self = <ipatests.test_integration.test_edns.TestDNSOverTLS_EnforcedPolicy_IPA_CA object at 0x7f9abca639d0>
    def test_dot_enforced_dns_policy_with_ipa_ca(self):
        """
        This test installs IPA server, replica, and client with
        --no-dnssec-validation option, enforced DNS policy, and
        with IPA CA, ensuring all queries are encrypted.
        """
        # Install master first with enforced policy
        args = [
            "--dns-over-tls",
            "--dot-forwarder", "1.1.1.1#cloudflare-dns.com",
            "--no-dnssec-validation",
            "--dns-policy", "enforced",
            "--ip-address", self.master.ip
        ]
        tasks.install_master(self.master, extra_args=args)
        # Apply pre-configuration on client before installation
        apply_enforced_dns_preconfig(
            self.clients[0], self.master.ip, self.master,
            paths.IPA_CA_CRT, "ca.crt"
        )
        # Configure client nameserver
        self.clients[0].put_file_contents(
            paths.RESOLV_CONF,
            "nameserver %s" % self.master.ip
        )
        # Install client with enforced policy
        args = [
            "--dns-over-tls",
            "--no-dnssec-validation",
            "--ip-address", self.clients[0].ip
        ]
        tasks.install_client(
            self.master,
            self.clients[0],
            nameservers=None,
            extra_args=args
        )
        # Apply pre-configuration on replica before installation
        apply_enforced_dns_preconfig(
            self.replicas[0], self.master.ip, self.master,
            paths.IPA_CA_CRT, "ipa-ca.crt"
        )
        # Install replica with enforced policy
        args = [
            "--dns-over-tls",
            "--dot-forwarder", "1.1.1.1#cloudflare-dns.com",
            "--no-dnssec-validation",
            "--dns-policy", "enforced"
        ]
>       tasks.install_replica(
            self.master,
            self.replicas[0],
            setup_dns=True,
            extra_args=args
        )
args       = ['--dns-over-tls', '--dot-forwarder', '1.1.1.1#cloudflare-dns.com', '--no-dnssec-validation', '--dns-policy', 'enforced']
self       = <ipatests.test_integration.test_edns.TestDNSOverTLS_EnforcedPolicy_IPA_CA object at 0x7f9abca639d0>
test_integration/test_edns.py:491: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
pytest_ipa/integration/tasks.py:493: in install_replica
    install_client(master, replica, extra_args=ntp_args,
        args       = ['ipa-replica-install', '--admin-password', 'Secret.123', '--password', 'Secret.123']
        domain_level = 1
        extra_args = ['--dns-over-tls', '--dot-forwarder', '1.1.1.1#cloudflare-dns.com', '--no-dnssec-validation', '--dns-policy', 'enforced']
        fw         = <ipatests.pytest_ipa.integration.firewall.Firewall object at 0x7f9abb1ebf50>
        fw_services = ['freeipa-ldap', 'freeipa-ldaps']
        ipatests_dse = '/root/ipatests/ipatests_dse.ldif'
        master     = <ipatests.pytest_ipa.integration.host.Host master.ufreeipa.test (master)>
        nameservers = 'master'
        ntp_args   = []
        promote    = True
        raiseonerr = True
        replica    = <ipatests.pytest_ipa.integration.host.Host replica1.ufreeipa.test (replica)>
        replica_args = ['--dns-over-tls', '--dot-forwarder', '1.1.1.1#cloudflare-dns.com', '--no-dnssec-validation', '--dns-policy', 'enforced']
        setup_adtrust = False
        setup_ca   = True
        setup_dns  = True
        setup_kra  = False
        stdin_text = None
        unattended = True
pytest_ipa/integration/tasks.py:570: in install_client
    client.resolver.backup()
        client     = <ipatests.pytest_ipa.integration.host.Host replica1.ufreeipa.test (replica)>
        error      = 1
        extra_args = []
        master     = <ipatests.pytest_ipa.integration.host.Host master.ufreeipa.test (master)>
        nameservers = 'master'
        password   = None
        pkinit_identity = None
        stdin_text = None
        unattended = True
        user       = None
        zone       = '195.0.10.in-addr.arpa.'
pytest_ipa/integration/resolver.py:57: in backup
    self.check_state_expected()
        self       = <ipatests.pytest_ipa.integration.resolver.PlainFileResolver object at 0x7f9abc4a3f50>
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <ipatests.pytest_ipa.integration.resolver.PlainFileResolver object at 0x7f9abc4a3f50>
    def check_state_expected(self):
        """Checks if resolver configuration has not changed.
        Raises AssertionError if actual configuration has changed since last
        call to any method of Resolver
        """
>       assert self._get_state() == self.current_state, (
            'Resolver state changed unexpectedly at host {}'.format(self.host))
E       AssertionError: Resolver state changed unexpectedly at host <Host replica1.ufreeipa.test (replica)>
E       assert {'resolv_conf...\nsearch .\n'} == {'resolv_conf...0.11.142.1\n'}
E         
E         Differing items:
E         {'resolv_conf': '# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).\n# Do not edit.\n...he supported modes of\n# operation for /etc/resolv.conf.\n\nnameserver 127.0.0.53\noptions edns0 trust-ad\nsearch .\n'} != {'resolv_conf': 'search ufreeipa.test\n\nnameserver 10.0.195.6\nnameserver 10.11.5.19\nnameserver 10.11.142.1\n'}
E         
E         Full diff:
E           {
E         -     'resolv_conf': 'search ufreeipa.test\n'...
E         
E         ...Full output truncated (34 lines hidden), use '-vv' to show
self       = <ipatests.pytest_ipa.integration.resolver.PlainFileResolver object at 0x7f9abc4a3f50>
pytest_ipa/integration/resolver.py:91: AssertionError

    elif osinfo.id == 'fedora':
        # Fedora configuration
        # Configure systemd-resolved for DNS over TLS
        host.run_command([
            "ln", "-sf", "../run/systemd/resolve/stub-resolv.conf",
            "/etc/resolv.conf"
        ])
        host.run_command(["systemctl", "restart", "systemd-resolved"])
        # Configure DNS over TLS via systemd-resolve
        host.run_command([
            "systemd-resolve", "--set-dns", master_ip,
            "--set-dnsovertls=yes", f"--interface={iface}"
        ])