On 28-05-2021 19:32, Kees Bakker via FreeIPA-users wrote:
*** EXTERNAL E-MAIL ***
On 28-05-2021 17:22, Kees Bakker via FreeIPA-users wrote:
> Hi,
>
> After installing a new replica and running
>
> /usr/bin/ipa-healthcheck --source
pki.server.healthcheck.clones.connectivity_and_data
>
> I'm getting this error
>
> keyctl_search: Required key not available
> Enter password for Internal Key Storage Token:
> Internal server error HTTPSConnectionPool(host='iparep3.ghs.nl', port=443):
Max retries exceeded with url: /ca/rest/certs/search?size=3 (Caused by
NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at
0x7fc473262a90>: Failed to establish a new connection: [Errno 113] No route to
host',))
> [
> {
> "source":
"pki.server.healthcheck.clones.connectivity_and_data",
> "check": "ClonesConnectivyAndDataCheck",
> "result": "ERROR",
> "uuid": "c2f3ec1d-494b-4f6a-b6e3-0e38108f2005",
> "when": "20210528150818Z",
> "duration": "30.348789",
> "kw": {
> "status": "ERROR: pki-tomcat : Internal error testing CA clone.
Host: iparep3.ghs.nl Port: 443"
> }
> }
> ]
>
> First, it is asking for a password, and I have no clue for what. I've
> tried the admin password and the Directory Manager password. It
> makes no difference.
>
> Second, it tries to connect to a replica that was removed several months
> ago. Both ipa-replica-manage list and ipa-csreplica-manage show the
> correct list of masters that we currently have.
>
> Where does ipa-healthcheck get the information from to query the removed
> replica?
>
> BTW. Two replica run CentOS 8 Stream, and one runs CentOS 7. The first two give
> this healthcheck error, the centos7 master does not.
That last remark should be: on CentOS 7 there was no such check. So, perhaps
the error is there too.
# /usr/bin/ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found
The problem seems to be that PKI has its own information about
masters (and clones). In our PKI configuration there are still two hosts
that were deleted from FreeIPA a long time ago. So, the
ipa-replica-manage del
command did not remove them from PKI??
BTW, healthcheck uses this url to get that PKI info.
http://localhost:8080/ca/rest/securityDomain/domainInfo
How can I get rid of the two old hosts?
--
Kees