Bug 1199516

Summary: [RFE] Move replication topology to the shared tree
Product: Red Hat Enterprise Linux 7 Reporter: Martin Kosek <mkosek>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 7.0CC: akasurde, jcholast, pvoborni, rcritten
Target Milestone: rcKeywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-4.3.1-0.201605191449GITf8edf37.el7 Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-04 05:44:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 837369, 1199520, 1206588    
Bug Blocks: 1206591, 1296125, 1298848, 1313485    
Attachments:
Description Flags
tkt_4997.png
none
tkt_4302_1.log
none
tkt_4302_2.log none

Description Martin Kosek 2015-03-06 14:37:21 UTC 
The current way to handle replication, is cumbersome and makes it difficult to properly handle replication topology.

Create a new replication topology subtree under the cn=etc tree that will have a simplified schema to list the replication agreements between servers, and have a global configs for things like excluded replication attributes.

The idea is that admins would change objects in this shared tree and these changes would then be reflected in actual replication agreement changes in cn=config as a consequence.

Advantages (in no particular order):

* it becomes possible to easily visualize the topology w/o having to contact multiple servers
* it is possible to centrally remove a server and have all other server remove the relevant replication agreement w/o having to contact every single server
* it is possible to have a topology checker that uses graph theory
* it is possible to use said checker to prevent split brain situations by simply denying (LDAP_UNWILLING_TO_PERFORM) changes that would break the graph
* it is possible to create new agreements remotely w/o direct access to the replica just by virtue of replication of the shared tree.
* it will be possible to create multiple replication typologies for different database (ie one for main tree and one for CA data) and have distinct checks for all of them.

In the first version, the Web UI should be able to display at least read only graph of the replicas.
Comment 1 Petr Vobornik 2015-04-14 15:34:54 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3053
Comment 2 Petr Vobornik 2015-04-21 14:01:24 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4997
Comment 3 Petr Vobornik 2015-05-26 08:45:06 UTC 
ds plugin implemented upstream:

master:
https://fedorahosted.org/freeipa/changeset/25bf0c6e78dca62e7fa11cd654ed0d8675408176

