Don’t forget to delete the keytab file from the ipa server! Otherwise anyone will be able to unauthenticated download that file and impersonate that host principal

Better yet you’ll want to encrypt that file in some way when transferring it