That sounds reasonable. I don't see any reason you can't install bind on
the replica's using the system package manager and configure them as slaves
of your other IPA servers that are running bind with LDAP.
Just a couple of things to note:
- Bind slaves do not support multiple masters. In our environment we've
designated one of our IPA servers as the master but we allow zone transfer
from any IPA server to all of our slaves. This way if for some reason our
master goes down for an extended period of time we can manually change the
master on the slaves to point to another IPA server.
- The FreeIPA bind-dyndb-ldap plugin does not support bind's also-notify
feature. This means that it will only notify servers with NS records. This
is problematic if you're running private slaves that don't have NS records
as they won't be notified of changes and will only receive updates at the
refresh interval. We worked around this by enabling also-notify on our NS
servers which are slaves of our FreeIPA server. The NS servers are notified
by FreeIPA and then they notify the others.