#2281 [ipa/server] Change how the check for ipa-replica-install is being done
Merged a month ago by zlopez. Opened a month ago by zlopez.
fedora-infra/ zlopez/ansible ipa  into  main

file modified
+17 -11
@@ -93,19 +93,25 @@ 

    - ipa/server

    - config

  

-   # ipactl status has return code > 0 when the IPA is not set up yet

-   # even if the client is already installed

-   # Previously we checked in /etc/ipa/default.conf exists, but this

-   # is already created in ipa/client role so the replica never

-   # started

- - name: determine whether we need to set up replication

-   shell: ipactl status

-   register: replication_status

-   ignore_errors: true

+   # During the ipa-replica-install /var/log/ipainstall.log is created

+   # Let's check if the file is available and prevent breaking replica

+   # by running ipa-replica-install more than once

+ - name: Check if /var/log/ipainstall.log is available

+   ansible.builtin.stat:

+     path: /var/log/ipainstall.log

+   register: replica_check

+   tags:

+   - ipa/server

+   - config

+ 

+ - name: ask admin if they are ok reinstalling this ipa server replica

+   ansible.builtin.pause:

+     prompt: "Looks like this replica should be reinstalled, are you sure you want to do that? (yes/no)"

+   when: not ipa_initial and (not replica_check.stat.exists)

+   register: confirm_replica

    tags:

    - ipa/server

    - config

-   when: not ipa_initial

  

  - name: configure replication

    block:
@@ -136,7 +142,7 @@ 

               --server={{ipa_server}}

               --dirsrv-config-file=/root/ldif/replica-install.ldif

      when: ansible_distribution_major_version|int >= 8

-   when: not ipa_initial and replication_status.rc > 0

+   when: (confirm_replica is defined) and (confirm_replica.user_input | bool)

    tags:

    - ipa/server

    - config

As found on in https://pagure.io/fedora-infrastructure/issue/12149 the current
method of checking if the ipa-replica-install have to be executed is not
reliable enough.

Let's instead check for log file that is created during the installation. This
will need manual intervention in case the ipa-replica-install needs to be run
again, but it will be much more reliable otherwise.

Signed-off-by: Michal Konecny mkonecny@redhat.com

Hum... so that file exists after a server install?

But this means this would run on every run... we only want it to run if that file 'doesn't' exist?

Also, thinking about it, perhaps we could also add a prompt:

  • name: ask admin if they are ok reinstalling this ipa server replica
    pause: prompt="Looks like this replica should be reinstalled, are you sure you want to do that?"

Now that I'm looking I should check if the file doesn't exist as it's created by ipa-replica-install. Let me change the logic.

I can add the prompt as well.

1 new commit added

  • [ipa/server] Add confirmation prompt for ipa-replica-install
a month ago

2 new commits added

  • [ipa/server] Add confirmation prompt for ipa-replica-install
  • [ipa/server] Change how the check for ipa-replica-install is being done
a month ago

This looks good to me now.

Perhaps we should merge this and run it over staging to make sure all is well there?

rebased onto 58f8c45

a month ago

rebased onto 58f8c45

a month ago

Pull-Request has been merged by zlopez

a month ago

The playbook seems to work OK, I wasn't even prompted as the file I'm checking is already there.

I just saw this error, so I will look at that:

fatal: [ipa01.stg.iad2.fedoraproject.org]: FAILED! => {"msg": "The conditional check '(confirm_replica is defined) and (confirm_replica.user_input | bool)' failed. The error was: error while evaluating conditional ((confirm_replica is defined) and (confirm_replica.user_input | bool)): 'dict object' has no attribute 'user_input'. 'dict object' has no attribute 'user_input'\n\nThe error appears to be in '/srv/web/infra/ansible/roles/ipa/server/tasks/main.yml': line 122, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n    # the replica to be deployed.\n  - name: clean client installation\n    ^ here\n"}

It seems that this is being checked for ipa01 as well, which is wrong as the prompt is actually skipped. I will check what happened and produce a fix.

Metadata