Never mind, I partly figured out what's wrong, once I found a clue that
this stage requires server->replica connections.
The `ipa-replica-install` process, probably during `ipa-client-install`,
adds the DNS A-record for the server, but uses the container's IP address.
The freeipa-container scripts allow for this, and if the `IPA_SERVER_IP`
environment variable is set, they will attempt to correct the A-record
with `nsupdate`. This was silently failing (I don't know why yet).
If the A-record is set prior to running `ipa-replica-install`, the
server can find the replica, the replication can be completed, and
everything hums happily.
For folks in the future, I guess if the replica install breaks at this
particular step, it's a good clue to check connectivity from the server
to the replica.
John
On 07/24/2017 04:14 PM, John Morris via FreeIPA-users wrote:
> I reinstalled both server and replica with the image you suggest. The
> same problem occurs at the same location; see the new gist:
>
>
https://gist.github.com/zultron/d7bed6d0c00ae8daef292ba4bb2c04e0
>
> Thanks-
>
> John
>
> On 07/24/2017 02:47 PM, Felipe Barreto Volpone via FreeIPA-users wrote:
>> John,
>>
>> I didn't noticed that you're using adelton's repository.
>> Could you try more recent image from the official docker hub (/r/freeipa
>> instead of /r/adelton)?
>>
https://hub.docker.com/r/freeipa/freeipa-server/
>> <
https://hub.docker.com/r/freeipa/freeipa-server/>
>>
>>
>> On Mon, Jul 24, 2017 at 4:40 PM, John Morris via FreeIPA-users
>> <freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>>
>> (Apologies for previously sending off-list, Felipe.)
>>
>> Sure:
>>
>> docker run \
>> --rm \
>> --interactive \
>> --restart=no \
>> --hostname=h01.example.com <
http://h01.example.com> \
>> --security-opt=seccomp=unconfined \
>> --name=ipa \
>> --volume=/media/freeipa:/data \
>> --volume=/media/state:/media/state \
>> --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
>> --env=IPA_SERVER_IP=1.2.3.4 \
>> --add-host=h01.example.com:1 <
http://h01.example.com:1>.2.3.4 \
>> --publish=80:80 \
>> --publish=443:443 \
>> --publish=53:53 \
>> --publish=53:53/udp \
>> --publish=389:389 \
>> --publish=636:636 \
>> --publish=88:88 \
>> --publish=88:88/udp \
>> --publish=464:464 \
>> --publish=464:464/udp \
>> adelton/freeipa-server:centos-7
>>
>> Thanks-
>>
>> John
>>
>>
>>
>> On 07/24/2017 01:29 PM, Felipe Barreto Volpone wrote:
>>
>> Hi John,
>>
>> could you share the command you have run to setup the ipa server?
>>
>> On Mon, Jul 24, 2017 at 3:12 PM, John Morris via FreeIPA-users
>> <freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> <mailto:freeipa-users@lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>>> wrote:
>>
>> Running FreeIPA out of Docker
>> (`adelton/freeipa-server:centos-7`
>> image), `ipa-replica-install` hangs at `[29/44]: setting up
>> initial
>> replication`. The `ipa-server-configure-first.log` (debug
>> output
>> enabled) is pasted in the below gist, plus output of
>> `journalctl
>> -xe` from within the container.
>>
>>
>>
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba
>>
>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba>
>>
>>
>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba
>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba>>
>>
>> The options to `ipa-replica-install` look like this:
>>
>> --unattended
>> --principal=admin
>> --admin-password=redacted
>> --server=h01.example.com <
http://h01.example.com>
>> <
http://h01.example.com>
>> --hostname=h11.example.com <
http://h11.example.com>
>> <
http://h11.example.com>
>> --realm=EXAMPLE.COM <
http://EXAMPLE.COM>
>> <
http://EXAMPLE.COM>
>> --domain=example.com <
http://example.com>
>> <
http://example.com>
>> --setup-ca
>> --setup-dns
>> --no-reverse
>> --no-forwarders
>> --no-host-dns
>> --no-ntp
>> --no-ui-redirect
>> --allow-zone-overlap
>> --debug
>> --skip-conncheck
>>
>> The docker command looks like this:
>>
>> docker run \
>> --rm \
>> --interactive \
>> --restart=no \
>> --hostname=h11.example.com <
http://h11.example.com>
>> <
http://h11.example.com> \
>> --security-opt=seccomp=unconfined \
>> --name=ipa \
>> --volume=/media/freeipa:/data \
>> --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
>> --env=IPA_SERVER_IP=2.3.4.5 \
>> --env=KRB5_TRACE=/dev/stdout \
>> --add-host=h01.example.com:1
>> <
http://h01.example.com:1> <
http://h01.example.com:1>.2.3.4
\
>> --publish=80:80 \
>> --publish=443:443 \
>> --publish=53:53 \
>> --publish=53:53/udp \
>> --publish=389:389 \
>> --publish=636:636 \
>> --publish=88:88 \
>> --publish=88:88/udp \
>> --publish=464:464 \
>> --publish=464:464/udp \
>> adelton/freeipa-server:centos-7 \
>> ipa-replica-install
>>
>> I'm starting to track this down starting from
>> `ipaserver/install/dsinstance.py`, `__setup_replica()`,
>> but I'd
>> really appreciate suggestions. Thanks-
>>
>> John
>> _______________________________________________
>> FreeIPA-users mailing list --
>> freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> <mailto:freeipa-users@lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>>
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>> <mailto:freeipa-users-leave@lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>
>>
>>
>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
>>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org