Bug 1296216

Summary:	ipa-server-upgrade fails if certmonger is not running
Product:	Red Hat Enterprise Linux 7	Reporter:	Petr Vobornik <pvoborni>
Component:	ipa	Assignee:	Martin Babinsky <mbabinsk>
Status:	CLOSED ERRATA	QA Contact:	Namita Soman <nsoman>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	7.3	CC:	ekeck, enewland, jcholast, ksiddiqu, mbasti, mkosek, ndehadra, orion, rcritten
Target Milestone:	rc	Keywords:	Regression, ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ipa-4.2.0-16.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1298103 (view as bug list)		Environment:
Last Closed:	2016-11-04 05:48:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1298103

Description Petr Vobornik 2016-01-06 15:49:59 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5519

I have a CA-less install (with --root-ca-file) and so certmonger is not configured to run.  ipa-server-upgrade from 4.2.0 fails in this situation with:
{{{
2015-12-07T17:47:46Z DEBUG Starting external process
2015-12-07T17:47:46Z DEBUG args='/bin/systemctl' 'is-active' 'certmonger.service'
2015-12-07T17:47:46Z DEBUG Process finished, return code=3
2015-12-07T17:47:46Z DEBUG stdout=unknown

2015-12-07T17:47:46Z DEBUG stderr=
2015-12-07T17:47:46Z ERROR IPA server upgrade failed: Inspect
/var/log/ipaupgrade.log and run com
mand ipa-server-upgrade manually.
2015-12-07T17:47:46Z DEBUG   File
"/usr/lib/python2.7/site-packages/ipapython/admintool.py", line
 171, in execute
    return_value = self.run()
  File
"/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py",
line 50, in ru
n
    raise admintool.ScriptError(str(e))

2015-12-07T17:47:46Z DEBUG The ipa-server-upgrade command failed, exception:
ScriptError: Certmon
ger is not running. Start certmonger and run upgrade again.
2015-12-07T17:47:46Z ERROR Certmonger is not running. Start certmonger and run
upgrade again.
}}}

Comment 3 Jan Cholasta 2016-01-11 08:09:17 UTC

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/f55a228f5ddab45fdea884eee93eac9890cf093d
ipa-4-3:
https://fedorahosted.org/freeipa/changeset/0097558d3f5b56c7db930fc951bbdb6b46abbcc5

Comment 4 Martin Kosek 2016-01-12 15:58:33 UTC

Upgrade issue - high sev/prio.

Comment 7 Martin Bašti 2016-02-01 11:55:07 UTC

This patch causes upgrade regression https://fedorahosted.org/freeipa/ticket/5655

Comment 8 Martin Bašti 2016-02-02 12:58:15 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5655

Comment 9 Petr Vobornik 2016-02-02 13:00:50 UTC

Ticket 5655 is fixed.

Comment 10 Martin Bašti 2016-02-02 13:02:06 UTC

master:

612f4aa9003658f9a494ec327d50ec5a0592f7b4 always start certmonger during IPA server configuration upgrade
ipa-4-3:

d99552a8a9f855a7c5e00c4b0736061e05d6ed31 always start certmonger during IPA server configuration upgrade
ipa-4-2:

3664efa31edf0dff6dd3410e2eccd12c9cd25782 always start certmonger during IPA server configuration upgrade

Comment 12 Nikhil Dehadrai 2016-08-08 10:25:15 UTC

IPA server version: ipa-server-4.4.0-3.el7.x86_64

Verified the bug on the basis of following steps:
1. Verified that no error message like "ERROR Certmonger is not running" is observed during upgrade of IPA server.
2. Verified the bug for upgrade paths:
   a) 7.2(GA) to 7.3
   b) 7.2.z to 7.3 (In my case upgrade from 7.2up6)

 Thus on the basis of above observations marking the status of bug to "VERIFIED".

Comment 15 errata-xmlrpc 2016-11-04 05:48:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html