Finn Fysj via FreeIPA-users wrote:
I think there is some misunderstanding about the purpose of backup and
restore. It is for catastrophic recovery only.
This is why it wants all roles to be included because if you lose your
cluster and the only backup you have is lacking a role, say the CA, that
is less than awesome.
A restore will disable all replication agreements. They can be
re-enabled but a restore by its very nature is going back in time which
is going to confuse the heck out of replication. At best any other
existing servers will need to be re-initialized. Otherwise they need to
be re-installed. Remember: catastrophic.
It is not designed for recovering a single entry that was accidentally
deleted, or an undesired edit. If periodic backups are done the data is
available in the stored LDIFs but it is an exercise for the user to
restore in that case.
rob
I appreciate so much for your response.
I've experienced issues where I tried to uninstall the replica server and trying to
re-installing:
roles:
- role: freeipa.ansible_freeipa.ipareplica
ipaserver_ignore_topology_disconnect: true
ipaserver_ignore_last_of_role: true
state: absent
Then I try to install it again:
- role: freeipa.ansible_freeipa.ipareplica
ipaclient_force_join: true
ipareplica_install_packages: true
ipareplica_setup_firewalld: false
ipareplica_setup_dns: false
ipareplica_servers:
master1.example.com
ipareplicas: ["{{ ansible_play_hosts_all | join(', ') }}"]
ipareplica_domain: "example.com"
ipaadmin_principal: "admin"
ipaadmin_password: "Secret1213"
ipadm_password: "my_password"
I run into issues such as:
"module_stdout": "Traceback (most recent call last):\r\n File
\"/usr/lib/python3.9/site-packages/ipalib/krb_utils.py\", line 182, in
get_principal\r\n creds = get_credentials(ccache_name=ccache_name)\r\n File
\"/usr/lib/python3.9/site-packages/ipalib/krb_utils.py\", line 165, in
get_credentials\r\n return gssapi.Credentials(usage=\"initiate\", name=name,
store=store)\r\n File \"/usr/lib64/python3.9/site-packages/gssapi/creds.py\",
line 63, in __new__\r\n res = cls.acquire(name, lifetime, mechs, usage,\r\n File
\"/usr/lib64/python3.9/site-packages/gssapi/creds.py\", line 136, in acquire\r\n
res = rcreds.acquire_cred(name, lifetime,\r\n File \"gssapi/raw/creds.pyx\",
line 161, in
gssapi.raw.creds.acquire_cred\r\ngssapi.raw.exceptions.MissingCredentialsError: Major
(458752): No credentials were supplied, or the credentials were unavailable or
inaccessible, Minor (2529639053): No Kerberos credentials available (default cache:
)\r\n\r\nDuring handling of the above excepti
on, another exception occurred:\r\n\r\nTraceback (most recent call last):\r\n File
\"/home/ansible/.ansible/tmp/ansible-tmp-1706882379.2962139-14800-182642519268134/AnsiballZ_ipareplica_add_to_ipaservers.py\",
line 107, in <module>\r\n _ansiballz_main()\r\n File
\"/home/ansible/.ansible/tmp/ansible-tmp-1706882379.2962139-14800-182642519268134/AnsiballZ_ipareplica_add_to_ipaservers.py\",
line 99, in _ansiballz_main\r\n invoke_module(zipped_mod, temp_path,
ANSIBALLZ_PARAMS)\r\n File
\"/home/ansible/.ansible/tmp/ansible-tmp-1706882379.2962139-14800-182642519268134/AnsiballZ_ipareplica_add_to_ipaservers.py\",
line 47, in invoke_module\r\n
runpy.run_module(mod_name='ansible_collections.freeipa.ansible_freeipa.plugins.modules.ipareplica_add_to_ipaservers',
init_globals=dict(_module_fqn='ansible_collections.freeipa.ansible_freeipa.plugins.modules.ipareplica_add_to_ipaservers',
_modlib_path=modlib_path),\r\n File \"/usr/lib64/python3.9/runpy.py\", line
225, in run_module\r\n
return _run_module_code(code, init_globals, run_name, mod_spec)\r\n File
\"/usr/lib64/python3.9/runpy.py\", line 97, in _run_module_code\r\n
_run_code(code, mod_globals, init_globals,\r\n File
\"/usr/lib64/python3.9/runpy.py\", line 87, in _run_code\r\n exec(code,
run_globals)\r\n File
\"/tmp/ansible_freeipa.ansible_freeipa.ipareplica_add_to_ipaservers_payload_gnneon23/ansible_freeipa.ansible_freeipa.ipareplica_add_to_ipaservers_payload.zip/ansible_collections/freeipa/ansible_freeipa/plugins/modules/ipareplica_add_to_ipaservers.py\",
line 156, in <module>\r\n File
\"/tmp/ansible_freeipa.ansible_freeipa.ipareplica_add_to_ipaservers_payload_gnneon23/ansible_freeipa.ansible_freeipa.ipareplica_add_to_ipaservers_payload.zip/ansible_collections/freeipa/ansible_freeipa/plugins/modules/ipareplica_add_to_ipaservers.py\",
line 139, in main\r\n File
\"/usr/lib/python3.9/site-packages/ipalib/backend.py\", line 69, in connect\r\n
conn = self.create_connection(*args, **kw)\r\n Fil
e \"/usr/lib/python3.9/site-packages/ipaserver/plugins/ldap2.py\", line 203, in
create_connection\r\n principal = krb_utils.get_principal(ccache_name=ccache)\r\n File
\"/usr/lib/python3.9/site-packages/ipalib/krb_utils.py\", line 185, in
get_principal\r\n raise
errors.CCacheError(message=str(e))\r\nipalib.errors.CCacheError: Major (458752): No
credentials were supplied, or the credentials were unavailable or inaccessible, Minor
(2529639053): No Kerberos credentials available (default cache: )\r\n",