URL: https://github.com/freeipa/freeipa/pull/5612 Author: flo-renaud Title: #5612: DNSSEC key synchronization issues Action: opened

PR body: """ ### dnssec: fix ipa-ods-exporter crash when master key missing

When a master key is missing from the local HSM, ipa-ods-exporter crashes. This can happen when the DNSSEC master role is moved from one node to another with the following scenario: - install server1 with dns + dnssec - install server2 without dns - disable dnssec from server1 - install dns + dnssec on server2

With the above scenario, server2 never had the opportunity to get the master key (this happens only when the replica is already configured as DNS server and has put its public replica key in LDAP + the current DNSSEC master wraps its master key with the replica key).

ipa-ods-exporter can only log an error instead of crashing.

Related: https://pagure.io/freeipa/issue/8654

### dnssec: concurrency issue when disabling old replica key

When dnssec role is removed from the local node, the uninstaller creates a new replica key and marks the older replica keys as disabled (both in the local HSM and in LDAP). If ipa-ods-exporter runs in the middle of this operation, the old replica key may be disabled in the local HSM but not yet in LDAP and ipa-ods-exporter believes that it is a new replica key that needs to be imported from LDAP to local hsm. The op fails as there is already the key in the local HSM.

The error can be ignored, ipa-ods-exporter simply needs to log a warning.

Fixes: https://pagure.io/freeipa/issue/8654 """

To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5612/head:pr5612 git checkout pr5612