This issue can be reproduced also on RPM based installs (no containers):
1.) install a master
2.) install a replica
3.) reboot a replica
4.) try to login to WebUI on the replica
login fails due to missing /var/run/ipa directory
login works and WebUI is fully functional.
Moreover, upon replica VM restart only directory server is running, all other services are stopped. When running `ipactl restart` I see the following error:
Failed to get service list from file: Unknown error when retrieving list of services from file: [Errno 2] No such file or directory: '/var/run/ipa/services.list'
This is also caused by the missing configuration in /etc/tmpfiles.d. A proper solution would be to ship a ipa-specific configuration to /usr/lib/tmpfiles.d/ (where vendor-provided configuration should be placed anyway) via spec file instead of runtime shenanigans. We are adding ipaapi user in spec anyway so we should not encounter issues with missing directory owners anymore.
Note that the code in 38c66896de1769077cd5b057133606ec5eeaf62b first creates the temporary directory, then runs client installation, and then configures systemd-tmpfiles to re-create temporary directories on reboot.
However, in the case of replica, we do not configure systemd-tmpfiles to re-create temporary directories. Instead, we expect upgrade code to handle this.
It looks like in the case of a replica installation we never run upgrade routine at all.
So a potential workaround would be to explicitly run ipa-server-upgrade before rebooting a replica, with or without containers.
ipa-server version: ipa-server-4.5.4-7.el7.x86_64
Verified the bug on the basis of following observations:
1) Log in to webui of replica is successful after reboot when REPLICA is setup on RHEL 75 as fresh install.
2) Log in to webui of replica is successful after reboot when REPLICA is setup as upgraded from RHEL74z to RHEL75.
3) Verified that '/var/run/ipa' directory exists on Replica.
4) Similar behavior is observed with IPA-master after reboot.
[root@ibm-x3650m4-01-vm-01 ~]# tail -1 /var/log/ipareplica-install.log
2018-01-05T11:57:21Z INFO The ipa-replica-install command was successful
[root@ibm-x3650m4-01-vm-01 ~]# rpm -q ipa-server nss
[root@ibm-x3650m4-01-vm-01 ~]# ls -l /var/run/ipa/
drwxrwx---. 2 ipaapi ipaapi 60 Jan 5 08:13 ccaches
-rw-------. 1 root root 19 Jan 5 07:58 renewal.lock
-rw-r--r--. 1 root root 104 Jan 5 08:04 services.list
Thus on the basis of above observations , marking the status of bug to "VERIFIED".
Created attachment 1377493 [details]
Created attachment 1377496 [details]
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.