freeipa

#7892 Implement hidden / unadvertised IPA replicas
Closed: fixed by cheimes. Opened by cheimes.

Closed: fixed
Reopen Issue

Implement the ability to have a hidden replica.

A hidden replica is an IPA master server that is not advertised to clients or other masters. Hidden replicas have all services running and available, but none of the services has any DNS SRV records or enabled LDAP server roles. This makes hidden replicas invisible for service discovery.

master:

  • 025facb85c9be9606430498629ff723a8c24ab0f Add hidden replica feature
  • 0770d8a004db41d24f1c3f41e108a2bfd580a822 ipatests: Exercise hidden replica feature
  • 99133eb12bf6a403a10fafd5e8fd227f90d4515d Simplify and improve tests
  • 94b86354b5bec565d65f2995758e560d805c09c7 Implement server-state --state=enabled/hidden
  • d810e1ff2f1fcee41131e359235540e8cada7d47 Consider hidden servers as role provider
  • 56d97f942b02de1b6f1755c898ce0aab8c30494a Improve config-show to show hidden servers
  • f839d3c916a50442e0926e73b27504ad66283492 More test fixes
  • e7e0f190bb459e9b80f3a000fd686cd2367f6c62 Don't allow to hide last server for a role
  • 8b1bb211c48f22bf920504d06289a9c232777f6f Synchronize hidden state from IPA master role
  • e04dc9a8e168c762fe8ad34d0c19992f4357fd14 Test replica installation from hidden replica
  • d727321ce30ae78c3b159211c3996d0c5cb96070 Add design draft
  • 713c9b0ce89ce9835b78c25d3c7b46bb0d71bd83 Don't fail if config-show does not return servers

One remaining issue is that restoring a backup from a hidden replica results in an enabled (e.g. not hidden) server. Issue logged at https://pagure.io/freeipa/issue/7894

ipa-4-6:

  • cb8534280ab90ac3ef768972a2382b053ae0b9f5 Add hidden replica feature
  • 016c47fa1f644eaa30e78bccb9ad795cb4285929 ipatests: Exercise hidden replica feature
  • 76911627a5ae3957c027ca9a0bd1e96f6d98c3c8 Simplify and improve tests
  • da9f62d7bbe3a4a22698374dd9b5b03236058611 Implement server-state --state=enabled/hidden
  • d12cca47fbd28ea9da09b2b84cd1bdbcf28ac0a5 Consider hidden servers as role provider
  • ed0046664699e2b3880ca46c1e4404246735e005 Improve config-show to show hidden servers
  • 131c1ab6e929de80d4e473994cacf48a2706026b More test fixes
  • bcf70c5fa96f2dd90d3f385c3caa14a0a07ff090 Don't allow to hide last server for a role
  • d8d6799de0654153145390bd0a01ec6a467b9057 Synchronize hidden state from IPA master role
  • e40d92f0f90bd436a5d92cf8d22702afb09d1f42 Test replica installation from hidden replica
  • d1eb4c7395229f99f50d46d28edc7f97f82666bb Add design draft
  • a0f00e60f19df15fced2956b6f0b1c42ae477525 Don't fail if config-show does not return servers

ipa-4-7:

  • ddf8e16a6b506d0081b1ec9a5b2cf1cb77f9217e Add hidden replica feature
  • f96f4a19d87d23e3b1dcd596cdf5f64535ac5694 ipatests: Exercise hidden replica feature
  • 585bc52b4444df9dda985bd17558e549864a7849 Simplify and improve tests
  • f3daa45cbdae7f5737e18edf10bb79916ddb5b12 Implement server-state --state=enabled/hidden
  • 0bf26c59c3a68858af57f2b7246a552650c2ed28 Consider hidden servers as role provider
  • de1a075b775fedc9f5e54f3e56634159de1e9ed8 Improve config-show to show hidden servers
  • 3e2fb2156feee334f828436219d1e3de2ee3e3d1 More test fixes
  • dc2a5ece21920ed2f6234bf6e635dbb6758a73d5 Don't allow to hide last server for a role
  • 87f9119a501f9396ab79d53e738856a4ff3ba7a3 Synchronize hidden state from IPA master role
  • 467ceaffa25409adfd26a5fe2668a760f544403c Test replica installation from hidden replica
  • 66c961da269a1a5fceb0805fe329acd07c83d390 Add design draft
  • c76620efa598f78bc8f591846fbe364bacc13f0f Don't fail if config-show does not return servers

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

rfe

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.