Bug 1780358
| Summary: | ipa-healthcheck - Check if the CA renewal master is reachable. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Têko Mihinto <tmihinto> |
| Component: | ipa | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED WONTFIX | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 8.1 | CC: | pasik, pcech, rcritten, tscherf |
| Target Milestone: | rc | Keywords: | FutureFeature, Triaged |
| Target Release: | 8.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-17 08:00:28 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Interesting idea. Generally speaking we like to keep all checks local because it gets complicated fast to search remote machines without adding healthcheck-specific credentials. But checking to see if a host is reachable should be doable. Thinking about it further, what is the purpose of checking if the renewal master is reachable? It isn't a requirement for it to be so. The certs are distributed using normal IPA replication so there need not be a direct link between any other masters with the renewal master. There are RFE's asking to be able to limit connectivity between certain masters so if this were checked it could lead to false positives. Hi Rob,
This RFE is actually to request a couple of additional information that could be useful for customers and Support.
1 - The first one is to provide the FQDN of the CA renewal master ( in case it is not the host on which the ipa-healthcheck command is run )
2 - The second one is to let the user know if the CA renewal master is reachable.
It may happen it is not reachable due to mistakes.
For instance:
* wrong DNS configuration ( this might be checked in the DNS plugin [1] )
* decommission of a VM that is hosting the renewal master
IMHO, it would be nice to get the FQDN of the CA renewal master ( it is already provided with "ipa config-show" ).
Knowing whether it is reachable is less important but might be useful for Support folks.
Regards,
Têko.
[1] https://www.freeipa.org/page/V4/Healthcheck#DNS
I can do the first request since it is stored in configuration. But not the second. It is not an error to be not reachable and could lead to false positives. Hi Rob, OK, that works for me :-) Thanks, Têko. Upstream ticket: https://pagure.io/freeipa/issue/8842 Thank you taking your time and submitting this request for Red Hat Enterprise Linux. The request was cloned to the upstream tracker a long time ago (see link to the upstream ticket above), but it was unfortunately not given priority either in the upstream project, nor in Red Hat Enterprise Linux. Given that this request is not planned for a close release, it is highly unlikely it will be fixed in this major version of Red Hat Enterprise Linux. We are therefore closing the request as WONTFIX. To request that Red Hat reconsiders the decision, please reopen the Bugzilla with the help of Red Hat Customer Service and provide additional business and/or technical details about it's importance to you. Please note that you can still track this request or even offer help in the referred upstream Pagure ticket to expedite the solution. FreeIPA Product Owner |
Description of problem: ipa-healthcheck should report if the configured CA renewal master is reachable. Version-Release number of selected component (if applicable): # rpm -qa | grep ipa-server ipa-server-common-4.8.0-11.module+el8.1.0+4247+9f3fd721.noarch ipa-server-4.8.0-11.module+el8.1.0+4247+9f3fd721.x86_64 # How reproducible: Always. Steps to Reproduce: 1. Change the RDN of the LDAP entry cn=<CA_RENEWAL_MASTER>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN> to a value that points to a non-existing server. 2. Run the command # ipa-healthcheck --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck Actual results: The command shows that the server is not a CA renewal master. # ipa-healthcheck --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck [ { "source": "ipahealthcheck.ipa.roles", "check": "IPARenewalMasterCheck", "result": "SUCCESS", "uuid": "29ef3a25-81bb-4a9b-aa56-dd27743936b1", "when": "20191205175059Z", "duration": "0.156789", "kw": { "key": "renewal_master", "master": false } } ] # Expected results: It would be nice to also show if there is a reachable CA renewal master. Eg: # ipa-healthcheck --source ipahealthcheck.ipa.roles --check IPARenewalMasterCheck [ { "source": "ipahealthcheck.ipa.roles", "check": "IPARenewalMasterCheck", "result": "SUCCESS", "uuid": "3431e60b-c98a-4633-a7f9-249747b1a1b8", "when": "20191205175326Z", "duration": "0.161224", "kw": { "key": "renewal_master", "master": false, "current_master": "unreachable_master.example.com", "current_master_reachable": false } } ] Additional info: