Bug 1541659
| Summary: | file conflicts between python2-mod_wsgi and freeipa-server | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | George R. Goffe <grgoffe> |
| Component: | freeipa | Assignee: | Christian Heimes <cheimes> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 28 | CC: | abokovoy, bkabrda, cheimes, cstratak, dmalcolm, ipa-maint, jhrozek, mcyprian, mhroncok, pviktori, pvoborni, rcritten, rkuska, ssorce, tomspur, torsava |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-03-20 17:45:52 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
George R. Goffe
2018-02-03 19:34:36 UTC
It's not file conflict but a package conflict. I added the conflict on purpose. It's not possible to load the Apache mod_wsgi (Python 2) and python3-mod_wsgi modules at the same time. Only one of them can be enabled at the same time. Since IPA 4.6, the server runs on Python 3. I added a conflict with mod_wsgi to avoid bugs. You have to install or upgrade with ``dnf install --best --allowerasing`` or remove mod_wsgi before you install IPA. I talked to Charalampos. We will try to find a better way to solve the issue. I also think package Conflicts: arent' the way to go here. The guidelines say "we can usually make it so that conflicting packages can be installed and the user can decide which package to enable afterwards" ... and they only get stricter after that. It looks like python2-mod_wsgi and python3-mod_wsgi already have a check, so only one can be loaded at once. And that is check is in /etc, packaged as %config -- which sounds like what the guidelines intended. Would it be possible for IPA to detect if the wrong mod_wsgi is loaded, and give a reasonable error message on startup? Then the admin can uninstall python2-mod_wsgi manually, a better experience than what DNF will give you. Charalampos told me that RPM conflict is problematic because only distribution upgrades use --best --allowerasing. Standard updates do not.
However we need to ensure that freeipa-server-4.6.* uses python3-mod_wsgi. If both Python 2 and Python 3 variant is installed, then we may end up with Python 2 mod_wsgi, which breaks the server.
The packages can be installed at the same time, but only one module can be loaded:
$ cat /etc/httpd/conf.modules.d/10-wsgi-python3.conf
# NOTE: mod_wsgi_python3 can not coexist in the same apache process as
# mod_wsgi (python2). Only load if mod_wsgi is not already loaded.
<IfModule !wsgi_module>
LoadModule wsgi_module modules/mod_wsgi_python3.so
</IfModule>
We cannot fix the issue in /etc/httpd/conf.d/ipa.conf because the config file is loaded **after** the module configs. /etc/httpd/conf/httpd.conf first "Include conf.modules.d/*.conf", then "IncludeOptional conf.d/*.conf".
I could remove the package conflict and install a freeIPA config file (/etc/httpd/conf.modules.d/02-ipa-wsgi-python3.conf) instead. The 02 prefix ensure that it gets loaded before the package config file from mod_wsgi is loaded.
# NOTE: mod_wsgi_python3 can not coexist in the same apache process as
# mod_wsgi (python2). Only load if mod_wsgi is not already loaded.
BTW We need to do it the other way around (some day).
Christina, the long term solution is to stop using the common apahce config file and system unit file and write our own config file and unit file complitely separate fro the system ones. It'd be nice to use this bugs as an excuse to finally do so. Upstream ticket: https://pagure.io/freeipa/issue/7394 Fixed upstream master: https://pagure.io/freeipa/c/1785a3e17b9196ac661074ae66c4774d720358fb ipa-4-6: https://pagure.io/freeipa/c/3336051a9feb70ceab32e43015caced82d79eb5f This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'. Should be fixed in freeipa-4.6.90.pre1-3.fc28. |