1:15 p.m.
Christian Reiss via FreeIPA-users wrote:
Hey folks,
Running a 3-node FreeIPA Installation. All is well, but I am now
upgrading all VMs, including my three IPA Servers from Centos 7 to 8.
As the Upgrade for Centos 7 to 8 is a complete reinstall I would need
to, one at a time, upgrade an IPA server. The IP and FQDN would remain
the same.
- I read several documents out there and some say decommission one,
reinstall and add it again.
- Others go for replica-prepare and go from there.
- What about simply backup up the data direcory and restore that?
Maybe there is a recommended way?
I tried doing this some months ago for a failed server, and I got an
issue about replication agreement already existing which I only was able
to resolve by reinstalling. The proposed "modify ldap" was way, way
above me ;)
The recommended way is your first point: decommission one, reinstall
with new OS, add back to the pool. Rinse and repeat.
Things to remember:
- ensuring that the DNA range is preserved (it can be automagic but
watch out for it). See the ipa-replica-manage command for showing the
ranges.
- ensure that one master is defined as the CRL generator (and only one)
- ensure that one master is defined as the CA renewal master
- ensure you maintain the roles (and have at least 2 of everything)
- watch the replication topology when it's done and adjust as needed
We generally recommend that this transition happen over a fairly short
period of time, week(s) not months.
rob