Re: Better way to upgrade IPAServer4.6.4 to 4.6.5 + OS 7.6 to 7.7?

[Florence Blanc-Renaud]

On 6/12/20 2:52 PM, Karim Bourenane wrote:
>  Hello Florence, All
>  
>  After your recommendation :
>  yum update
>  ipactl start ( start will be start ipa-server-upgrade too)
>  
>  In attachment the ipaupgrade.log file
>  I hope the file will be taken by the website.
>   
Hi,

can you check the content of the /etc/ipa/default.conf file?
I have never seen this error but it may happen if "mode = developer" is 
set in your default.conf, instead of "mode = production".

HTH,
flo
>  
>  Bien à vous
>  Mr Karim Bourenane
>  [phone]
>  [phone]
>  
>  
>  Le jeu. 11 juin 2020 à 10:02, Florence Blanc-Renaud <flo(a)redhat.com 
>  <mailto:[e-mail]>> a écrit :
>  
>      On 6/9/20 10:04 AM, Karim Bourenane via FreeIPA-users wrote:
>       > Hello Florence, all
>       >
>       > I have also only update ipa-*, but i have same Error. Its appears
>      that
>       > unable to unlink the port 8433 TCPV6 by pki-tomcat used by
>      FreeIPA. Im
>       > actually blocked with this minor update.
>       >
>      Hi,
>      do you mean that you ran
>      # yum update ipa-*
>      instead of
>      # yum update
>      ?
>  
>      The recommendation is to upgrade all the packages when upgrading the OS
>      version, not only the ipa ones.
>      Also please post the content of /var/log/ipaupgrade.log for us to
>      understand the exact issue.
>  
>      flo
>  
>       > ....
>       > [Ensurung CA is using LDAPProfileSubsustem)
>       > [Migration certificat profiles to LDAP]
>       > IPA server upgrade failed : Inspect /var/log/ipaupgrade.log and run
>       > command ipa-upgrade manually. Unexpected error - see
>       > /var/log/ipaupgrade.log for details:
>       > AttributeError: locked cannot see ra_certprofile.override_port to
>      8443
>       >
>       > ipa: DEBUG : File
>       >
>      /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py at
>       > line 1015, in run_script
>       > return_value = main_function ()
>       >
>       > File /usr/sbin/ipactl, line 598, in main
>       > ipa_start (options)
>       >
>       > File /usr/sbin/ipactl, line 288, in main
>       > version_check ()
>       >
>       > File /usr/sbin/ipactl, line161, in version_ckeck
>       > raise IpactlError ("Abording ipactl")
>       >
>       > Regard
>       > Karim
>       >
>       >
>       > Le lun. 8 juin 2020 à 08:58, Florence Blanc-Renaud
>      <flo(a)redhat.com <mailto:[e-mail]>
>       > <mailto:[e-mail] <mailto:[e-mail]>>> a écrit :
>       >
>       >     On 6/6/20 11:42 AM, Karim Bourenane via FreeIPA-users wrote:
>       >      > Hello Team
>       >      >
>       >      > I have some questions :
>       >      > 1°) I need your help, to find the better way to upgrade my
>      3 servers
>       >      > linked (replicat).
>       >      > I want to upgrade servers from CentOS 7.6 to CentOS7.7 with
>       >     update in
>       >      > same time the IPAServer (or separately ?)
>       >
>       >     Hi,
>       >
>       >     in order to upgrade each server from centOS 7.6 to CentOS
>      7.7, you need
>       >     to run "yum update".
>       >     This command will also update ipa-* packages and internally call
>       >     ipa-server-upgrade, meaning you don't need to manually call
>       >     ipa-server-upgrade.
>       >     Please find more information in "Updating Identity
>      Management" [1].
>       >
>       >     For multiple servers upgrade, keep in mind that the upgrade
>      needs to be
>       >     done sequentially, i.e upgrade server 1, wait a few minutes for
>       >     replication to propagate changes, upgrade server 2, etc...
>       >
>       >     HTH,
>       >     flo
>       >
>       >     [1]
>       >
>     
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>       >
>       >      >
>       >      > After searching on Freeipa.org and other site, i find :
>       >      > #ipactl stop
>       >      > #ipa-server-upgrade
>       >      > #ipactl start
>       >      >
>       >      > I not need to delete first the replication link before ?
>       >      > What is the better solution ways ?
>       >      >
>       >      > 2°) Is not better to migrate my IPAServers's to 4.7 or 4.8
>      version ?
>       >      > Or i need steps too ?
>       >      >
>       >      > Thanks you for your help
>       >      >
>       >      > Best Regard
>       >      > Bien à vous
>       >      > Mr Karim Bourenane
>       >      > [phone]
>       >      > [phone]
>       >      >
>       >      > _______________________________________________
>       >      > FreeIPA-users mailing list --
>       > freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>       >     <mailto:[e-mail]
>      <mailto:[e-mail]>>
>       >      > To unsubscribe send an email to
>       > freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>       >     <mailto:[e-mail]
>      <mailto:[e-mail]>>
>       >      > Fedora Code of Conduct:
>       > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>       >      > List Guidelines:
>       > https://fedoraproject.org/wiki/Mailing_list_guidelines
>       >      > List Archives:
>       >
>      https://lists.fedorahosted.org/archives/list/[e-mail]...
>       >      >
>       >
>       >
>       > _______________________________________________
>       > FreeIPA-users mailing list --
>      freeipa-users(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>       > To unsubscribe send an email to
>      freeipa-users-leave(a)lists.fedorahosted.org
>      <mailto:[e-mail]>
>       > Fedora Code of Conduct:
>      https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>       > List Guidelines:
>      https://fedoraproject.org/wiki/Mailing_list_guidelines
>       > List Archives:
>      https://lists.fedorahosted.org/archives/list/[e-mail]...
>       >
>

