Bug 1651679
| Summary: | NTP options fails on ipa replica | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Rob Crittenden <rcritten> |
| Component: | ipa | Assignee: | IPA Maintainers <ipa-maint> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Kaleem <ksiddiqu> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.0 | CC: | frenaud, ksiddiqu, mvarun, pvoborni, rcritten, tscherf, twoerner |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-14 02:04:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Rob Crittenden
2018-11-20 14:56:43 UTC
Fixed upstream: master: https://pagure.io/freeipa/c/2fba5acc5245caf62ec9af8b8707c13f59bfcff4 ipa-4-7: https://pagure.io/freeipa/c/f3e3da509329881c4ba770d1f9418ad180ee98ae Automated tests: master: https://pagure.io/freeipa/c/dde2aa4b16b10f39ed595fef4d2425a4229fd7d5 https://pagure.io/freeipa/c/715d1223dd8d38c12c5a2812248288b20465fafb https://pagure.io/freeipa/c/83487c49f69c6ceef3fddc0c176027c4bed7aab4 Verified
ipa-server-4.7.1-7.module+el8+2555+b334d87b.x86_64
Console Output:
1) Replica installed on a machine that has not yet been enrolled in the IdM domain
[root@replica ~]# ipa-replica-install -w <XXXXXXXXXXXXXXX> -n realmmv082.test -r REALMMV082.TEST --server vm-idm-036.realmmv082.test --ntp-pool=pool.ntp.org --ntp-server=1.pool.ntp.org
Configuring client side components
This program will set up IPA client.
Version 4.7.1
Client hostname: replica.realmmv082.test
Realm: REALMMV082.TEST
DNS Domain: realmmv082.test
IPA Server: vm-idm-036.realmmv082.test
BaseDN: dc=realmmv082,dc=test
Synchronizing time
Configuration of chrony was changed by installer.
Attempting to sync time with chronyc.
Time synchronization was successful.
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=REALMMV082.TEST
Issuer: CN=Certificate Authority,O=REALMMV082.TEST
Valid From: 2019-01-08 11:46:54
Valid Until: 2039-01-08 11:46:54
Enrolled in IPA realm REALMMV082.TEST
Created /etc/ipa/default.conf
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm REALMMV082.TEST
Systemwide CA database updated.
Hostname (replica.realmmv082.test) does not have A/AAAA record.
Missing reverse record(s) for address(es): 10.65.206.143.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring realmmv082.test as NIS domain.
Client configuration complete.
*
*
*
*
[10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
WARNING: The CA service is only installed on one server (vm-idm-036.realmmv082.test).
It is strongly recommended to install it on another server.
Run ipa-ca-install(1) on another master to accomplish this.
[root@replica ~]#
[root@replica ~]# cat /etc/chrony.conf
# These servers were defined in the installation:
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
# Record the rate at which the system clock gains/losses time.
driftfile /var/lib/chrony/drift
# Allow the system clock to be stepped in the first three updates
# if its offset is larger than 1 second.
makestep 1.0 3
# Enable kernel synchronization of the real-time clock (RTC).
rtcsync
# Enable hardware timestamping on all interfaces that support it.
#hwtimestamp *
# Increase the minimum number of selectable sources required to adjust
# the system clock.
#minsources 2
# Allow NTP client access from local network.
#allow 192.168.0.0/16
# Serve time even if not synchronized to a time source.
#local stratum 10
# Specify file containing keys for NTP authentication.
keyfile /etc/chrony.keys
# Get TAI-UTC offset and leap seconds from the system tz database.
leapsectz right/UTC
# Specify directory for log files.
logdir /var/log/chrony
# Select which information is logged.
#log measurements statistics tracking
pool pool.ntp.org iburst
server 1.pool.ntp.org iburst
2) with Replica promotion.
[root@replica ~]# ipa-client-install --domain replica.realmmv082.test --realm REALMMV082.TEST -p admin -w <XXXXXXXXXX> --server vm-idm-036.realmmv082.test
This program will set up IPA client.
Version 4.7.1
Autodiscovery of servers for failover cannot work with this configuration.
If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.
Proceed with fixed values and no DNS discovery? [no]: yes
Client hostname: replica.realmmv082.test
Realm: REALMMV082.TEST
DNS Domain: replica.realmmv082.test
IPA Server: vm-idm-036.realmmv082.test
BaseDN: dc=realmmv082,dc=test
Continue to configure the system with these values? [no]: yes
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Time synchronization was successful.
Successfully retrieved CA cert
Subject: CN=Certificate Authority,O=REALMMV082.TEST
Issuer: CN=Certificate Authority,O=REALMMV082.TEST
Valid From: 2019-01-08 11:46:54
Valid Until: 2039-01-08 11:46:54
Enrolled in IPA realm REALMMV082.TEST
Created /etc/ipa/default.conf
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm REALMMV082.TEST
Systemwide CA database updated.
Hostname (replica.realmmv082.test) does not have A/AAAA record.
Missing reverse record(s) for address(es): 10.65.206.143.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring replica.realmmv082.test as NIS domain.
Client configuration complete.
The ipa-client-install command was successful
[root@replica ~]#
[root@replica ~]#
[root@replica ~]# ipa-replica-install --ntp-server=1.pool.ntp.org --ntp-pool=pool.ntp.org
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
ipapython.admintool: ERROR NTP configuration cannot be updated during promotion
ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information
Based on the above observation, marking the bug VERIFIED.
|