installation part:
master:
https://fedorahosted.org/freeipa/changeset/4bcc2546d59041f0d09960d6f9d44ca68bd424e1
Comment 4 Jan Cholasta 2015-05-26 12:18:06 UTC 
master:
https://fedorahosted.org/freeipa/changeset/41662eb9f02fc6bf1399508a13de8d6f18d7b3b1
Comment 5 Petr Vobornik 2015-05-28 11:20:39 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5035
Comment 6 Petr Vobornik 2015-06-02 13:58:38 UTC 
master:
https://fedorahosted.org/freeipa/changeset/faa4d0b6ea6e911c1098b070d1959b3106d5b5b2
Comment 7 Petr Vobornik 2015-06-04 09:48:33 UTC 
master:
https://fedorahosted.org/freeipa/changeset/4e05ffa22c4880e393f4770fe64035fa93cb5fd1
https://fedorahosted.org/freeipa/changeset/f87324df546055df1e7d038e63c04bb0d2250f55
https://fedorahosted.org/freeipa/changeset/8457edc14dade724b486540800bcdafb7d9a6f76
Comment 8 Petr Vobornik 2015-06-04 10:09:34 UTC 
master:
https://fedorahosted.org/freeipa/changeset/b189e66298816c3414e027c914b5e62f30512330
Comment 9 Petr Vobornik 2015-06-04 11:24:42 UTC 
Web UI, master:
master:
https://fedorahosted.org/freeipa/changeset/604331f0bedf65b6c61a9c1b2d743d5d965576a9
https://fedorahosted.org/freeipa/changeset/ed78dcfa3acde7aeb1f381f49988c6911c5277ee
https://fedorahosted.org/freeipa/changeset/55bf33cce2ff6bcd49e2281dff31b2a2e24e6fb2
https://fedorahosted.org/freeipa/changeset/538178b53dcb6ecb7a2f1892d648a86202afb7ce
https://fedorahosted.org/freeipa/changeset/0138595f581d4b8ed76622d067e8dba0c29fd62f
Comment 10 Petr Vobornik 2015-06-10 12:17:17 UTC 
master:
https://fedorahosted.org/freeipa/changeset/4232c39f6767d27b9f812a15cfc5ee2c5be69d5e
https://fedorahosted.org/freeipa/changeset/2661a860e0049c75088fffe2765d67b051c31c9b
Comment 11 Petr Vobornik 2015-06-11 12:03:31 UTC 
master:
https://fedorahosted.org/freeipa/changeset/7cf82cf9aac6cc5ecb8d575ce4f141ab2afa85a2
https://fedorahosted.org/freeipa/changeset/99ce650b59dbf9da7dc95f1cade91fcfa55b8375
https://fedorahosted.org/freeipa/changeset/ae56ca422d1897569717fa44a5d483b10e490f6a
https://fedorahosted.org/freeipa/changeset/c9cbb1493a8c9e10020c7f2104a345cd43535259
https://fedorahosted.org/freeipa/changeset/5089dde2cdbe22cabdbf74f325711ea5dcc22490
https://fedorahosted.org/freeipa/changeset/b3c2a4b810bfe31dc544648de8fe98dbb84ec320
https://fedorahosted.org/freeipa/changeset/056518ab1af36fa4a8d7b4450616145aa0dbfd16
Comment 12 Petr Vobornik 2015-06-15 15:00:45 UTC 
master:
https://fedorahosted.org/freeipa/changeset/6b153ba876edf1ed9249ed29420a4af2b2e1830d
https://fedorahosted.org/freeipa/changeset/bb6c0b9c634f26ae5d16079b3a66841ac0ce60cc
https://fedorahosted.org/freeipa/changeset/45dccedd12e6d26e146ad9c30c2c304e6b2eded1
https://fedorahosted.org/freeipa/changeset/d58bdf29a514a7868c63b767f4954891b10a574d
https://fedorahosted.org/freeipa/changeset/e9e4509b10e5064556f0aa9a6f0124f38f14b31b
Comment 13 Petr Vobornik 2015-06-29 15:22:21 UTC 
master:
https://fedorahosted.org/freeipa/changeset/659b88b8205ef403aa9162453472e4731d93d13b
https://fedorahosted.org/freeipa/changeset/5397150979a474f6df82e6df5287e1cc678a3479
Comment 14 Martin Kosek 2015-06-30 10:50:31 UTC 
The functionality is there. From now on, the feature is in bugfixing mode upstream.
Comment 15 Martin Kosek 2015-07-07 07:49:06 UTC 
Topology feature was postponed in the upstream project, to FreeIPA 4.3 which should closely follow FreeIPA 4.2 release.

See the reasoning and details in:
http://www.redhat.com/archives/freeipa-devel/2015-July/msg00092.html
Comment 16 Petr Vobornik 2016-01-22 09:38:28 UTC 
has been fixed upstream
Comment 17 Mike McCune 2016-03-28 22:42:18 UTC 
This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions
Comment 19 Abhijeet Kasurde 2016-08-17 09:22:32 UTC 
Created attachment 1191511 [details]
tkt_4997.png
Comment 20 Abhijeet Kasurde 2016-08-19 08:23:53 UTC 
Created attachment 1192067 [details]
tkt_4302_1.log
Comment 21 Abhijeet Kasurde 2016-08-19 08:24:13 UTC 
Created attachment 1192068 [details]
tkt_4302_2.log
Comment 22 Abhijeet Kasurde 2016-08-19 08:27:51 UTC 
Verified RFE BZ using ipa version ::
ipa-server-4.4.0-8.el7.x86_64

Marking BZ as verified. Please see attachments for verification steps.
Comment 24 errata-xmlrpc 2016-11-04 05:44:31 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html