Issue

Some HSMs are not particularly fast in some cases. We saw dbus timeouts starting tracking certificates in https://pagure.io/freeipa/issue/9725 and now we are seeing some tomcat startup timeouts on the same HSM.

In particular when installing a KRA in the initial installation step we see a 100% failure rate when the PKI service is restarted after the KRA is spawned.

Feb 04 10:18:10 hsm.example.test systemd[1]: Starting pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat...

Feb 04 10:18:33 hsm.example.test ipa-pki-wait-running[674333]: ipa-pki-wait-running: Connection failed: HTTPConnectionPool(host='hsm.example.test', port=8080): Read timed out. (read timeout=1.0)

Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: start-post operation timed out. Terminating.
Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: Control process exited, code=killed, status=15/TERM
Feb 04 10:19:50 hsm.example.test systemd[1]: pki-tomcatd@pki-tomcat.service: Failed with result 'timeout'.
Feb 04 10:19:50 hsm.example.test systemd[1]: Failed to start pki-tomcatd@pki-tomcat.service - PKI Tomcat Server pki-tomcat.

Creating /etc/ipa/installer.conf with a startup_timeout mitigates a failure during the spawn but it always fails in systemd because it still uses the default systemd timeout.