Hi Seaport,
Based on your question I think there are two ways in which I can give interpretations to this.
[1] {{CONF_DIR}} or other CM variables using/integrating with Ansible
{{CONF_DIR}} is expanded/replace when a service is started from Cloudera Manager, we don't have an API that exposes this. To give you more context, every time a service is restarted or started CM will go to the database, construct the configuration files for each service and expand it in /var/run/cloudera-scm-agent/process/<PID>_<ROLE>_<SERVICE>, here is where CM will expand all the variables, including {{CONF_DIR}} and some others.
[2] {{CONF_DIR}} being an Ansible variable that you can use or create your own Ansible variables
We have no public documentation on what or how Cloudera Manager works, but If I were to guess we do something similar to what Ansible does in terms of variables replacement. As for you being able to define your own Variables that is something we currently don't support so if you're defining anything you have to use absolute values. Based on your example you should be using this in your Safety Valves:
++
krbRealm.signatureSecretFile=/mytopsecretlocation/example/http_secret
++
Note: You can use the default variables, like {{CONF_DIR}} in CM to make the replacement, but make sure that this file exists under /var/run/cloudera-scm-agent/process/<PID>_<ROLE>_<SERVICE> otherwise the services will fail to start. IMHO, I don't that you use the Cloudera Variables for customized files or attributes as there is no way for you to figure out what the next PID is, so you can't predict where to place the files until the services have started the "starting" process.
If neither of my explanations makes sense to you or are way off to what you need/asked please clarify. We will be happy to help you resolve these questions.
