freeipa

#7635 ipa dns install with --dnssec-master failing
Closed: fixed Opened by ksiddiqu.

Closed: fixed
Reopen Issue

Issue

ipa dns install with --dnssec-master failing with current freeipa master bits.

[root@dhcp207-43 ~]# ipa-dns-install --dnssec-master --forwarder 10.65.201.89 -U

....
.....
[8/8]: configuring OpenDNSSEC enforcer to start on boot
Done configuring OpenDNSSEC enforcer daemon (ods-enforcerd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records
==============================================================================
Setup complete

Unexpected error - see /var/log/ipaserver-install.log for details:
ValidationError: invalid 'DNSSec key master': all masters must have DNS server role enabled
[root@dhcp207-43 ~]# echo $?
1
[root@dhcp207-43 ~]#

Steps to Reproduce

  1. Install IPA server without dns
    ipa-server-install -n testrelm.test -r TESTRELM.TEST -p Secret.123 -a Secret.123 --domain-level=1 -U
  2. Install dns with --dnssec-master option
    ipa-dns-install --dnssec-master --forwarder 10.65.201.89 -U

Actual behavior

Dns install fails

Expected behavior

dns install should have been successful.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

[root@dhcp207-43 ~]# rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.6.90test-0.fc28.x86_64
freeipa-client-4.6.90test-0.fc28.x86_64
389-ds-base-1.4.0.10-2.fc28.x86_64
pki-ca-10.6.3-1.fc28.noarch
krb5-server-1.16.1-7.fc28.x86_64
[root@dhcp207-43 ~]#

Pkgs used from latest PR CI nightly repos from http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/6dbfb6c2-83d2-11e8-8552-fa163e53fc78/rpms/

Additional info:

Snip from /var/log/ipaserver-install.log 

[root@dhcp207-43 ~]# tail -n 50 /var/log/ipaserver-install.log 
2018-07-10T08:42:15Z DEBUG raw: location_find(None, version='2.229')
2018-07-10T08:42:15Z DEBUG location_find(None, all=False, raw=False, version='2.229', pkey_only=False)
2018-07-10T08:42:15Z DEBUG raw: dnsconfig_show(version='2.229')
2018-07-10T08:42:15Z DEBUG dnsconfig_show(rights=False, all=False, raw=False, version='2.229')
2018-07-10T08:42:15Z DEBUG   File "/usr/lib/python3.6/site-packages/ipaserver/install/installutils.py", line 798, in run_script
    return_value = main_function()
  File "/usr/sbin/ipa-dns-install", line 144, in main
    dns_installer.install(True, False, options)
  File "/usr/lib/python3.6/site-packages/ipaserver/install/dns.py", line 366, in install
    bind.check_global_configuration()
  File "/usr/lib/python3.6/site-packages/ipaserver/install/bindinstance.py", line 1166, in check_global_configuration
    result = self.api.Command.dnsconfig_show()
  File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 450, in __call__
    return self.__do_call(*args, **options)
  File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 478, in __do_call
    ret = self.run(*args, **options)
  File "/usr/lib/python3.6/site-packages/ipalib/frontend.py", line 800, in run
    return self.execute(*args, **options)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 4258, in execute
    result = super(dnsconfig_show, self).execute(*keys, **options)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/baseldap.py", line 1337, in execute
    self, ldap, entry_attrs.dn, entry_attrs, *keys, **options)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/dns.py", line 4264, in post_callback
    entry_attrs, "DNS server", **options)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/config.py", line 306, in show_servroles_attributes
    self.update_entry_with_role_config(role, entry_attrs)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/config.py", line 286, in update_entry_with_role_config
    role_config = backend.config_retrieve(role_name)
  File "/usr/lib/python3.6/site-packages/ipaserver/plugins/serverroles.py", line 143, in config_retrieve
    attr_value = attr.get(self.api)
  File "/usr/lib/python3.6/site-packages/ipaserver/servroles.py", line 438, in get
    masters = super(SingleValuedServerAttribute, self).get(api_instance)
  File "/usr/lib/python3.6/site-packages/ipaserver/servroles.py", line 291, in get
    {'role': self.associated_role.name})
2018-07-10T08:42:15Z DEBUG The ipa-dns-install command failed, exception: ValidationError: invalid 'DNSSec key master': all masters must have DNS server role enabled
[root@dhcp207-43 ~]#

When did the problem occur for the first time? It might be caused by a recent improvement, https://github.com/freeipa/freeipa/pull/2112

Metadata Update from @cheimes:
- Issue assigned to cheimes

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2128
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.5.5

It occured on Friday, 6th July

Metadata Update from @ksiddiqu:
- Custom field on_review reset (from https://github.com/freeipa/freeipa/pull/2128)
- Issue priority set to: None (was: important)
- Issue set to the milestone: None (was: FreeIPA 4.5.5)

Metadata Update from @ksiddiqu:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2128
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.5.5

master:

  • 9222a08c288159a7a150923a2eb825a47da36a13 Fix DNSSEC install regression

ipa-4-5:

  • 56e03098c6166c546be0543a3763545778fa37d4 Fix DNSSEC install regression

ipa-4-6:

  • 87466d167f2744ff81d38880cec60a1b9f8e2783 Fix DNSSEC install regression

@cheimes can this be closed?

Yes, it's fixed.

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

regression

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.