Just as record: It looks like replica lost dnarange on my two servers somehow,not sure if
it is caused by update or it is already happen before.since I notice that via trying to
add a user after update and failed with: Allocation of a new value for range cn=posix
ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to
proceed.
I'll trying to recover dnarange via
https://www.freeipa.org/page/V3/Recover_DNA_Ranges
Lays