FreeIPA should should keep track if ipa-server-upgrade is in progress or hasn't been finishes successfully. Tools like ipactl can then inform an administrator that she needs to wait for upgrade to finish or re-run ipa-server-upgrade. For example in https://bugzilla.redhat.com/show_bug.cgi?id=1503321 ipa-custodia fails to start because its config files hasn't been upgraded yet. It's most likely caused by a failed / aborted upgrade.

Proposal:

• ipa-server-upgrade creates STATEFILE_DIR/upgrade-in-progress as first step
• on success, ipa-server-upgrade removes the file as last step
• ipactl fails if file exists (unless --upgrade-mode is given)