Better way to upgrade IPAServer4.6.4 to 4.6.5 + OS 7.6 to 7.7?

[Karim Bourenane]

Hello Florence, All

Yes, the mode into my /etc/ipa/default.cond = developement
I wanted POC's validation upgrade.

That's mean, i must tag "mode = production" temporarily before upgrading
into my LAB ?

I updated the default.conf file with the "mode = production", and the
update is very well done.

Thanks you very much, for you and all your help.

All the best

Bien à vous
Mr Karim Bourenane
[phone]
[phone]



Le jeu. 18 juin 2020 à 10:43, Florence Blanc-Renaud <flo(a)redhat.com&gt; a
écrit :

>  On 6/12/20 2:52 PM, Karim Bourenane wrote:
>  > Hello Florence, All
>  >
>  > After your recommendation :
>  > yum update
>  > ipactl start ( start will be start ipa-server-upgrade too)
>  >
>  > In attachment the ipaupgrade.log file
>  > I hope the file will be taken by the website.
>  >
>  Hi,
>
>  can you check the content of the /etc/ipa/default.conf file?
>  I have never seen this error but it may happen if "mode = developer" is
>  set in your default.conf, instead of "mode = production".
>
>  HTH,
>  flo
>  >
>  > Bien à vous
>  > Mr Karim Bourenane
>  > [phone]
>  > [phone]
>  >
>  >
>  > Le jeu. 11 juin 2020 à 10:02, Florence Blanc-Renaud <flo(a)redhat.com
>  > <mailto:[e-mail]>> a écrit :
>  >
>  >     On 6/9/20 10:04 AM, Karim Bourenane via FreeIPA-users wrote:
>  >      > Hello Florence, all
>  >      >
>  >      > I have also only update ipa-*, but i have same Error. Its appears
>  >     that
>  >      > unable to unlink the port 8433 TCPV6 by pki-tomcat used by
>  >     FreeIPA. Im
>  >      > actually blocked with this minor update.
>  >      >
>  >     Hi,
>  >     do you mean that you ran
>  >     # yum update ipa-*
>  >     instead of
>  >     # yum update
>  >     ?
>  >
>  >     The recommendation is to upgrade all the packages when upgrading the
>  OS
>  >     version, not only the ipa ones.
>  >     Also please post the content of /var/log/ipaupgrade.log for us to
>  >     understand the exact issue.
>  >
>  >     flo
>  >
>  >      > ....
>  >      > [Ensurung CA is using LDAPProfileSubsustem)
>  >      > [Migration certificat profiles to LDAP]
>  >      > IPA server upgrade failed : Inspect /var/log/ipaupgrade.log and
>  run
>  >      > command ipa-upgrade manually. Unexpected error - see
>  >      > /var/log/ipaupgrade.log for details:
>  >      > AttributeError: locked cannot see ra_certprofile.override_port to
>  >     8443
>  >      >
>  >      > ipa: DEBUG : File
>  >      >
>  >     /usr/lib/python2.7/site-packages/ipaserver/install/installutils.py at
>  >      > line 1015, in run_script
>  >      > return_value = main_function ()
>  >      >
>  >      > File /usr/sbin/ipactl, line 598, in main
>  >      > ipa_start (options)
>  >      >
>  >      > File /usr/sbin/ipactl, line 288, in main
>  >      > version_check ()
>  >      >
>  >      > File /usr/sbin/ipactl, line161, in version_ckeck
>  >      > raise IpactlError ("Abording ipactl")
>  >      >
>  >      > Regard
>  >      > Karim
>  >      >
>  >      >
>  >      > Le lun. 8 juin 2020 à 08:58, Florence Blanc-Renaud
>  >     <flo(a)redhat.com <mailto:[e-mail]>
>  >      > <mailto:[e-mail] <mailto:[e-mail]>>> a écrit :
>  >      >
>  >      >     On 6/6/20 11:42 AM, Karim Bourenane via FreeIPA-users wrote:
>  >      >      > Hello Team
>  >      >      >
