From 86c1426b2d376a390e87b074d3e10d85fa124abf Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Jun 21 2023 17:02:48 +0000 Subject: Upgrade: add PKI drop-in file if missing During the installation of IPA server, the installer adds a drop-in file in /etc/systemd/system/pki-tomcatd@pki-tomcat.service.d/ipa.conf that ensures the CA is reachable before the start command returns. If the file is missing (for instance because the server was installed with an old version before this drop-in was created), the upgrade should add the file. Fixes: https://pagure.io/freeipa/issue/9381 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Rob Crittenden --- diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index dd22ac2..e4dc7ae 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -1737,6 +1737,10 @@ def upgrade_configuration(): os.path.join(paths.USR_SHARE_IPA_DIR, "ipa-kdc-proxy.conf.template")) if ca.is_configured(): + # Ensure that the drop-in file is present + if not os.path.isfile(paths.SYSTEMD_PKI_TOMCAT_IPA_CONF): + ca.add_ipa_wait() + # Handle upgrade of AJP connector configuration rewrite = ca.secure_ajp_connector() if ca.ajp_secret: