Issue

ipa-server-upgrade is always calling setup_lightweight_ca_key_retrieval() even if a previous upgrade already did the job.

Steps to Reproduce

1. run ipa-server-upgrade a first time. The debug log shows: Set up lightweight CA key retrieval
2. run ipa-server-upgrade a 2nd time. The debug log shows: Set up lightweight CA key retrieval, even though the job was already done.

Expected behavior

The 2nd call should detect that upgrade already prepared the server for lightweight CA key retrieval and skip this part

The issue happens because of a typo in sysupgrade.state. The code is looking for

[dogtag]
setup_lwca_key_retrieval = True

but the file contains

[dogtag]
setup_lwca_key_retieval = True

(Note the missing r in retrieval).

Apparently there is no consequence on the server health, but this typo needs to be fixed.