Issue #9674: ipa client doesn't seem to handle main runs - fedora-infrastructure

fedora-infrastructure

#9674 ipa client doesn't seem to handle main runs

Closed: Fixed Feb 19, 2021 by kevin. Opened Feb 17, 2021 by kevin.

roles/ipa/client doesn't seem to handle the case where it's called from a main.yml run.

the koji-hub.yml playbook when run on staging completes fine.

When running from main.yml however:

TASK [ipa/client : Give certain groups shell access per host group] ************************************************
Wednesday 17 February 2021  18:41:22 +0000 (0:00:05.664)       2:15:06.373 ****                                    
Wednesday 17 February 2021  18:41:22 +0000 (0:00:05.664)       2:15:06.373 ****                                     
ok: [koji01.stg.iad2.fedoraproject.org -> ipa01.stg.iad2.fedoraproject.org] => (item=['ipa01.stg.iad2.fedoraproject.
org', 'kojihub'])                                                                                                   
failed: [koji01.stg.iad2.fedoraproject.org -> ipa01.iad2.fedoraproject.org] (item=['ipa01.iad2.fedoraproject.org', '
kojihub']) => {"ansible_loop_var": "item", "changed": false, "item": ["ipa01.iad2.fedoraproject.org", "kojihub"], "m
sg": "hbacrule_add_user: group sysadmin-releng: no such entry"}

Note that it's trying to contact the PROD ipa server, not staging...

CC @nphilipp

Metadata Update from @smooge:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: medium-gain, medium-trouble

Feb 17, 2021

Metadata Update from @nphilipp:
- Issue assigned to nphilipp

Feb 18, 2021

nphilipp commented Feb 18, 2021

As discussed in IRC, this is a side effect of delegating fact-finding re: IPA to one host and manually iterating over all hosts/groups in the play which doesn't care about why the ipa/client role is in use.

Best course of action seems to be your suggestion to add a flag set to false for the all group, true in staging and for the prod hosts we want to have it on and check for it in ipa/client/tasks/prepare-ipa-info.yml.