Bug 1398594
| Summary: | ipa topologysuffix-verify should only warn about maximum number of replication agreements. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | German Parente <gparente> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.3 | CC: | fbarreto, myusuf, pvoborni, rcritten |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.5.4-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 16:40:25 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
We have recommendation in docs that max 4 replication agreements should be used https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html-single/Linux_Domain_Identity_Authentication_and_Policy_Guide/index.html#replica-topology-recommendations I'm totally against of removal this check, users should be informed that they don't follow recommendations and putting themselves to risk and inefficient replication. But to not scary people we may transform this to warning. Upstream ticket: https://fedorahosted.org/freeipa/ticket/6533 Fixed upstream master: https://pagure.io/freeipa/c/777bf46b2da045e537724641adec4a3ab454323f ipa-4-5: https://pagure.io/freeipa/c/bccf065a881ee3e81165ca69e9a915d292d51136 version:
ipa-server-4.5.4-7.el7.x86_64
Steps:
1. Install Master with 5 replica just to exceed the recommended limit.
2. $ ipa topologysuffix-verify domain
Actual result:
[root@master ~]# ipa topologysuffix-verify domain
-------------------------------------------------------------
Recommended maximum number of agreements per replica exceeded
-------------------------------------------------------------
Maximum number of agreements per replica: 4
Server "master.testrelm.test" has 5 agreements with servers:
replica1.testrelm.test
replica2.testrelm.test
replica3.testrelm.test
replica4.testrelm.test
replica5.testrelm.test
[root@master ~]# ipa server-find
---------------------
6 IPA servers matched
---------------------
Server name: master.testrelm.test
Min domain level: 0
Max domain level: 1
Server name: replica1.testrelm.test
Min domain level: 0
Max domain level: 1
Server name: replica2.testrelm.test
Min domain level: 0
Max domain level: 1
Server name: replica3.testrelm.test
Min domain level: 0
Max domain level: 1
Server name: replica4.testrelm.test
Min domain level: 0
Max domain level: 1
Server name: replica5.testrelm.test
Min domain level: 0
Max domain level: 1
----------------------------
Number of entries returned 6
----------------------------
Warning can be seen when recommended replication agreement exceeded.
Based on above observation marking the bug verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0918 |
Description of problem: ipa topologysuffix-verify domain ======================================================== Replication topology of suffix "domain" contains errors. ======================================================== ------------------------------------------------------------- Recommended maximum number of agreements per replica exceeded ------------------------------------------------------------- Maximum number of agreements per replica: 4 Server "p0029ipa03.unix.local" has 5 agreements with servers: i22ldap-ipa02.unix.local p0029ipa04.unix.local p00iuipa02.unix.local p029i35ipa02.unix.local p00iuipa02.unix.local the message should turn into a warning or let's disable this check since lots of customers have more than 4 agreements per replica. Version-Release number of selected component (if applicable): python2-ipaclient-4.4.0-12.el7.noarch Additional info: source code: ======================== ======================== if max_agmts_errors: textui.print_dashed(unicode(_('Recommended maximum number of ' 'agreements per replica exceeded'))) ======================== # check if suggested maximum number of agreements per replica max_agmts_errors = [] for m in master_cns: # chosen direction doesn't matter much given that 'both' is the # only allowed direction suppliers = graph.get_tails(m) if len(suppliers) > self.api.env.recommended_max_agmts: max_agmts_errors.append((m, suppliers)) ======================= # Topology plugin ('recommended_max_agmts', 4), # Recommended maximum number of replication # agreements ========================