Quoting Martin Kosek <mko...@redhat.com>:
On 01/05/2015 02:05 PM, Anthony Messina wrote:Quoting Martin Kosek <mko...@redhat.com>:On 01/04/2015 12:29 AM, Anthony Messina wrote:I was hoping to "migrate" from F20 to F21 using: http://www.freeipa.org/page/Howto/Migration http://www.freeipa.org/page/Howto/Promote_CA_to_Renewal_and_CRL_MasterThe migration procedure is only needed if you run FreeIPA server with PKI based on Dogtag (pki-ca package) 9. Do you? Is your Fedora 20 FreeIPA&PKI instancefunctional? FreeIPA+Dogtag 9 is not supported since Fedora 18, so I was surprised such setup worked in Fedora 20.I don't use Dogtag 9. I installed FreeIPA freshly on a F19 VM, then yum upgraded to F20. With the significant changes for Fedora.next, systemd-216, and FreeIPA 4, I wanted to create a new "master" (amd retire the old) byreplicating the current F20 3.3.5 master to what would become an F21 4.1.2 master.Ah, makes more sense then. The PKI error below gets more serious then - Fraserand Endi, please help Anthony.While I use the yum upgrade procedure often with great success on a number ofmy other servers, it can be tricky and sometimes unreliablem leaving aroundcruft that can interfere with proper operation. I'm one of those folks that'swaiting patiently for the FreeIPA-to-FreeIPA migration ;)I am just afraid everyone is just waiting and no one is willing to invest in this feature and code ;-) IIRC, the difficulty in implementing the migration tool is mostly in handling Kerberos and certificate data, which are based on data secret and unique to the original server.
You may be right here about everyone waiting. Unfortnuately for this case, I am not a programmer, but a mere sysadmin. However, I can do code/design digging to look at the situation from outside the box to see what I might be able to find.
Is the proper, recommended procedure to yum upgrade the F20 FreeIPA 3.3.5 VM instance to F21 FreeIPA 4.1.2?It should work, yes.Even so, it seems like I should be able to create a 4.1.2 replica of a 3.3.5 master.Indeed. This looks like a bug :-(Where the new F21 replica would become the new "master" from which I would later create other F21 replica(s). F20 master: freeipa-server-3.3.5-1.fc20.x86_64 F21 replica: freeipa-server-4.1.2-1.fc21.x86_64The first F21 replica installation fails when attempting to setup the CA andI'm not sure where to go from here. Any guidance is appreciated. Thanks.CCing Fraser and Endi from PKI team to advise.2015-01-03T23:09:39Z DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state' 2015-01-03T23:09:39Z DEBUG Starting external process 2015-01-03T23:09:39Z DEBUG args='/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpZNHZWb' 2015-01-03T23:09:39Z DEBUG Process finished, return code=1 2015-01-03T23:09:39Z DEBUG stdout=Loading deployment configuration from /tmp/tmpZNHZWb. 2015-01-03T23:09:39Z DEBUG stderr=Traceback (most recent call last): File "/usr/sbin/pkispawn", line 579, in <module> main(sys.argv) File "/usr/sbin/pkispawn", line 480, in main info = parser.sd_get_info()File "/usr/lib/python2.7/site-packages/pki/server/deployment/pkiparser.py",line 464, in sd_get_info info = sd.get_security_domain_info() File "/usr/lib/python2.7/site-packages/pki/system.py", line 96, in get_security_domain_info info = SecurityDomainInfo.from_json(response.json())File "/usr/lib/python2.7/site-packages/pki/system.py", line 83, in from_jsonret.name = json_value['id'] KeyError: 'id' 2015-01-03T23:09:39Z CRITICAL failed to configure ca instance Command''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmpZNHZWb'' returned non-zero exitstatus 1 2015-01-03T23:09:39Z DEBUG Traceback (most recent call last):File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line382, in start_creation run_step(full_msg, method)File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line372, in run_step method() File "/usr/lib/python2.7/site-packages/ipaserver/install/cainstance.py", line 671, in __spawn_instance raise RuntimeError('Configuration of CA failed') RuntimeError: Configuration of CA failed
-- Anthony - https://messinet.com - https://messinet.com/~amessina/gallery 8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E
Description: PGP Digital Signature
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project