-
Notifications
You must be signed in to change notification settings - Fork 252
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
IPA_SERVER_IP not respected in replica setup, causing failures when containers are not on the same docker network #121
Comments
Reading Scenario: Master has a pre-existing A record for the replica, replica skips conncheck, I believe I've found the source of misunderstanding:
The |
The workarounds listed are actually the correct approach and boil down to: make sure you have correct networking and DNS records. Overall, I don't think there is any issue to somehow fix in code. |
I might not have been clear on the issue. The Having the replica setup code use the |
It is not set before the replica setup starts, that true. It's setup after the new replica was created. The problem with setting it before starting Having said that -- |
I should have mentioned this in my bug report, but using the
This is because the docker container only see's it's docker interface. This particular error was obviously on purpose to help sysadmin's who enter an unusable address. However, now there is a use case this error check prevents. Changing this in the main FreeIPA source would probably be best. I'm just not 100% sure that will result in solving this issue, but it's certainly a good place to start. I'll file an issue in freeipa/freeipa and reference this one. Between now and when the Thanks! |
Just to close the loop, the issue has been filed with freeipa, under ticket 6879 |
Hmm, looking at https://bugzilla.redhat.com/show_bug.cgi?id=1377973, I wonder if we can do something like https://bugzilla.redhat.com/show_bug.cgi?id=1377973#c8 in the |
If I read the suggestion in comment 8 correctly, it's to allow the loopback address to be specified as the Instead, I would want the ability to skip the checks that ensure the IP address specified using Did I follow the suggestion correctly, or miss the boat? |
Not the loopback address. Address which cannot be found on any of the local interfaces. |
Ah, sorry, I misread the example. I see now, In that case, it seems like comment 8 is the same thing I would want to see. That is, the ability to specify an address for the replica that is not bound on any local interfaces. Between docker containers and cloud-based 1-1 NAT, the situation where your advertised IP is not bound to a local interface is fairly common these days. |
@tkent, with https://bugzilla.redhat.com/show_bug.cgi?id=1377973 CLOSED/ERRATA, have things actually improved in containers as well? |
@adelton The situation is changed now, but not really improved. If you specify both For what it's worth, this issue is no longer relevant to us. We stopped using the DNS component of the FreeIPA containers and just manually manage our SRV records. I'd be quite happy to just see it closed since I don't think it impacts many people. |
Thanks for the info. I'll close the issue now but if you still have the setup around to investigate, it's be good to get to the bottom of this. What IP address does the replica try to connect to when it fails during that "setting up initial replication" step? Would pre-creating A record of the replica, pointing to its host's IP address, help? |
The
IPA_SERVER_IP
environment variable is not respected when used withipa-replica-install
. This causes a range of failure behaviors when adding a replica in domain-level 1 environments.Steps to reproduce
There are a variety of failure behaviors that show up. I ran into a lot of them chasing this down :-). I've included two easy-to-test scenarios below.
For all scenarios, put the master and replica containers on different hosts or VMs. That way they are not on the same docker network. Obviously, the docker networks shouldn't be connected via swarm
Scenario: Master has no knowledge of replica, replica tries to join master - per the docs.
Test
On the master
On the replica
Outcome
conncheck
stepNote, repeating this exact test with the
--skip-conncheck
option produces a LDAP authentication error after client setup. This is a particularly confusing error and sent us down the wrong path for a while.Scenario: Master has a pre-existing A record for the replica, replica skips conncheck
Test
On the master
IPA_SERVER_IP
On the replica
--skip-conncheck
, but not--no-reverse
or--no-host-dns
entries.Outcome
(This is the error referenced in #92 that couldn't be reproduced.)
Workaround
To work around the issue requires some prep work on the master:
IPA_SERVER_IP
.IPA_SERVER_IP
and point it back to the DNS entry in 1.--skip-conncheck
ipa-replica-install option. If using--setup-dns
, also add the--no-host-dns
, and--no-reverse
options.The text was updated successfully, but these errors were encountered: