rui liang via FreeIPA-users wrote:
There is only one CA server configured.
because hadoop services are running 24 hours a day, and thousands of servers in the
cluster depend on the KDC server. It is very risky to stop services and change the time.
Is there any other solution that doesn't affect service operation
No because of the older version you have.
What you might be able to do if this is running on a VM is snapshot it
then bring a copy up on an isolated network so you can try the renewal
and see how long things may be offline and get the procedure down.
Moving forward I'd suggest:
- Upgrading more frequently to keep up with bug fixes
- Creating at least one additional CA to avoid a single point of failure
- Running ipa-healthcheck to watch for issues
rob