Why ipa-server package is installed on a client ?

[aellert]

I have a problem on several Debian client, puppet wants to apply ipa-server Package installation. Here is the yaml output of my clients :

classes: ipa: otp: OTP_PASSWORD adminpw: ADMIN_PASSWORD dspw: DS_PASSWORD master: false domain: mydomain.org mkhomedir: true client: true realm: MYDOMAIN.ORG cleanup: false

I really don't know why and tried to comment some portion without success.. Need help plz ! Thanks.

Here is some more information : puppet master --compile debian-client1.mydomain.org [ ... ] { "exported": false, "line": 71, "title": "ipa-server", "parameters": { "ensure": "installed" }, "tags": [ "package", "ipa-server", "class", "ipa" ], "type": "Package", "file": "/etc/puppet/modules/production/ipa/manifests/init.pp" }, [ ... ] { "exported": false, "title": "Ipa", "parameters": { "sssdtoolspkg": "sssd-tools", "dspw": "DS_PASSWORD", "svrpkg": "ipa-server", "cleanup": false, "sssd": true, "location": "", "realm": "MYDOMAIN.ORG", "otp": "OTP_PASSWORD", "clntpkg": "freeipa-client", "desc": "", "mkhomedir": true, "dns": false, "replica": false, "ldaputils": true, "ntp": false, "domain": "mydomain.org", "ldaputilspkg": "ldap-utils", "client": true, "kstart": true, "master": false, "sssdtools": true, "adminpw": "ADMIN_PASSWORD", "locality": "" },

=> A quick fix, that works for me, was to add a condition at the begin of init.pp : if $ipa::master == true { @package { $ipa::svrpkg: ensure => installed } }

[robruma]

Hi Alexandre,

I think I need more information about this problem. Can you send me the following info:

Client OS version Client Puppet version Node file contents

Also, can you try to deactivate the client node on the Puppet master then reactivate?

Run 'puppet node deactivate debian-client1.mydomain.org' on the Puppet master then issue a test run on the client to reactivate.

Thanks Rob

[aellert]

Hi,

Here is the information needed :

• Client OS version : Debian wheezy 7.1
• Client puppet version : 3.2.2 (from puppetlabs repo)
• I use Foreman as an ENC, so don't have node node.pp file. That's why in my first post, i sent YAML output from Foreman of node debian-client1.mydomain.org.

I tried 'puppet node deactivate debian-client1.mydomain.org' but puppet keeps try to install ipa-server package on debian-client1.mydomain.org.

Thanks for working on my issue !

Alexandre

[robruma]

Alexandre,

I have not tested this module with Debian Wheezy. Only Ubuntu 12.04, but I am not seeing the issues you are describing.

I will try to setup an environment similar to yours where I can reproduce this problem.

I will post any information I find.

Thanks Rob

[aellert]

Rob,

There are no official package for Debian Wheezy, that's why I've made y own (it's a backport from https://launchpad.net/~freeipa/+archive/ppa). They are available on my custom apt repository (add this to /etc/apt/sources.list) : deb http://apt.numeezy.fr wheezy main deb-src http://apt.numeezy.fr wheezy main (gpg key : B718F645)

Thanks again.

[robruma]

Alexandre,

I have confirmed that the freeipa-client package from your custom repo is being installed by this module correctly on a test Wheezy host I have stood up earlier today. However, I see changes occurring to the repo currently where it now appears that the freeipa-client package is missing.

Thanks Rob

[aellert]

I had some bugs on the package I made and version 3.2 is not totally compatible with the server version in Centos 6 (v 3.0) . So i upload a new package in my depot (version is downgraded to 3.0.2). Please remove the actual freeipa-client 3.2 and python-freeipa, do an apt-get update and reinstall freeipa-client. It should work.

Thanks

[robruma]

Alexandre,

I'm unable to confirm this is a problem with the module. I see the freeipa-client package being installed and configured on my test Wheezy host.

This issue appears to be specific to your environment which I cannot replicate exactly since I do not use Foreman.

Sorry, I don't seem to have an answer for this...

Thanks Rob

[aellert]

Hi Rob,

I will check my environment and update my ipa module to the latest version. Thanks for watching.

Alexandre

[aellert]

I think i found the issue : I have an apt module which configure sources.list, do other things and I have a snippet which says "do an apt-get update before trigger package installation" in this submodule : class apt::update { include apt::params

exec { 'apt_update': command => "${apt::params::provider} update", logoutput => 'on_failure', refreshonly => true, }

Exec["apt_update"] -> Package <| |> }

If I comment "Exec["apt_update"] -> Package <| |>", ipa-server package does not try to be installed !

[aellert]

It's a bug in puppet : http://projects.puppetlabs.com/issues/7240 http://www.mail-archive.com/puppet-users@googlegroups.com/msg41795.html

syntax : Exec["apt_update"] -> Package <| |> should work but it actually install all virtual ressources everywhere !

Alexandre