chronyd for IPA?

[lejeczek]

Hi guys.

IPA in containers, in case may matter, its _chronyd_

-> $ ipa-healthcheck
[
   {
     "source": "ipahealthcheck.meta.services",
     "check": "chronyd",
     "result": "ERROR",
     "uuid": "d8c878ba-12a9-4d32-a03f-52db65e1a94d",
     "when": "20251022092910Z",
     "duration": "0.017229",
     "kw": {
       "status": false,
       "msg": "chronyd: not running"
     }
   },

I understand it's good that a system has a time service - is 
that why IPA worries about it?
But, more weirdly, one of three-replica domain master does 
not check for _chronyd_
-> $ systemctl status -l crond.service
○ crond.service - Command Scheduler
      Loaded: loaded (/usr/lib/systemd/system/crond.service; 
disabled; preset: enabled)
      Active: inactive (dead)
-> $ ipa-healthcheck
...
and no mention of it.
ipa 4.12.2

any/all comments are much appreciated.
thanks, L.

[Rob Crittenden]

lejeczek via FreeIPA-users wrote:
> Hi guys.
>
> IPA in containers, in case may matter, its _chronyd_
>
> -> $ ipa-healthcheck 
> [
>   {
>     "source": "ipahealthcheck.meta.services",
>     "check": "chronyd",
>     "result": "ERROR",
>     "uuid": "d8c878ba-12a9-4d32-a03f-52db65e1a94d",
>     "when": "20251022092910Z",
>     "duration": "0.017229",
>     "kw": {
>       "status": false,
>       "msg": "chronyd: not running"
>     }
>   },
>
> I understand it's good that a system has a time service - is that why
> IPA worries about it?
> But, more weirdly, one of three-replica domain master does not check for
> _chronyd_
> -> $ systemctl status -l crond.service 
> ○ crond.service - Command Scheduler
>      Loaded: loaded (/usr/lib/systemd/system/crond.service; disabled;
> preset: enabled)
>      Active: inactive (dead)
> -> $ ipa-healthcheck 
> ...
> and no mention of it.
> ipa 4.12.2
>
> any/all comments are much appreciated.
> thanks, L.

IPA knows what services it is managing. These are called server-roles.
You can find the enabled server roles for a given server using:

$ ipa server-role-find --status enabled --server ipa.example.test

It would seem that one of your servers has chronyd enabled as a role.
That is why healthcheck noticed.

rob