Home / server / Questions / 674169
In Process
David Ramirez
Asked: 2015-03-10 15:06:04 +0800 CST

Deployed IPA-server, created replica, then fed production data only to replica. How to fix?

  • 772

At some point, I deployed ipa-server on a CentOS 6 machine. Being asked to better move it into a VM, I used ipa-replica-prepare / ipa-replica-install . This resulted as wanted, and I got a working IPA-server prototype on the VM.

The original server was then disconnected to keep it as a fallback resource, but this eventually meant that actual production data was fed only to the replica server.

Now I have a full 100+ users operation based on the replica alone, not a healthy proposition. There is no disaster recovery here.

The initial server remains disconnected, but clients (e.g. ipa user-status) regard it as still being a master, and I am quite fearful of reconnecting it and have some unexpected outcome (such as my production databases being overwritten by the almost empty ones that are on the original server). Who has the authority do say which records are true?

Actually, to work around this, I want my current replica to become the master, forget about the old master, an eventually produce a new replica that would work as a backup of the current production environment. Creating a replica of the replica fails with "A replica can only be created on an IPA server installed with ipa-server-install (the first server)."

Instructions for promoting a replica into master are hard to find: The only relevant and somewhat old how-to for freeipa (Fedora) points to files that I don't find in my environment.
So my question boils to: How can I promote my replica to master? Can this be done live ? (Or with minimum downtime & risk ?)

Thanks

centos

1 Answers

  1. I do not recall ipa-replica-prepare having this kind of error. I, however, saw that the warning you mentioned appears in ipa-replica-prepare man pages. This is an invalid statement, you can create replicas from other masters too. Only if you are installing replica with CA, you should create the replica file on other replica with CA. For the man page bug, I filed upstream ticket.

    As for the problem you are having, see the upstream article for replica promotion. This again only applies to replicas with CA, other replicas are equal. Since you mentioned non-existing files, I am just slightly afraid you installed the IPA server with the unsupported --selfsign option - then the procedure would be different.

    As for your old master, I think it is pretty safe starting it again. It will likely just fail to replicate as it's date are too old. You would need to re-initialize it from the fresh replica, to get it working again.

    • 0