Bug 2175755

Summary:	[ansible-freeipa] ipaclient does not maintain server affinity during deployment
Product:	Red Hat Enterprise Linux 8	Reporter:	Thomas Woerner <twoerner>
Component:	ansible-freeipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Varun Mylaraiah <mvarun>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.9	CC:	mvarun, tscherf
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ansible-freeipa-1.10.0-1.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2175757 2189238 2189239 2189240 (view as bug list)		Environment:
Last Closed:	2023-11-14 15:26:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2175757, 2189238, 2189239, 2189240

Description Thomas Woerner 2023-03-06 13:14:15 UTC

Description of problem:
A temporary krb5 configuration was used to join the domain in ipaclient_join. After that the final krkb5 configuration was created with enabled DNS discovery and used for the remainaing tasks, where also a connection to the IPA API was done.

With several servers the DNS discovery could have picked up a different server. If the client deployment was faster than the replication this could have lead to an unknown host error.

The issue was seen in FreeIPA ipa-client-install in performance testing where many simultaneous client enrollments have been done. This is the fix for ansible-freeipa ipaclient role.

Version-Release number of selected component (if applicable):
ansible-freeipa-1.9.2

Additional info:
FreeIPA upstream ticket: https://pagure.io/freeipa/issue/9228
ipa bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2148259

Comment 1 Thomas Woerner 2023-03-06 13:20:19 UTC

Upstream PR: https://github.com/freeipa/ansible-freeipa/pull/1050

Comment 2 Thomas Woerner 2023-04-04 11:32:32 UTC

Additional upstream fix: https://github.com/freeipa/ansible-freeipa/pull/1067

Comment 7 Varun Mylaraiah 2023-04-19 16:29:12 UTC

Verified
ansible-2.9.27-1.el8ae.noarch
ansible-freeipa-1.10.0-1.el8.noarch

2023-04-19T14:24:09+0000 =========================== short test summary info ============================
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC03_14::test_auto_discovery
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC03_14::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientAllowRepair::test_client_allow_repair
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientAllowRepair::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC04::test_vault
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC04::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC05::test_otp_vault
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC05::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC06::test_specified_server
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC06::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC07::test_specified_server_otp
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC07::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC08::test_specified_server_otp_vault
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC08::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC09::test_all_options
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC09::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC10::test_keytab
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC10::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC11::test_keytab_otp
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC11::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC13::test_multiple_client_auto_discovery
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC13::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC26::test_specified_server_keytab_otp
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC26::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC27::test_otp_without_krb5_pkgs
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC27::test_client_uninstall
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestDNSResolver::test_config_dns_resolver
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestDNSResolver::test_cleanup_dns_resolver
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC28::test_nss_setup
2023-04-19T14:24:09+0000 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC28::test_client_uninstall
2023-04-19T14:24:09+0000 ================== 30 passed, 1 warning in 1932.54s (0:32:12) ==================

Comment 12 errata-xmlrpc 2023-11-14 15:26:23 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ansible-freeipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6926