openQA failure seems to be a real one: it's the test that deploys a server and client as F33 and upgrades them to F34 to check that works OK. The server is showing up with ipa.service failed after the upgrade runs. Journal shows ipa-server-upgrade failed, with a ton of errors to do with things not existing, basically. The earliest message I see that's obviously an error is:
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: Parent DN of cn=ca,cn=topology,cn=ipa,cn=etc,dc=test,dc=openqa,dc=fedoraproject,dc=org may not exist, cannot create the entry
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: default_range: No local ID range and no admins group found. Cannot create default ID range
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: update_idrange_type: cannot retrieve list of ranges with no type set: no such entry
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: Error retrieving: cn=ipaConfig,cn=etc,dc=test,dc=openqa,dc=fedoraproject,dc=org
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: Upgrade failed with no such entry
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: ('IPA upgrade failed.', 1)
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information
Apr 08 13:05:37 ipa001.test.openqa.fedoraproject.org ipactl[678]: See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again
I believe this is actually an unclean shutdown of the VM during the upgrade. I investigated the logs and in no way IPA installation would have entries like
the cn=ng,cn=alt,$SUFFIX entry is a part of the FreeIPA bootstrap configuration and is imported as the very first part of deploying 389-ds instance:
...
dn: cn=ng,cn=alt,$SUFFIX
changetype: add
objectClass: nsContainer
cn: ng
It must have at least one object class or otherwise it will be not possible to import this entry.
Recently we've got a report that Fedora 34 VMs seem to have this issue in https://github.com/SSSD/sssd-test-suite/issues/21, so I have serious suspicion it is either Qemu/libvirt or systemd offline upgrade problem.
This update has been submitted for testing by tbordaz.
This update's test gating status has been changed to 'ignored'.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
openQA failure seems to be a real one: it's the test that deploys a server and client as F33 and upgrades them to F34 to check that works OK. The server is showing up with
ipa.servicefailed after the upgrade runs. Journal showsipa-server-upgradefailed, with a ton of errors to do with things not existing, basically. The earliest message I see that's obviously an error is:and the last few are:
Between that are a ton of others. Grab https://openqa.fedoraproject.org/tests/849781/file/role_deploy_domain_controller_check-var_log.tar.gz to see for yourself.
Bodhi is disabling automatic push to stable due to negative karma. The maintainer may push manually if they determine that the issue is not severe.
I believe this is actually an unclean shutdown of the VM during the upgrade. I investigated the logs and in no way IPA installation would have entries like
the
cn=ng,cn=alt,$SUFFIXentry is a part of the FreeIPA bootstrap configuration and is imported as the very first part of deploying 389-ds instance:It must have at least one object class or otherwise it will be not possible to import this entry.
Recently we've got a report that Fedora 34 VMs seem to have this issue in https://github.com/SSSD/sssd-test-suite/issues/21, so I have serious suspicion it is either Qemu/libvirt or systemd offline upgrade problem.
This update has been unpushed.
I unpushed this update as we have another report where downgrade of 389-ds-base helps: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org/thread/ZGX6MG65ACG6YU72DWB7FGBEMADOMKOC/
Bug https://bugzilla.redhat.com/show_bug.cgi?id=1947762 was opened to track this issue.