Steps to Reproduce

1. Install IPA with CA and KRA on primary server
2. Install IPA replica with CA and KRA on secondary server
3. Uninstall IPA from primary server

Actual Result

After step 1 ipa config-show returned this:

  IPA masters: primary.example.com
  IPA CA servers: primary.example.com
  IPA KRA servers: primary.example.com

and the primary CA's CS.cfg had this:

ca.connector.KRA.host=primary.example.com

After step 2 ipa config-show returned this:

  IPA masters: primary.example.com, secondary.example.com
  IPA CA servers: primary.example.com, secondary.example.com
  IPA KRA servers: primary.example.com, secondary.example.com

The primary CA's CS.cfg had this:

ca.connector.KRA.host=primary.example.com

but the secondary CA's CS.cfg had this:

ca.connector.KRA.host=primary.example.com:8443 secondary.example.com:8443

This happened because pkispawn copied the param from the primary CA when installing the secondary CA, then added the secondary KRA into this param when installing the secondary KRA, but currently it has no mechanism to update the param in the primary CA.

After step 3 ~~ipa config-show returned this:~~

  IPA masters: secondary.example.com
  IPA CA servers: primary.example.com, secondary.example.com
  IPA KRA servers: primary.example.com, secondary.example.com

~~but sometimes it returned this instead:~~

  IPA masters: primary.example.com, secondary.example.com
  IPA CA servers: primary.example.com, secondary.example.com
  IPA KRA servers: primary.example.com, secondary.example.com

~~This probably happened because the DS on the primary IPA was shutdown and removed before the config changes could be replicated to the DS on the secondary IPA.~~

~~Also,~~ the secondary CA's CS.cfg had this:

ca.connector.KRA.host=primary.example.com:8443 secondary.example.com:8443

This happened because currently pkidestroy has no mechanism to remove the primary KRA from the secondary CA.

Expected Result

Based on the current design, after step 2 the primary CA's CS.cfg should have this:

ca.connector.KRA.host=primary.example.com:8443 secondary.example.com:8443

and after step 3 ~~ipa config-show should return this consistently:~~

  IPA masters: secondary.example.com
  IPA CA servers: secondary.example.com
  IPA KRA servers: secondary.example.com

~~and~~ the secondary CA's CS.cfg should have this:

ca.connector.KRA.host=secondary.example.com

Since there's no guarantee that all existing replicas will be available when a replica is added/removed, even if this issue is fixed in PKI pkispawn/pkidestroy could still fail to update all replicas properly and the admin will ultimately be responsible to fix it manually.

One possible solution is to simply connect each CA to the local KRA on the same server so there's no need to add/remove other KRA replicas. This will require installing KRA on each replica (if KRA is needed at all), but this will also make each replica more consistent with each other.

Another possible solution is to migrate the KRA connector config into DS (just like CA profiles) so that the changes will be propagated automatically, then the CA will need to monitor config changes in DS.