The `IPA_SERVER_IP` failing to correct the A-record is issue #121:
https://github.com/freeipa/freeipa-container/issues/121
That puts a neat little bow on all my questions in this email thread.
:D Thanks-
John
On 07/24/2017 09:26 PM, John Morris via FreeIPA-users wrote:
> Never mind, I partly figured out what's wrong, once I found a clue that
> this stage requires server->replica connections.
>
> The `ipa-replica-install` process, probably during `ipa-client-install`,
> adds the DNS A-record for the server, but uses the container's IP address.
>
> The freeipa-container scripts allow for this, and if the `IPA_SERVER_IP`
> environment variable is set, they will attempt to correct the A-record
> with `nsupdate`. This was silently failing (I don't know why yet).
>
> If the A-record is set prior to running `ipa-replica-install`, the
> server can find the replica, the replication can be completed, and
> everything hums happily.
>
> For folks in the future, I guess if the replica install breaks at this
> particular step, it's a good clue to check connectivity from the server
> to the replica.
>
> John
>
>
> On 07/24/2017 04:14 PM, John Morris via FreeIPA-users wrote:
>> I reinstalled both server and replica with the image you suggest. The
>> same problem occurs at the same location; see the new gist:
>>
>>
https://gist.github.com/zultron/d7bed6d0c00ae8daef292ba4bb2c04e0
>>
>> Thanks-
>>
>> John
>>
>> On 07/24/2017 02:47 PM, Felipe Barreto Volpone via FreeIPA-users wrote:
>>> John,
>>>
>>> I didn't noticed that you're using adelton's repository.
>>> Could you try more recent image from the official docker hub (/r/freeipa
>>> instead of /r/adelton)?
>>>
https://hub.docker.com/r/freeipa/freeipa-server/
>>> <
https://hub.docker.com/r/freeipa/freeipa-server/>
>>>
>>>
>>> On Mon, Jul 24, 2017 at 4:40 PM, John Morris via FreeIPA-users
>>> <freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>>>
>>> (Apologies for previously sending off-list, Felipe.)
>>>
>>> Sure:
>>>
>>> docker run \
>>> --rm \
>>> --interactive \
>>> --restart=no \
>>> --hostname=h01.example.com <
http://h01.example.com> \
>>> --security-opt=seccomp=unconfined \
>>> --name=ipa \
>>> --volume=/media/freeipa:/data \
>>> --volume=/media/state:/media/state \
>>> --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
>>> --env=IPA_SERVER_IP=1.2.3.4 \
>>> --add-host=h01.example.com:1 <
http://h01.example.com:1>.2.3.4
\
>>> --publish=80:80 \
>>> --publish=443:443 \
>>> --publish=53:53 \
>>> --publish=53:53/udp \
>>> --publish=389:389 \
>>> --publish=636:636 \
>>> --publish=88:88 \
>>> --publish=88:88/udp \
>>> --publish=464:464 \
>>> --publish=464:464/udp \
>>> adelton/freeipa-server:centos-7
>>>
>>> Thanks-
>>>
>>> John
>>>
>>>
>>>
>>> On 07/24/2017 01:29 PM, Felipe Barreto Volpone wrote:
>>>
>>> Hi John,
>>>
>>> could you share the command you have run to setup the ipa
>>> server?
>>>
>>> On Mon, Jul 24, 2017 at 3:12 PM, John Morris via FreeIPA-users
>>> <freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>> <mailto:freeipa-users@lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>>> wrote:
>>>
>>> Running FreeIPA out of Docker
>>> (`adelton/freeipa-server:centos-7`
>>> image), `ipa-replica-install` hangs at `[29/44]: setting up
>>> initial
>>> replication`. The `ipa-server-configure-first.log` (debug
>>> output
>>> enabled) is pasted in the below gist, plus output of
>>> `journalctl
>>> -xe` from within the container.
>>>
>>>
>>>
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba
>>>
>>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba>
>>>
>>>
>>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba
>>> <
https://gist.github.com/zultron/6f9aeb47d304c7bcab93d023e36484ba>>
>>>
>>> The options to `ipa-replica-install` look like this:
>>>
>>> --unattended
>>> --principal=admin
>>> --admin-password=redacted
>>> --server=h01.example.com <
http://h01.example.com>
>>> <
http://h01.example.com>
>>> --hostname=h11.example.com <
http://h11.example.com>
>>> <
http://h11.example.com>
>>> --realm=EXAMPLE.COM <
http://EXAMPLE.COM>
>>> <
http://EXAMPLE.COM>
>>> --domain=example.com <
http://example.com>
>>> <
http://example.com>
>>> --setup-ca
>>> --setup-dns
>>> --no-reverse
>>> --no-forwarders
>>> --no-host-dns
>>> --no-ntp
>>> --no-ui-redirect
>>> --allow-zone-overlap
>>> --debug
>>> --skip-conncheck
>>>
>>> The docker command looks like this:
>>>
>>> docker run \
>>> --rm \
>>> --interactive \
>>> --restart=no \
>>> --hostname=h11.example.com
<
http://h11.example.com>
>>> <
http://h11.example.com> \
>>> --security-opt=seccomp=unconfined \
>>> --name=ipa \
>>> --volume=/media/freeipa:/data \
>>> --volume=/sys/fs/cgroup:/sys/fs/cgroup:ro \
>>> --env=IPA_SERVER_IP=2.3.4.5 \
>>> --env=KRB5_TRACE=/dev/stdout \
>>> --add-host=h01.example.com:1
>>> <
http://h01.example.com:1>
<
http://h01.example.com:1>.2.3.4 \
>>> --publish=80:80 \
>>> --publish=443:443 \
>>> --publish=53:53 \
>>> --publish=53:53/udp \
>>> --publish=389:389 \
>>> --publish=636:636 \
>>> --publish=88:88 \
>>> --publish=88:88/udp \
>>> --publish=464:464 \
>>> --publish=464:464/udp \
>>> adelton/freeipa-server:centos-7 \
>>> ipa-replica-install
>>>
>>> I'm starting to track this down starting from
>>> `ipaserver/install/dsinstance.py`, `__setup_replica()`,
>>> but I'd
>>> really appreciate suggestions. Thanks-
>>>
>>> John
>>> _______________________________________________
>>> FreeIPA-users mailing list --
>>> freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>> <mailto:freeipa-users@lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>>
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to
>> freeipa-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org