At https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/1769440/comments/34
You will find a recipe to work around all bugs stopping the installation of freeipa with integrated DNS on 18.04/bionic as of this date. Hopefully folks who like to fix things can work these into the install scripts and programs. At the heart of the timing problems (there are many others) is the install script's habit of (re) starting a service then nearly immediately placing calls to it (which fail as the service isn't up yet). 4 cores and 4GB of memory was enough to avoid all but two of the problems. The above note includes four lines of code in two files that inject waits until the system load is under 9% before processing further after starting a service. HTH -- You received this bug notification because you are a member of FreeIPA, which is subscribed to freeipa in Ubuntu. https://bugs.launchpad.net/bugs/1627371 Title: Timing problems with FreeIPA installation Status in dogtag-pki package in Ubuntu: Confirmed Status in freeipa package in Ubuntu: Confirmed Bug description: While installing FreeIPA I came accross two situations that turned out to be timing problems. In both cases, the installation procedure was attempting to access the certificate server immediately after a restart, and the server was not listening. The first one is at step 10 of "Configuring certificate server (pki_tomcatd)": [10/28]: importing CA chain to RA certificate database [error] RuntimeError: Unable to retrieve CA chain: [Errno 111] Connection refused ipa.ipapython.install.cli.install_tool(Server): ERROR Unable to retrieve CA chain: [Errno 111] Connection refused The second is at step 25: [25/28]: migrating certificate profiles to LDAP [error] NetworkError: cannot connect to 'https://server.name:8443/ca/rest/account/login': Could not connect to server.name using any address: (PR_ADDRESS_NOT_SUPPORTED_ERROR) Network address type not supported. My solution was to add a delay at the top of the functions for those steps. def __import_ca_chain(self): + ##====================== + # Add wait time to allow certificate server to start up + # + time.sleep(10) chain = self.__get_ca_chain() ... def migrate_profiles_to_ldap(): """Migrate profiles from filesystem to LDAP. This must be run *after* switching to the LDAPProfileSubsystem and restarting the CA. The profile might already exist, e.g. if a replica was already upgraded, so this case is ignored. """ + ##====================== + # Add wait time to allow certificate server to start up + # + time.sleep(20) ensure_ldap_profiles_container() It might be necessary to adjust the sleep time. These bugs are intermittent and they may not appear at all. In my case, one KVM machine had no problems whatsoever while another had problems at the "migrate profiles ..." step. Both problems showed up on one Raspberry Pi. There were also time differences between runs. So, one needs to be _very_ patient. This is all on Ubuntu Xenial. freeipa-server 4.3.1-0ubuntu1. The RaspberryPi is a pi 2B To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/dogtag-pki/+bug/1627371/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~freeipa Post to : freeipa@lists.launchpad.net Unsubscribe : https://launchpad.net/~freeipa More help : https://help.launchpad.net/ListHelp
