Hi,
Fedora project has released Fedora 28 last week. Unfortunately, FreeIPA
4.6.90.pre1 in Fedora 28 is not ready for production. We do not
recommend to upgrade to Fedora 28 on your FreeIPA masters at this time.
We are working on finalizing FreeIPA 4.7 release that should replace
4.6.90.pre1 in Fedora 28. Right now the delta between Fedora 28 alpha
where 4.6.90.pre1 was released and FreeIPA git master is about two
months of work and dozens of fixes, including fixes for upgrade
issues.
The reason why FreeIPA 4.7 is delayed is due to a need to coordinate
with a number of other projects. FreeIPA moved to mod_ssl; Fedora 28
moved to use SQL backend in nss as a new default which broke a lot of
assumptions in both FreeIPA and Dogtag. Tomcat version was upgrade and
Dogtag needed to adapt which all took a lot of time. Unfortunately, some
issues could only be discovered when you are moving forward past the
fixes already made, so we are in a ping-pong game across a number of
projects.
A nightly CI was added to FreeIPA upstream which allows us to test a
wider set of configurations against Fedora 27 and 28.
We are planning to release another FreeIPA 4.7 prelease this week. It
should help with a general upgrade path stabilization from Fedora 27 to
28.
Thus, I'd recommend to not upgrade to Fedora 28 until we provide an
additional guidance.
Thank you,
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland