6:08 a.m.
Yes, however, rolling-release is not for everyone and every usecase, hence I am asking of
the status of the Debian and Ubuntu implementations :).
Thanks!
6:45 a.m.
New subject: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Nico Maas via FreeIPA-users wrote:
Yes, however, rolling-release is not for everyone and every usecase,
hence I am asking of the status of the Debian and Ubuntu
implementations :).
It is the same as in past: FreeIPA upstream development team has no
influence or control over Debian or Ubuntu packages. There is a single
person (thank you, Timo!) doing whole packaging for Debian and Ubuntu
and this effort is not his primary focus at Canonical.
With the change of the CentOS project, there is a hope that downstream
packagers for RHEL and FreeIPA upstream developers will have a better
way to address needs of IPA users currently utilizing CentOS.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
7:40 a.m.
New subject: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Nico Maas via FreeIPA-users wrote:
It is the same as in past: FreeIPA upstream development team has no
influence or control over Debian or Ubuntu packages. There is a single
person (thank you, Timo!) doing whole packaging for Debian and Ubuntu
and this effort is not his primary focus at Canonical.
With the change of the CentOS project, there is a hope that downstream
packagers for RHEL and FreeIPA upstream developers will have a better
way to address needs of IPA users currently utilizing CentOS.
Ok, I understand that the CentOS 8 Stream should actually improve freeIPA as a platform,
so thank you for your input and I look forward to this changes than :)
Kind regards,
Nico
9:33 a.m.
New subject: freeIPA Status Debian/Ubuntu
We’e in the same situation. I’d actually be willing to pay for Redhat, but not with the
requirement to do a reinstall. So until RHEL 9 I need an alternative. While I have lots of
reasons to dislike it, I’m currently thinking of Oracle Linux for our remaining time on 8.
I’ve found delays in Centos 8 a concern already, so I’m not inclined to wait.
If the IPA developers can assure us that the version in Centos 8 Stream is well tested,
I’d use that instead. Historically IPA administrative tools have been brittle. Any slight
difference from the environment they expect and there’s a failure, requiring days of
reverse engineering an understanding of complex Python code. So I’m not inclined to gamble
on a release with less testing than usual.
On Dec 9, 2020, at 7:45 AM, Alexander Bokovoy via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
On ke, 09 joulu 2020, Nico Maas via FreeIPA-users wrote:
> Yes, however, rolling-release is not for everyone and every usecase,
> hence I am asking of the status of the Debian and Ubuntu
> implementations :).
It is the same as in past: FreeIPA upstream development team has no
influence or control over Debian or Ubuntu packages. There is a single
person (thank you, Timo!) doing whole packaging for Debian and Ubuntu
and this effort is not his primary focus at Canonical.
With the change of the CentOS project, there is a hope that downstream
packagers for RHEL and FreeIPA upstream developers will have a better
way to address needs of IPA users currently utilizing CentOS.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
10:23 a.m.
New subject: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Charles Hedrick wrote:
We’e in the same situation. I’d actually be willing to pay for
Redhat,
but not with the requirement to do a reinstall. So until RHEL 9 I need
an alternative. While I have lots of reasons to dislike it, I’m
currently thinking of Oracle Linux for our remaining time on 8. I’ve
found delays in Centos 8 a concern already, so I’m not inclined to
wait.
EPEL is has Convert2RHEL: https://access.redhat.com/articles/2360841
It does reinstall of the packages in-place if I understand it right.
If the IPA developers can assure us that the version in Centos 8
Stream
is well tested, I’d use that instead. Historically IPA administrative
tools have been brittle. Any slight difference from the environment
they expect and there’s a failure, requiring days of reverse
engineering an understanding of complex Python code. So I’m not
inclined to gamble on a release with less testing than usual.
What I see as a good change is the fact that if you'd find a bug in
C8S IPA version update, reporting it to bugzilla.redhat.com would
trigger a faster fix cycle than currently with CentOS 8 or 7. The only
exception would probably be a CVE fix since that would still be first
available to RHEL customers through an update to RHEL, same as with
CentOS 8 or 7. Perhaps, even a bit faster than with CentOS 8 or 7
because fixes to C8S for security issues would most likely be automated.
With most of RHEL development moving into a public space in C8S and
Fedora ELN, the feedback loop should get shorter. Many of the changes
were already discussed during last two years at Flock and other
conferences, ongoing work in the infrastructure and processes to support
this certainly make life of RHEL packagers 'interesting' but the end
result is an increase of a attention to details and a lot more stability
to the 'pre-release' composes.
