freeipa

#7566 Installation of replica against a specific master
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

This can be viewed as both RFE and a bug.

Request for enhancement

As an administrator, I want to install a replica(promote client) against a specific server so that it doesn't pick a replica which is unreachable(e.g. the replica is on different site) for the to-be-promoted client. It should not require communicating with other servers as they might be unreachable.

Issue

A replica has several steps when it communicates with another master: getting secrets, creation of service principles, requests of certificates, replication of domain and ca suffixes. It is not guaranteed that all operations will be done against a single master. This can be a cause of race-conditions when something is created on one master, but replica communicates with another master where it was not yet replicated thus failing the installation.

Also in environments with split topology (error state), the replica installation can be a CA server in disconnected CA suffix and thus fail.

Actual behavior

In some race conditions and error conditions, replica installation might fail.

Expected behavior

Replica installation will be more robust.

So the use cases are:

  • installation of a replica in a network with some masters behind a firewall
  • more robust installation, e.g. multiple replicas in parallel, in split topology

Version/Release/Distribution

$ every IPA release till this date (May 28 2018 - unreleased 4.7), maybe after an introduction of replica promotion

Additional information:

A proposal for behavior:

  • If the supplied master doesn't fulfill prerequisites - e.g. doesn't have CA/KRA server then installation should fail.
  • If no server is provided then replica should pick one automatically (e.g. similarly as now) and then behave as it was picked

Related: #7518

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.6.4

Metadata Update from @frenaud:
- Issue priority set to: important

Metadata Update from @rcritten:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.6.4)

Related: #7587

Metadata Update from @pvoborni:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1591824

Issue linked to bug 1591824

PR https://github.com/freeipa/freeipa/pull/2048 addresses one issue with CA replication peer selection.

master:

  • 8c3ff0308c95793a6809b8e0a3ed2a145ad3c8ea Always set ca_host when installing replica

ipa-4-6:

  • 14519c2d083e71918deeec98dc72621ff6b298e7 Always set ca_host when installing replica

ipa-4-5:

  • 2c471b529c4701b2d8b1e88a8186d0cda641fa90 Always set ca_host when installing replica

master:

  • 7c2ca14118f3396b2b4ca4ac4d4d986569349415 Query for server role IPA master
  • 10457a01bf6077e6978b3672dbbd7dc86a170e91 Only create DNS SRV records for ready server
  • 7284097eedef70dd556270732e6ab8e23501ce09 Delay enabling services until end of installer

ipa-4-5:

  • 4085d1e7fbe7f0ce22382505cb25cd76fbe1e470 Query for server role IPA master
  • 54a7eefc350f615f985f4ee32c92e773333dd8e1 Only create DNS SRV records for ready server
  • 2142a5beef1e5c5cc5b2ac3191e81ebc4809ed16 Delay enabling services until end of installer

ipa-4-6:

  • e70c9223fd983fb7d2c95c138cc8e807bda41be9 Query for server role IPA master
  • ce8890836854e41d6d3766894979110529858936 Only create DNS SRV records for ready server
  • 8fd206f4abdace679b5a852b867f1cf95426ebee Delay enabling services until end of installer

master:

  • 8fa767622f2e3f40109cbb85b7d3dccfd4e33a2e Fix CA topology warning

master:

  • f29412729e0a6b81f42043a93682bd944f0afa8a replicainstall: DS SSL replica install pick right certmonger host

ipa-4-6:

  • a5de02ba2f6e020f0af0937937077e73c59d89b2 Fix CA topology warning

ipa-4-6:

  • f5aa209e5d662e3b59135bf8b1511cfabd8110f1 replicainstall: DS SSL replica install pick right certmonger host

master:

  • 199d50a4c8ac2dd96a8bca3af4a90e4a9c05adf9 Fix race condition in get_locations_records()

ipa-4-6:

  • 3679e6ab2922ac036ee39cc61c88652149e63081 Fix race condition in get_locations_records()

ipa-4-5:

  • ec6090180ccd5c6a05d95bd87085b77e51e9c0a1 replicainstall: DS SSL replica install pick right certmonger host
  • 5ef8333dfbb9c6290b2bb7b762c53c6871a05df1 Fix race condition in get_locations_records()
  • a9cc862df7ba99126bd7cfaf8cfb2f78cb944ac8 Tune DS replication settings
  • 79fe98166cf66418b99d7cbdcaf09c9bd246224b Auto-retry failed certmonger requests
  • f3dd0cb2f0227568aa6058e46a31ac7123b3a43b Wait for client certificates

master:

