Open lessfoobar opened 1 year ago
I've made a few tests, and your scenario seems to work with ansible-freeipa version 1.9.0, and a few modifications.
Release 1.9.0 added some variables to the ipaclient
role that allow one to setup DNS resolution on the target node when configuring ipaclient
and ipareplica
. If you add something like the following to your vars
files, it might fix the issue:
# Update DNS records.
ipaclient_all_ip_addresses: yes
# Configure DNS nameservers on target nodes
ipaclient_configure_dns_resolver: yes
ipaclient_dns_servers:
# Server with embedded DNS
- 192.168.122.30
# Replica with embedded DNS
- 192.168.122.31
These variables are accepted by the ipaclient
role, but can be used by ipareplica
as it makes use of ipaclient
.
With this setup I was able to deploy an IPA cluster without any extra task or role.
One thing to notice is that it will change your name resolution configuration (systemd-resolved, NetworkManager, or plain /etc/resolv.conf). Please, read ipaclient
documentation for further information.
I've opened issue #1008 which is related to the problem you are facing.
@rjeffman I'll check in a couple of hours and report back to you. So the above variables should be set when you want freeipa to be your main dns server, or am I reading it wrong? Also they are only for the clients correct? Because from my logs I can see that the replica is failing on the client step not the replica instalation. Also can I use fqdns or IPs will be better for that scenarion?
A replica is a client that is promoted to replica, and this behavior is copied by ansible-freeipa deployment. So, yes, those variables are for the "client part" (but are needed by both 'ipareplica' and 'ipaclient' roles).
It actually does not matter much if the FreeIPA server is the main DNS server, as you can set any nameserver there, but it is mostly useful if the FreeIPA server(s) will also act as nameserver. As this will configure the nameserver for the hosts, you should use IPs there. Think of this alternative as a "resolv.conf on steroids".
hi guys, I have same issues:
│ TASK [ipaclient : Install - IPA client test] │ fatal: [ipa3.s1.test.local]: FAILED! => {"changed": false, "msg": "Unable to find IPA Server to join"} │ fatal: [ipa2.s2.test.local]: FAILED! => {"changed": false, "msg": "Unable to find IPA Server to join"} │ fatal: [ipa4.s2.test.local]: FAILED! => {"changed": false, "msg": "Unable to find IPA Server to join"}
Ipa server install is successful all three replicas fails. I followed your instructions and same results. I can install whole cluster only in two step installation. First ipaserver than add DNS A records for all servers and run second time and will work.
[ipaserver:vars] ipaserver_setup_dns=yes ipaserver_setup_kra=yes ipaserver_auto_forwarders=yes ipaserver_allow_zone_overlap=yes ipaserver_auto_reverse=true ipaserver_forwarders=10.10.0.1 ipaserver_setup_firewalld=yes
[ipareplica:vars] ipadm_password=Somepassword ipareplica_setup_dns=yes ipareplica_setup_ca=yes ipareplica_setup_kra=yes ipaserver_hostname=ipa1.s1.test.local ipaclient_force_join=yes ipareplica_domain=test.local ipaadmin_principal=admin ipaadmin_password=Somepassword ipareplica_allow_zone_overlap=yes ipareplica_auto_reverse=yes ipareplica_forwarders=10.10.0.1 ipareplica_setup_firewalld=yes ipaclient_all_ip_addresses=yes ipaclient_configure_dns_resolver=yes ipaclient_dns_servers=10.30.0.110,10.20.0.110
Any idea what I'm doing wrong?
@arozmarin Hi, you are setting two two DNS server IPs 10.30.0.110 and 10.20.0.110. Which machines are these?
BTW, why are you enabling ipaclient_force_join?
I'm assuming you want your ipaserver to be the nameserver, so ipaclient_dns_servers=10.30.0.110,10.20.0.110
should contain the server's IP address.
yes that correct, both ipaserver (10.30.0.110)and ipareplica(10.20.0.110) I want to be nameservers. Ipaclient_force_join I have just in case that client was already member before and just in case I have to rebuilt cluster will join again. For now my solution is in three steps:
For now I'm happy with that but I will try to do all that in one step if possible.
