From 25ca0df51b87a97abfcdf7af892530e5b99bb857 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 4 Mar 2021 12:05:12 -0500
Subject: [PATCH 1/3] Set enable_ra and ra_plugin when setting up replica CA

With ra_plugin unconfigured the other CA backends are not
available during installation. The methods that utilize this
are all skipped, on purpose I'm not sure, but the effect was
this was unnoticed.

https://pagure.io/freeipa/issue/8738

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
---
 ipaserver/install/server/replicainstall.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index 73967a2249d..89555041e64 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -814,11 +814,20 @@ def promote_check(installer):
     env._bootstrap(context='installer', confdir=paths.ETC_IPA, log=None)
     env._finalize_core(**dict(constants.DEFAULT_CONFIG))
 
+    if options.setup_ca:
+        enable_ra = True
+        ra_plugin = 'dogtag'
+    else:
+        enable_ra = False
+        ra_plugin = 'None'
+
     # pylint: disable=no-member
     xmlrpc_uri = 'https://{}/ipa/xml'.format(ipautil.format_netloc(env.host))
     api.bootstrap(in_server=True,
                   context='installer',
                   confdir=paths.ETC_IPA,
+                  enable_ra=enable_ra,
+                  ra_plugin=ra_plugin,
                   ldap_uri=ipaldap.realm_to_ldapi_uri(env.realm),
                   xmlrpc_uri=xmlrpc_uri)
     # pylint: enable=no-member

From 215169a61a86f9f7fd1d5b6d54446254b637dc5f Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 4 Mar 2021 12:10:26 -0500
Subject: [PATCH 2/3] Always import the default certificate profiles

The default certificate profiles were not imported for
in a promoted client installation.

This could lead to missing profiles, as was seen in the ACME
case, while upgrading from older versions.

The sequence was:

1. Install a non-ACME IPA server
2. Install an ipa client
3. On the client promote to a server with a build that supports
   ACME.

The resulting installation is missing the acmeIPAServerCert
profile because it is provided in INCLUDED_PROFILES which isn't
loaded during promotions.

There is already handling to handle issues if the profile already
exists so it is safe to call this on every installation.

https://pagure.io/freeipa/issue/8738

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
---
 ipaserver/install/cainstance.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index cd21c80eb85..759882aacfe 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -479,10 +479,10 @@ def configure_instance(self, host_name, dm_password, admin_password,
 
                     self.step("migrating certificate profiles to LDAP",
                               migrate_profiles_to_ldap)
-                    self.step("importing IPA certificate profiles",
-                              import_included_profiles)
                     self.step("adding default CA ACL", ensure_default_caacl)
                     self.step("adding 'ipa' CA entry", ensure_ipa_authority_entry)
+                self.step("importing IPA certificate profiles",
+                          import_included_profiles)
 
                 self.step("configuring certmonger renewal for lightweight CAs",
                           self.add_lightweight_ca_tracking_requests)

From f6a1050e069e1b5f14842a37163712c5e26834e1 Mon Sep 17 00:00:00 2001
From: Rob Crittenden <rcritten@redhat.com>
Date: Thu, 4 Mar 2021 13:07:19 -0500
Subject: [PATCH 3/3] Temp commit

---
 .freeipa-pr-ci.yaml                        |  2 +-
 ipatests/prci_definitions/temp_commit.yaml | 30 +++++++++++++++++++---
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/.freeipa-pr-ci.yaml b/.freeipa-pr-ci.yaml
index abcf8c5b634..80656690080 120000
--- a/.freeipa-pr-ci.yaml
+++ b/.freeipa-pr-ci.yaml
@@ -1 +1 @@
-ipatests/prci_definitions/gating.yaml
\ No newline at end of file
+ipatests/prci_definitions/temp_commit.yaml
\ No newline at end of file
diff --git a/ipatests/prci_definitions/temp_commit.yaml b/ipatests/prci_definitions/temp_commit.yaml
index 8f8a357acd1..082cf833950 100644
--- a/ipatests/prci_definitions/temp_commit.yaml
+++ b/ipatests/prci_definitions/temp_commit.yaml
@@ -61,14 +61,38 @@ jobs:
         timeout: 1800
         topology: *build
 
-  fedora-latest/temp_commit:
+  fedora-latest/temp_commit_1:
     requires: [fedora-latest/build]
     priority: 50
     job:
       class: RunPytest
       args:
         build_url: '{fedora-latest/build_url}'
-        test_suite: test_integration/test_REPLACEME.py
+        test_suite: test_integration/test_caless.py::TestServerInstall
         template: *ci-master-latest
-        timeout: 3600
+        timeout: 1200
+        topology: *master_1repl
+
+  fedora-latest/test_caless_TestReplicaInstall:
+    requires: [fedora-latest/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{fedora-latest/build_url}'
+        test_suite: test_integration/test_caless.py::TestReplicaInstall
+        template: *ci-master-latest
+        timeout: 7200
+        topology: *master_1repl
+
+  fedora-latest/temp_commit_3:
+    requires: [fedora-latest/build]
+    priority: 50
+    job:
+      class: RunPytest
+      args:
+        build_url: '{fedora-latest/build_url}'
+        test_suite: test_integration/test_acme.py
+        template: *ci-master-latest
+        timeout: 7200
         topology: *master_1repl_1client
