Task fails

[till]

Can't install server, it seems to fail at setting the name:

fatal: [keymaster]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: float object has no element 0\n\nThe error appears to have been in '/Users/till/.ansible/roles/timorunge.freeipa_server/tasks/dependencies.yml': line 8, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n  when: freeipa_server_manage_host\n- name: Add FreeIPA host entry\n  ^ here\n"}

[timorunge]

Hey,

thanks for reporting. Can you share your OS, and the vars that you're setting?

Thanks, Regards Timo

[till]

@timorunge yeah, I am trying to run on CentOS:

Linux keymaster.example.org 3.10.0 #1 SMP Wed May 23 10:04:13 MSK 2018 x86_64 x86_64 x86_64 GNU/Linux

cat /etc/centos-release
CentOS Linux release 7.5.1804 (Core)

I put all variables into a vault:

 # Admin user kerberos password                                                                                          
 freeipa_server_admin_password: Passw0rd                                                                                 
 # Primary DNS domain of the IPA deployment                                                                              
 freeipa_server_domain: keymaster.example.org                                                                  
 # Directory Manager password                                                                                            
 freeipa_server_ds_password: Passw0rd                                                                                    
 # The hostname of this machine (FQDN)                                                                                   
 freeipa_server_fqdn: keymaster.planetary-networks.de                                                                    
 # Master Server IP Address                                                                                              
 freeipa_server_ip: 172.20.0.2                                                                                           
 # Kerberos realm name of the IPA deployment                                                                             
 freeipa_server_realm: KEYMASTER.EXAMPLE.ORG

(Changed the hostname as I don't want to post it in public but it's a FQDN that resolves.)

[timorunge]

@till: Can you confirm that 5351f4d51e981321fcfece348dedc85360386891 is fixing the issue for you?

[till]

@timorunge do I just ansible-galaxy (with force) again to update? (Sorry, I am an ansible n00b.)

[timorunge]

@till this will do the trick: ansible-galaxy install -f timorunge.freeipa_server,master

[till]

@timorunge I added you to a requirements.yml — just learned about that. 💃

It continues beyond that step, but then fails with:

fatal: [keymaster]: FAILED! => {"changed": false, "msg": "Unable to find any of pip2, pip to use.  pip needs to be installed."}

Sorry for all the questions. Am I supposed to include a role for pip now? Or is that a dependency "missing" in your role?

[timorunge]

:)

This has nothing to do with the module itself. You need some basic-packages on your remote system.

yum install -y epel-release ; yum update -y ; yum install python-pip -y ; pip install --upgrade pip

[till]

OK, I did add a few more roles from galaxy for the things you suggested (to keep track of what I install) and it continues successfully!

Thanks so much for your help!

[timorunge]

You're welcome!

[till]

@timorunge

Two additional questions:

• can you publish a bugfix release?
• I see that configuration of krb5kdc and kadmin happens (probably through ipa), I am trying to figure out how to get it running — kinit admin is unable to contact it. I am gonna try to run through the setup again and enable them and start them, etc. — but is there anything else to take care of or would it be best to use another role for this?

[till]

If anyone ever gets here through Google:

KRB5_TRACE=/dev/stdout kinit admin

Helps to debug the hanging. Pointed me to something in DNS in my case (record of the domain for the KDC resolved wrong).

[timorunge]

@till

The bugfix release is done. Actually this role is meant just to do be a wrapper for the basic setup of FreeIPA. Actually there is an official Ansible role which can do a lot more (https://github.com/freeipa/ansible-freeipa) but this was overhead for my usage.

[till]

@timorunge Thanks! Yeah, same here. :) Your's worked in the end — I think I got confused by how FreeIPA uses all components. Even DNS is included and fed by LDAP. So that was what tripped me over.

Thanks again for responding/helping! :)