I can only talk about FreeIPA and few other projects I am involved with.
For example, we are getting incredible feedback from both Rawhide and
RHEL 8.x QA processes for FreeIPA 4.9.0 release candidates. The packages
are not yet in RHEL 8.x development composes as we do fixes to issues
found through the QA pre-verification work. Once overall state of the
release candidate is at the level RHEL IdM QA team accepts, those
packages will get to RHEL composes and eventually land in C8S (once the
infra is ready). Once C8S is there in full capacity and running upstream
CI tests on it would become a reality, we'll see even more shortening of
that feedback loop length.
> On Dec 9, 2020, at 7:45 AM, Alexander Bokovoy via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> On ke, 09 joulu 2020, Nico Maas via FreeIPA-users wrote:
>> Yes, however, rolling-release is not for everyone and every usecase,
>> hence I am asking of the status of the Debian and Ubuntu
>> implementations :).
>
> It is the same as in past: FreeIPA upstream development team has no
> influence or control over Debian or Ubuntu packages. There is a single
> person (thank you, Timo!) doing whole packaging for Debian and Ubuntu
> and this effort is not his primary focus at Canonical.
>
> With the change of the CentOS project, there is a hope that downstream
> packagers for RHEL and FreeIPA upstream developers will have a better
> way to address needs of IPA users currently utilizing CentOS.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
10:34 a.m.
New subject: freeIPA Status Debian/Ubuntu
Alexander, as a user without support from Red Hat, can we report bugs/issues for the IdM
product here on the FreeIPA list? Because, as far as I know, with RHEL there's no way
to install FreeIPA branded as it. It will always be Red Hat IdM.
Thank you.
-----Original Message-----
From: Alexander Bokovoy via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Sent: Wednesday, December 9, 2020 1:23 PM
To: Charles Hedrick <hedrick(a)cs.rutgers.edu>
Cc: Nico Maas <mail(a)nico-maas.de>; FreeIPA users list
<freeipa-users(a)lists.fedorahosted.org>; Alexander Bokovoy
<abokovoy(a)redhat.com>
Subject: [Freeipa-users] Re: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Charles Hedrick wrote:
We’e in the same situation. I’d actually be willing to pay for Redhat,
but not with the requirement to do a reinstall. So until RHEL 9 I need
an alternative. While I have lots of reasons to dislike it, I’m
currently thinking of Oracle Linux for our remaining time on 8. I’ve
found delays in Centos 8 a concern already, so I’m not inclined to
wait.
EPEL is has Convert2RHEL: https://access.redhat.com/articles/2360841
It does reinstall of the packages in-place if I understand it right.
If the IPA developers can assure us that the version in Centos 8
Stream
is well tested, I’d use that instead. Historically IPA administrative
tools have been brittle. Any slight difference from the environment
they expect and there’s a failure, requiring days of reverse
engineering an understanding of complex Python code. So I’m not
inclined to gamble on a release with less testing than usual.
What I see as a good change is the fact that if you'd find a bug in C8S IPA version
update, reporting it to bugzilla.redhat.com would trigger a faster fix cycle than
currently with CentOS 8 or 7. The only exception would probably be a CVE fix since that
would still be first available to RHEL customers through an update to RHEL, same as with
CentOS 8 or 7. Perhaps, even a bit faster than with CentOS 8 or 7 because fixes to C8S for
security issues would most likely be automated.
With most of RHEL development moving into a public space in C8S and Fedora ELN, the
feedback loop should get shorter. Many of the changes were already discussed during last
two years at Flock and other conferences, ongoing work in the infrastructure and processes
to support this certainly make life of RHEL packagers 'interesting' but the end
result is an increase of a attention to details and a lot more stability to the
'pre-release' composes.
I can only talk about FreeIPA and few other projects I am involved with.
For example, we are getting incredible feedback from both Rawhide and RHEL 8.x QA
processes for FreeIPA 4.9.0 release candidates. The packages are not yet in RHEL 8.x
development composes as we do fixes to issues found through the QA pre-verification work.
Once overall state of the release candidate is at the level RHEL IdM QA team accepts,
those packages will get to RHEL composes and eventually land in C8S (once the infra is
ready). Once C8S is there in full capacity and running upstream CI tests on it would
become a reality, we'll see even more shortening of that feedback loop length.
