specified in the hostent, then the hostent will be disabled
-# if ipaclient_use_otp is set.
-- block:
+
+  # The following block is executed when using OTP to enroll IPA client
+  # ie when ipaclient_use_otp is set.
+  # It connects to ipaserver and add the host with --random option in order
+  # to create a OneTime Password
+  # If a keytab is specified in the hostent, then the hostent will be disabled
+  # if ipaclient_use_otp is set.
+  - block:
     - name: Install - Get a One-Time Password for client enrollment
       no_log: yes
       ipahost:
@@ -68,15 +74,15 @@
 
     when: ipaclient_use_otp | bool
 
-- name: Install - Check if principal and keytab are set
+  - name: Install - Check if principal and keytab are set
     fail: msg="Principal and keytab cannot be used together"
     when: ipaadmin_principal is defined and ipaadmin_principal != "" and ipaclient_keytab is defined and ipaclient_keytab != ""
 
-- name: Install - Check if one of password and keytab are set
+  - name: Install - Check if one of password and keytab are set
     fail: msg="At least one of password or keytab must be specified"
     when: not ipatest.krb5_keytab_ok and (ipaadmin_password is undefined or ipaadmin_password == "") and (ipaclient_keytab is undefined or ipaclient_keytab == "")
 
-- name: Install - Purge {{ ipadiscovery.realm }} from host keytab
+  - name: Install - Purge {{ ipadiscovery.realm }} from host keytab
     command: /usr/sbin/ipa-rmkeytab -k /etc/krb5.keytab -r "{{ ipadiscovery.realm }}"
     register: iparmkeytab
     # Do not fail on error codes 3 and 5:
@@ -85,7 +91,7 @@
     failed_when: iparmkeytab.rc != 0 and iparmkeytab.rc != 3 and iparmkeytab.rc != 5
     when: ipaclient_use_otp | bool or ipaclient_force_join | bool
 
-- name: Install - Join IPA
+  - name: Install - Join IPA
     ipajoin:
       servers: "{{ ipadiscovery.servers }}"
       domain: "{{ ipadiscovery.domain }}"
@@ -102,15 +108,15 @@
     register: ipajoin
     when: not ipatest.krb5_keytab_ok or ipaclient_force_join
 
-- block:
-  - name: Install - Cleanup ccache, end playbook processing
+  - block:
+    - name: Install - End playbook processing
       file:
         path: "/etc/ipa/.dns_ccache"
         state: absent
     - meta: end_play
     when: not ipaclient_allow_repair | bool and (ipatest.krb5_keytab_ok or ipajoin.already_joined)
 
-- name: Install - Configure IPA default.conf
+  - name: Install - Configure IPA default.conf
     include_role:
       name: ipaconf
     vars:
@@ -120,7 +126,7 @@
       ipaconf_hostname: "{{ ipadiscovery.hostname }}"
       ipaconf_basedn: "{{ ipadiscovery.basedn }}"
 
-- name: Install - Configure SSSD
+  - name: Install - Configure SSSD
     ipasssd:
       servers: "{{ ipadiscovery.servers }}"
       domain: "{{ ipadiscovery.domain }}"
@@ -134,7 +140,7 @@
       #dns_updates: no
       #all_ip_addresses: no
 
-- name: Install - Configure krb5 for IPA realm "{{ ipadiscovery.realm }} <= 4.4"
+  - name: Install - Configure krb5 for IPA realm "{{ ipadiscovery.realm }} <= 4.4"
     include_role:
       name: krb5
     vars:
@@ -146,7 +152,7 @@
       krb5_pkinit_anchors: "FILE:/etc/ipa/ca.crt"
     when: ipadiscovery.ipa_python_version <= 40400
 
-- name: Install - Configure krb5 for IPA realm "{{ ipadiscovery.realm }} > 4.4"
+  - name: Install - Configure krb5 for IPA realm "{{ ipadiscovery.realm }} > 4.4"
     include_role:
       name: krb5
     vars:
@@ -160,7 +166,7 @@
       krb5_pkinit_anchors: "FILE:/var/lib/ipa-client/pki/pki-ca-bundle.pem"
     when: ipadiscovery.ipa_python_version > 40400
 
-- name: Install - IPA API calls for remaining enrollment parts
+  - name: Install - IPA API calls for remaining enrollment parts
     ipaapi:
       servers: "{{ ipadiscovery.servers }}"
       realm: "{{ ipadiscovery.realm }}"
@@ -168,7 +174,7 @@
       #debug: yes
     register: ipaapi
 
-- name: Install - Create IPA NSS database
+  - name: Install - Create IPA NSS database
     ipanss:
       servers: "{{ ipadiscovery.servers }}"
       domain: "{{ ipadiscovery.domain }}"
@@ -181,7 +187,7 @@
       ca_enabled: "{{ ipaapi.ca_enabled | default(omit) }}"
       #on_master: no
 
-- name: Install - IPA extras configuration
+  - name: Install - IPA extras configuration
     ipaextras:
       servers: "{{ ipadiscovery.servers }}"
       domain: "{{ ipadiscovery.domain }}"
@@ -198,3 +204,10 @@
       #no_nisdomain: no
       #nisdomain:
       #on_master: no
+
+  always:
+  - name: Cleanup leftover ccache
+    file:
+      path: "/etc/ipa/.dns_ccache"
+      state: absent
+