Standa Laznicka via FreeIPA-devel wrote:
Hello people of the freeipa-devel channel,
Let me share a design that proposes a way of automating the way FreeIPA
replicas would be promoted to become a CRL master. Since the
configuration cannot be dynamically altered by modifying an entry in the
LDAP database, the proposal is to create an ipa-advise extension that
could handle this operation instead for now. Read all about it in the
attachement.
This makes sense to me.
I wonder if we should reflect the current CRL master in LDAP somehow, as
a role perhaps. This way one could look to see whether one is assigned
or not.
The downside is that this could easily get stale, for example if the CRL
master server was lost in some way. But it would provide more visibility
into which master is the CRL master and could be used to prevent/warn a
user if they try to set multiple.
rob