On Mon, 12 Nov 2018, Rob Foehl via FreeIPA-users wrote:
On Tue, 13 Nov 2018, Fraser Tweedale wrote:
> Can you please clarify, what is the procedure to rebuild the master
> via replication?
Honestly, no, as there isn't any clearly documented way to do this ;)
https://www.freeipa.org/page/Howto/Migration#Migrating_to_different_platf...
is about as close as I've found. Current plan is to snapshot the VMs, then
destroy the older one (current renewal master), replace with a new image, and
install an IPA replica from the remaining server, using the same name as the
prior one (possibly by force). If that doesn't work, same approach with
extra steps to remove the old replica first.
Following up on this for posterity... Rebuilding the master by force did
work eventually, although it was necessary to manually promote it as the
renewal master even though the LDAP entry indicating it as such was never
changed. Doing this also skewed the CA-issued certificate serial numbers
by quite a lot on both replicas, and the newly reinstalled host doesn't
have a whole lot in common with its former self beyond the hostname.
Should I be concerned about anything else potentially going amiss after
this replacement?
Incidentally, this is partly the result of not being able to upgrade
in
place: an attempted 4.6.3 to 4.6.4 upgrade on F27 currently fails when
verifying the CA audit signing cert lifetime, as in this particular
environment the IPA CA is signed by an external CA cert that expires in 2020.
Is this bug-worthy?
And of course this remains an issue...
-Rob