I get IPA join error when I use a dynamic inventory, which is from the cloud provider itself and when a machine is provisioned the cloud DNS is updated. However, this works when it's static, which is not desired:
ERROR:
fatal: [master2.example.com]: FAILED! => {
"changed": false,
"invocation": {
"module_args": {
"all_ip_addresses": false,
"ca_cert_files": null,
"configure_firefox": false,
"domain": "example.com",
"enable_dns_updates": false,
"firefox_dir": null,
"force_ntpd": false,
"hostname": "master2.example.com",
"ip_addresses": null,
"kinit_attempts": 5,
"nisdomain": null,
"no_nisdomain": false,
"no_ntp": false,
"ntp_pool": null,
"ntp_servers": null,
"on_master": false,
"realm": "EXAMPLE.COM",
"servers": null
}
},
"msg": "Unable to find IPA Server to join"
}
Playbook:
- hosts:
- master1.example.com
roles:
- role: freeipa.ansible_freeipa.ipaserver
vars:
ipaserver: "{{ inventory_hostname }}"
ipaserver_hostname: "{{ inventory_hostname }}"
ipadm_password: SuperSecret123
ipaadmin_password: SuperSecret123
ipaserver_ip_addresses: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
ipaserver_domain: "example.com"
ipaserver_realm: "EXAMPLE.COM"
ipaserver_no_host_dns: true
ipaserver_mem_check: true
ipaserver_idstart: 6000
ipaserver_setup_dns: false
ipaserver_no_pkinit: true
- hosts:
- master2.example.com
become: true
roles:
- role: freeipa.ansible_freeipa.ipareplica
vars:
ipaservers: master1.example.com
ipaserver_hostname: master1.example.com
ipareplicas: master2.example.com
ipareplica_domain: example.com
ipaclient_force_join: true
ipaadmin_principal: admin
ipareplica_setup_dns: false
Works when using static inventory:
[ipaservers]
master1.example.com
[ipareplicas]
master2.example.com
Also... Including static inventory it also worked using add_host
module by adding my master1.example.com
to the group ipaservers
for in memory inventory.
Does this mean the ipaservers:
variable is ignored..?
have you tried using ipaserver_no_host_dns?
The problem that I'm experiencing
The problem is that the replica doesn't find the master. The master is working fine, however I can't join any clients, so I'm not sure if the problem is only on the replica or in the master server.
System Information
OS: Fedora 37 minimal install server-netinst.iso used only changes to the system were my ansible user and the ssh keys
kernel-version 6.0.12-300.fc37.x86_64
ansible --version ansible [core 2.14.0] config file = /etc/ansible/ansible.cfg configured module search path = ['/home/lessfoobar/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.11/site-packages/ansible ansible collection location = /home/lessfoobar/.ansible/collections:/usr/share/ansible/collections executable location = /usr/bin/ansible python version = 3.11.0 (main, Oct 24 2022, 00:00:00) [GCC 12.2.1 20220819 (Red Hat 12.2.1-2)] (/usr/bin/python3) jinja version = 3.0.3 libyaml = True
ansible-galaxy collection list freeipa.ansible_freeipa 1.9.0
Ansible Vars
ipacluster vars:
ipaserver vars:
ipareplicas vars:
Inventory file
Playbook used: https://github.com/freeipa/ansible-freeipa/blob/master/playbooks/install-cluster.yml
Ansible Playbook Logs
ansible_output.log
Ipa Logs Master
/var/log/ipaserver-install.log /var/log/ipaclient-install.log /var/log/ipa-custodia.audit.log Empty /var/log/ipa/ipactl.log
Ipa Logs Replica
/var/log/ipareplica-install.log /var/log/ipaclient-install.log