freeipa

#6103 [RFE] idempotent ipa-client-install
Closed: wontfix by frenaud. Opened by pvoborni.

Closed: wontfix
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1353681

We should provide advanced troubleshooting and diagnostics for clients
experiencing issues with IPA.
For example, a client was having issues with systems frequently losing IPA
functionality.  After lots of troubleshooting, we ended up re-doing the
ipa-client-install and it would work until rogue config mgmt "fixed" it.
To the customer, they now view everything in terms of idempotence (is that the
word?!) like with Ansible or Puppet, so they want to rerun ipa-client-install
in a --noop / dry-run mode and watch for changes.  The remaining tasks would
check things like:
* NTP and time
* DNS and name services resolution
* Kerberos configuration, KDC and realm verification
* Service Statii - ie sssd, etc

Note: trouble shooting tool is handled in #4008

Would it be possible to have ansible module frontend for ipa-client-install? Being able to write:

- name: subscribe machine to IPA
  ipa_client:
    state: installed/uninstalled  # or joined/left or ... - if joined, call --uninstall
    domain: ipa.example.com
    mkhomedir: yes
    ca_cert: file/uri/inline
    # other options maching CLI options of ipa-client-install

is much better than building the command line manually by each and every ipa-client+ansible user, trying to infer current status from /etc/ipa directory contents (yeah, that will be solved by idempotence) and native status/error reporting will be a huge plus as well.

All that hopefully with the same code doing the actual heavy lifting.

Better Ansible integration is on our radar for next major release (the one after 4.5).

But idempotency won't probably be in initial Ansible support of client installation. The reason is that to support changes - like adding or removing only some specific client configurations we would need to heavily refactor the client installer which takes significant amount of time.

So the initial support of adding or removing config will probably be "install" -> "uninstall" -> "install".

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: Future Releases

The ansible_freeipa collection provides ipaclient role that allows a repair mode with the variable ipaclient_allow_repair.
Closing this ticket as the ipaclient role will be the recommended method to perform a repair of an already installed client.

Metadata Update from @frenaud:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
enhancement
Client
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.