Bug 2175757

Summary:	[ansible-freeipa] ipaclient does not maintain server affinity during deployment
Product:	Red Hat Enterprise Linux 9	Reporter:	Thomas Woerner <twoerner>
Component:	ansible-freeipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Varun Mylaraiah <mvarun>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.3	CC:	ipa-qe, mvarun, tscherf
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ansible-freeipa-1.10.0-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2175755
Clones:	2189232 2189233 2189234 (view as bug list)		Environment:
Last Closed:	2023-11-07 08:25:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2175755
Bug Blocks:	2189232, 2189233, 2189234

Description Thomas Woerner 2023-03-06 13:15:53 UTC

+++ This bug was initially created as a clone of Bug #2175755 +++

Description of problem:
A temporary krb5 configuration was used to join the domain in ipaclient_join. After that the final krkb5 configuration was created with enabled DNS discovery and used for the remainaing tasks, where also a connection to the IPA API was done.

With several servers the DNS discovery could have picked up a different server. If the client deployment was faster than the replication this could have lead to an unknown host error.

The issue was seen in FreeIPA ipa-client-install in performance testing where many simultaneous client enrollments have been done. This is the fix for ansible-freeipa ipaclient role.

Version-Release number of selected component (if applicable):
ansible-freeipa-1.9.2

Additional info:
FreeIPA upstream ticket: https://pagure.io/freeipa/issue/9228
ipa bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2148259

Comment 1 Thomas Woerner 2023-03-06 13:20:31 UTC

Upstream PR: https://github.com/freeipa/ansible-freeipa/pull/1050

Comment 2 Thomas Woerner 2023-04-04 11:32:41 UTC

Additional upstream fix: https://github.com/freeipa/ansible-freeipa/pull/1067

Comment 7 Varun Mylaraiah 2023-04-20 02:55:02 UTC

Verified

ansible-core-2.14.2-4.el9.x86_64
ansible-freeipa-1.10.0-1.el9.noarch



 =========================== short test summary info ============================
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC03_14::test_auto_discovery
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC03_14::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientAllowRepair::test_client_allow_repair
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientAllowRepair::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC04::test_vault
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC04::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC05::test_otp_vault
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC05::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC06::test_specified_server
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC06::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC07::test_specified_server_otp
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC07::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC08::test_specified_server_otp_vault
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC08::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC09::test_all_options
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC09::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC10::test_keytab
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC10::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC11::test_keytab_otp
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC11::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC13::test_multiple_client_auto_discovery
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC13::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC26::test_specified_server_keytab_otp
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC26::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC27::test_otp_without_krb5_pkgs
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC27::test_client_uninstall
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestDNSResolver::test_config_dns_resolver
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestDNSResolver::test_cleanup_dns_resolver
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC28::test_nss_setup
 PASSED ansible_freeipa_tests/client/test_idm_deploy_client.py::TestClientTC28::test_client_uninstall
 ================== 30 passed, 1 warning in 1704.35s (0:28:24) ==================

Comment 12 errata-xmlrpc 2023-11-07 08:25:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ansible-freeipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6354