-
Story
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
-
False
-
None
-
False
-
Testable
-
-
https://pagure.io/fedora-infrastructure/issue/12158
Staging was affected by the same thing that hit produciton, but in the staging case both ipa02.stg and ipa03.stg were uninstalled.
So, we need to resetup ipa02.stg and ipa03.stg as replicas.
I attempted to do this last week, but it failed with:
```
"Configuring Kerberos KDC (krb5kdc)", " [1/6]: configurin
g KDC", " [2/6]: adding the password extension to the directory", " [3/6]: creating anonymou
s principal", " [4/6]: starting the KDC", " [5/6]: configuring KDC to start on boot", " [6/
6]: enable PAC ticket signature support", "Done configuring Kerberos KDC (krb5kdc).", "Configu
ring kadmin", " [1/2]: starting kadmin ", " [2/2]: configuring kadmin to start on boot", "Do
ne configuring kadmin.", "Configuring directory server (dirsrv)", " [1/3]: configuring TLS fo
r DS instance", " [error] RuntimeError: Certificate issuance failed (CA_UNREACHABLE: Server a
t https://ipa01.stg.iad2.fedoraproject.org/ipa/json failed request, will retry: 4016 (Failed t
o authenticate to CA REST API).)", "Your system may be partly configured.", "Run /usr/sbin/ipa
-server-install --uninstall to clean up."]}
```
I am not sure why it was saying ipa01.stg was unreachable there, it appears up and functioning fine.
Anyhow, we need to sort this out and perhaps add monitoring so we know it's broken when it is next time.