>  >      >      > I have some questions :
>  >      >      > 1°) I need your help, to find the better way to upgrade my
>  >     3 servers
>  >      >      > linked (replicat).
>  >      >      > I want to upgrade servers from CentOS 7.6 to CentOS7.7 with
>  >      >     update in
>  >      >      > same time the IPAServer (or separately ?)
>  >      >
>  >      >     Hi,
>  >      >
>  >      >     in order to upgrade each server from centOS 7.6 to CentOS
>  >     7.7, you need
>  >      >     to run "yum update".
>  >      >     This command will also update ipa-* packages and internally
>  call
>  >      >     ipa-server-upgrade, meaning you don't need to manually call
>  >      >     ipa-server-upgrade.
>  >      >     Please find more information in "Updating Identity
>  >     Management" [1].
>  >      >
>  >      >     For multiple servers upgrade, keep in mind that the upgrade
>  >     needs to be
>  >      >     done sequentially, i.e upgrade server 1, wait a few minutes
>  for
>  >      >     replication to propagate changes, upgrade server 2, etc...
>  >      >
>  >      >     HTH,
>  >      >     flo
>  >      >
>  >      >     [1]
>  >      >
>  >
>
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>  >      >
>  >      >      >
>  >      >      > After searching on Freeipa.org and other site, i find :
>  >      >      > #ipactl stop
>  >      >      > #ipa-server-upgrade
>  >      >      > #ipactl start
>  >      >      >
>  >      >      > I not need to delete first the replication link before ?
>  >      >      > What is the better solution ways ?
>  >      >      >
>  >      >      > 2°) Is not better to migrate my IPAServers's to 4.7 or 4.8
>  >     version ?
>  >      >      > Or i need steps too ?
>  >      >      >
>  >      >      > Thanks you for your help
>  >      >      >
>  >      >      > Best Regard
>  >      >      > Bien à vous
>  >      >      > Mr Karim Bourenane
>  >      >      > [phone]
>  >      >      > [phone]
>  >      >      >
>  >      >      > _______________________________________________
>  >      >      > FreeIPA-users mailing list --
>  >      > freeipa-users(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >      >     <mailto:[e-mail]
>  >     <mailto:[e-mail]>>
>  >      >      > To unsubscribe send an email to
>  >      > freeipa-users-leave(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >      >     <mailto:[e-mail]
>  >     <mailto:[e-mail]>>
>  >      >      > Fedora Code of Conduct:
>  >      > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >      >      > List Guidelines:
>  >      > https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >      >      > List Archives:
>  >      >
>  >
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >      >      >
>  >      >
>  >      >
>  >      > _______________________________________________
>  >      > FreeIPA-users mailing list --
>  >     freeipa-users(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >      > To unsubscribe send an email to
>  >     freeipa-users-leave(a)lists.fedorahosted.org
>  >     <mailto:[e-mail]>
>  >      > Fedora Code of Conduct:
>  >     https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  >      > List Guidelines:
>  >     https://fedoraproject.org/wiki/Mailing_list_guidelines
>  >      > List Archives:
>  >
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  >      >
>  >
>
>