  • 9222a08c288159a7a150923a2eb825a47da36a13 Fix DNSSEC install regression

ipa-4-5:

  • 56e03098c6166c546be0543a3763545778fa37d4 Fix DNSSEC install regression

ipa-4-6:

  • 87466d167f2744ff81d38880cec60a1b9f8e2783 Fix DNSSEC install regression

master:

  • f89e501ee13ce4d5f23ef33e3acacb181788fa5e Handle races in replica config

ipa-4-6:

  • 2394463263ed6ee62313faaf6e5184a3e9072777 Handle races in replica config

ipa-4-5:

  • 572103d2578491c847dbfa82c40469d1e9c5f94d Handle races in replica config

master:

  • 6175672e8e11a5fb0a813ea11513efffb704a672 Do not set ca_host when --setup-ca is used

ipa-4-6:

  • c4481d71a9a57b89366b02f86f99fc84b5d9d320 Do not set ca_host when --setup-ca is used

ipa-4-5:

  • 35958aa15bd96ec30b5d700f99995a9bddd20c95 Do not set ca_host when --setup-ca is used

ipa-4-7:

  • 15ce6c819e239eb58749a7c96a16984103c18675 Do not set ca_host when --setup-ca is used

master:

  • 6175672e8e11a5fb0a813ea11513efffb704a672 Do not set ca_host when --setup-ca is used

ipa-4-5:

  • 35958aa15bd96ec30b5d700f99995a9bddd20c95 Do not set ca_host when --setup-ca is used

ipa-4-6:

  • c4481d71a9a57b89366b02f86f99fc84b5d9d320 Do not set ca_host when --setup-ca is used

ipa-4-7:

  • 15ce6c819e239eb58749a7c96a16984103c18675 Do not set ca_host when --setup-ca is used

master:

  • 2a227c240fae802d3625805e0905a8ce71706b2f ipa-replica-install: fix pkinit setup
  • bcfd18f336d752483dffc048e1d9c0edac1628fd Tests: test successful PKINIT install on replica

ipa-4-5:

  • 2ff9684f14c14bcdf4a520c5e00cfe4030868143 ipa-replica-install: fix pkinit setup
  • 5b8531eb8f91c689cba1313dd2a7387f7bb5b5fa Tests: test successful PKINIT install on replica

ipa-4-6:

  • e02041d9797c2478da27bace65bfc6853afcb638 ipa-replica-install: fix pkinit setup
  • 2a2fd0829e7b768974365b01ea540dc16e705199 Tests: test successful PKINIT install on replica

ipa-4-7:

  • 09c78a1e07056eea1036d974bcdfd8c00a254733 ipa-replica-install: fix pkinit setup
  • 5ea8f8ae9d250b86d66d20df95293a71dc40eb46 Tests: test successful PKINIT install on replica

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1591824, https://bugzilla.redhat.com/show_bug.cgi?id=1754494 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1591824)

Issue linked to Bugzilla: Bug 1754494

master:

  • 802e54dd0e33be6015b22853767fc37a9ec02f39 replica install: enforce --server arg

ipa-4-8:

  • c845ef07892eb22118f381e9cb1f05b017099896 replica install: enforce --server arg

ipa-4-7:

  • 6c5e72aee4dffb353b79b99324858bf2a1ec7314 replica install: enforce --server arg

ipa-4-6:

  • 22e4eef6cb54c74fc9907db1385549db670094fa replica install: enforce --server arg

master:

  • c2c1000e2d5481d4be377feb12588fdb09d12de0 Installation of replica against a specific server
  • c77bbe7899577cb14b42625953f1b9a868e6f237 Add test to nightly yamls

ipa-4-8:

  • b6134e86b377a2804efbfac1d78091a460898d0c Installation of replica against a specific server
  • b585e58b845ccecd48934f55c664a12b8ed06fc8 Add test to nightly yamls.

ipa-4-7:

  • e12fa0b88371962e3684c6b932980c3ac0ab8e1d Installation of replica against a specific server
  • 16c794d8a3d7d690883da5b29c5c04a203a2b8db add test to nightly yaml

ipa-4-6:

  • f4dc0ee169689974020a4a77b8bb58b26f360369 Installation of replica against a specific server
  • 9b3855ec486990ecd08a9f3a0ca408425ee7fbf7 Add test to nightly.yaml

ipa-4-6:

  • 0d91a78ee409e66f96e7b2555ca33fb2128fdfa3 Add promote option to install_replica() method

Metadata Update from @frenaud:
- Issue set to the milestone: None (was: FreeIPA 4.6.5)
Metadata
None
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.