Issue

Enabling DNSSEC key master role on an IPA server causes it to get stuck on shutdown/reboot.

Steps to Reproduce

1. ipa-server-install
2. ipa-dns-install --dnssec-master
3. systemctl reboot

Actual behavior

The system gets stuck, with most services terminated but never actually rebooting.

Expected behavior

The system reboots as usual.

Version/Release/Distribution

ipa-server-4.12.2-5.el9.x86_64
ipa-client-4.12.2-5.el9.x86_64
389-ds-base-2.5.2-2.el9.x86_64
idm-pki-server-11.5.1-1.el9.noarch
krb5-server-1.21.1-4.el9.x86_64
opendnssec-2.1.10-1.el9.x86_64

Additional info:

It seems like on shutdown/reboot there appears a systemd dependency loop, preventing the machine from shutting down.

I'm not overly familiar with systemd, but using its debug shell I was able to inspect the services that are still running after systemctl reboot and indeed seems like the X: stopping held back, waiting for Y statuses are chained. The chain is as follows:
ipa.service (waits for the the systemctl stop ipa-ods-exporter.service ipa-ods-exporter.socket command to finish, which it never does) -> ipa-ods-exporter.socket -> sockets.target -> basic.target -> NetworkManager.service -> network.target -> ipa.service