Rob Crittenden via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
writes:
Jochen Kellner via FreeIPA-users wrote:
>
> Hi,
>
> I'm about to decomission one of my IPA replicas running on up to date
> fedora 35 (freeipa-server-common-4.9.7-4.fc35.noarch). On my CA renewal
> master (
freeipa1.example.org) I try to remove
freeipa4.example.org:
>
> [root@freeipa1 ~]# ipa server-del
freeipa4.example.org
> Removing
freeipa4.example.org from replication topology, please wait...
> ipa: ERROR: Server removal aborted: Deleting this server is not allowed as it would
leave your installation without a KRA..
>
...
> I think the message is wrong:
> I had a took at plugins/server.py:
>
> 509 if self.api.Command.ca_is_enabled()['result']:
> 510 try:
> 511 roles = self.api.Command.server_role_find(
> 512 server_server=hostname,
>
> =====> Do we really need to search for the hostname here? We will
> always find out that there is only one server left... When I remove
> that parameter deletion would continue - but I didn't really run the
> rest of the deletion yet.
>
> ipa server-role-find --server=freeipa4.example.org --role="KRA server"
> really returns one entry.
>
> 513 role_servrole='KRA server',
> 514 status='enabled',
> 515 include_master=True,
> 516 )['result']
> 517 except errors.NotFound:
> 518 roles = ()
> 519 if len(roles) == 1 and roles[0]['server_server'] ==
hostname:
> 520 handler(
> 521 _("Deleting this server is not allowed as it would
"
> 522 "leave your installation without a KRA."),
> 523 ignore_last_of_role)
>
> The commit that added the code was
>
https://github.com/freeipa/freeipa/commit/10bd66dd1a14fc0bd39c489d0d0af76...
> and should fix
https://pagure.io/freeipa/issue/8397
>
> Do I miss something else?
This is commit 0b9adf1d8d5efb48e734650e4101e8816b01e1d3 in the ipa-4-9
branch and was first tagged in 4.9.7
I'll take another look. You're right, the server match looks suspicious.
I've seen
https://github.com/freeipa/freeipa/pull/6101 and it works for
me. Thanks!
Jochen
--
This space is intentionally left blank.