Description of problem:
When installing FreeIPA with an external CA, the second ipa-server-install
--external-cert-file=... pass causes the addition of unnecessary /etc/hosts
entries, presumably by way of this bit from around line 620 in
/usr/lib/python2.7/site-packages/ipaserver/install/server/install.py:
    # installer needs to update hosts file when DNS subsystem will be
    # installed or custom addresses are used
    if options.ip_addresses or options.setup_dns:
        installer._update_hosts_file = True
It appears to be recording the addresses it saw on the first pass, and
unconditionally treating them as manually specified command line options on the
second.
Version-Release number of selected component (if applicable):
freeipa-server-4.4.4-1.fc25.x86_64
python2-ipaserver-4.4.4-1.fc25.noarch
How reproducible:
100% with --external-ca / --external-cert-file
Steps to Reproduce:
1. Run ipa-server-install --external-ca
2. Sign the resulting CSR
3. Run ipa-server-install --external-cert-file=ipa.pem
--external-cert-file=ca.pem
Actual results:
/etc/hosts is modified with all v4/v6 addresses currently present on the host,
including dynamic SLAAC and privacy addresses
Expected results:
/etc/hosts is left alone
Additional info:
This is obviously easy to clean up by hand, but appears to be an oversight in
the install scripts that'll cause surprises for anyone installing IPA with an
external CA on hosts with dynamic or otherwise temporary addresses.