freeipa

#7488 Set nsds5ReplicaReleaseTimeout on all replicas and databases
Closed: fixed Opened by cheimes.

Closed: fixed
Reopen Issue

German wrote on https://bugzilla.redhat.com/show_bug.cgi?id=1565633

in ipa environments, we need the least delay in replication, particularly when we install a replica. We have seen that in environments of only 4 replicas, the monopolization of consumers is already taking place and sometimes preventing the replica to be installed.

Particularly we can see failures in custodia component that adds keys in one node and checks the keys have been updated in the other node. This is failing by timeout.

We can workaround this issue by setting "nsds5ReplicaReleaseTimeout: 60" at replica level in all the replicas.

The setting is explained at http://directory.fedoraproject.org/docs/389ds/design/repl-conv-design.html . 389-DS recommends 60 seconds as a good and sane default value.

The settings must be applied on each 389-DS instance for each database:

  • cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config
  • cn=replica,cn=dc\3Dipa...,cn=mapping tree,cn=config (actual name depends on environment)

The settings must be added/updated as part of a regular installation or update:

  • ipa-server-install
  • ipa-server-upgrade
  • ipa-replica-install
  • ipa-ca-install
  • ipa-kra-install (?)

Metadata Update from @cheimes:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1565633

Metadata Update from @pvoborni:
- Issue set to the milestone: FreeIPA 4.5.5 (was: FreeIPA 4.5)

Metadata Update from @cheimes:
- Issue assigned to cheimes

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1800

master:

  • afc0d4b62d043cd568ce87400f60e8fa8273495f Add nsds5ReplicaReleaseTimeout to replica config

master:

  • 7c8fd5630da2de5d3c88cd5fec7787427259f123 Fix upgrade (update_replica_config) in single master mode

ipa-4-5:

  • 8a0d4fe4bf687c4bd8d31a04e62a117b6cc25338 Add nsds5ReplicaReleaseTimeout to replica config
  • cec72336df35a5b789fd75a6f10bb76b7be35d1e Fix upgrade (update_replica_config) in single master mode

ipa-4-6:

  • 0f7acc34d1edcdb9d297dd21e7c86e1d7b876932 Add nsds5ReplicaReleaseTimeout to replica config
  • 34078ca90b8ef556d9709ae3ee784b131d4b46e5 Fix upgrade (update_replica_config) in single master mode

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 84ae625fe2c3786f7c5430f23a55c171ff54e110 check nsds5ReplicaReleaseTimeout option was set

master:

  • 811b0fdb4620938963f1a29d3fdd22257327562c Tune DS replication settings

ipa-4-6:

  • 6ba653c13b0c3693c84eb648febdb521110dbcd0 Tune DS replication settings

ipa-4-5:

  • ec6090180ccd5c6a05d95bd87085b77e51e9c0a1 replicainstall: DS SSL replica install pick right certmonger host
  • 5ef8333dfbb9c6290b2bb7b762c53c6871a05df1 Fix race condition in get_locations_records()
  • a9cc862df7ba99126bd7cfaf8cfb2f78cb944ac8 Tune DS replication settings
  • 79fe98166cf66418b99d7cbdcaf09c9bd246224b Auto-retry failed certmonger requests
  • f3dd0cb2f0227568aa6058e46a31ac7123b3a43b Wait for client certificates
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1800
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.