> On Dec 9, 2020, at 7:45 AM, Alexander Bokovoy via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> On ke, 09 joulu 2020, Nico Maas via FreeIPA-users wrote:
>> Yes, however, rolling-release is not for everyone and every usecase,
>> hence I am asking of the status of the Debian and Ubuntu
>> implementations :).
>
> It is the same as in past: FreeIPA upstream development team has no
> influence or control over Debian or Ubuntu packages. There is a
> single person (thank you, Timo!) doing whole packaging for Debian and
> Ubuntu and this effort is not his primary focus at Canonical.
>
> With the change of the CentOS project, there is a hope that
> downstream packagers for RHEL and FreeIPA upstream developers will
> have a better way to address needs of IPA users currently utilizing CentOS.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedo
> rahosted.org
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
10:36 a.m.
New subject: freeIPA Status Debian/Ubuntu
thanks. There’s enough jargon in this that I’m not sure I understand. What’s the
difference in level of QA between freeipa in Stream and RHEL? I’d be happy to have new
versions of IPA sooner, if they’ve actually been tested well enough that they’re ready for
the next RHEL release. Are things in good enough shape that it would make sense to convert
to stream now?
Do you think the in-place upgrade of Centos to RHEL would be safe to do with freeipa? I’d
assume there’s no actual difference in the packages.
I’m really only concerned with IPA. We use Ubuntu for everything else. We’re a computer
science department. Our researchers want Ubuntu, and we have to do what our users want.
On Dec 9, 2020, at 11:23 AM, Alexander Bokovoy
<abokovoy(a)redhat.com> wrote:
I can only talk about FreeIPA and few other projects I am involved with.
For example, we are getting incredible feedback from both Rawhide and
RHEL 8.x QA processes for FreeIPA 4.9.0 release candidates. The packages
are not yet in RHEL 8.x development composes as we do fixes to issues
found through the QA pre-verification work. Once overall state of the
release candidate is at the level RHEL IdM QA team accepts, those
packages will get to RHEL composes and eventually land in C8S (once the
infra is ready). Once C8S is there in full capacity and running upstream
CI tests on it would become a reality, we'll see even more shortening of
that feedback loop length.
10:53 a.m.
New subject: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Charles Hedrick wrote:
thanks. There’s enough jargon in this that I’m not sure I understand.
What’s the difference in level of QA between freeipa in Stream and
RHEL? I’d be happy to have new versions of IPA sooner, if they’ve
actually been tested well enough that they’re ready for the next RHEL
release. Are things in good enough shape that it would make sense to
convert to stream now?
Difference in QA: I hope there will be very little difference. After
all, C8S (hopefully) will be an automated build of what is accepted into
RHEL 8.x build, after that one passed through QA. If any bug is found in
RHEL 8.x build that would require a rebuild, it means as soon as the
new build gets into RHEL 8.x compose, it is built for C8S.
All the above is my understanding of what is essentially still being
created -- as announcement said yesterday, C8S will be in full use by
end of 2021.
Do you think the in-place upgrade of Centos to RHEL would be safe to
do
with freeipa? I’d assume there’s no actual difference in the packages.
CentOS to RHEL should be straight-forward. The only difference in ipa
package in CentOS is (de)-branding. I admit, I have no tests of the
reinstall for that. If ipa-server-upgrade ran during package reinstall
would find something weird, this could be a bug to report and fix.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
6:47 p.m.
New subject: freeIPA Status Debian/Ubuntu
Alexander Bokovoy via FreeIPA-users wrote:
On ke, 09 joulu 2020, Charles Hedrick wrote:
> thanks. There’s enough jargon in this that I’m not sure I understand.
> What’s the difference in level of QA between freeipa in Stream and
> RHEL? I’d be happy to have new versions of IPA sooner, if they’ve
> actually been tested well enough that they’re ready for the next RHEL
> release. Are things in good enough shape that it would make sense to
> convert to stream now?
Difference in QA: I hope there will be very little difference. After
all, C8S (hopefully) will be an automated build of what is accepted into
RHEL 8.x build, after that one passed through QA. If any bug is found in
RHEL 8.x build that would require a rebuild, it means as soon as the
new build gets into RHEL 8.x compose, it is built for C8S.
All the above is my understanding of what is essentially still being
created -- as announcement said yesterday, C8S will be in full use by
end of 2021.
> Do you think the in-place upgrade of Centos to RHEL would be safe to do
> with freeipa? I’d assume there’s no actual difference in the packages.
CentOS to RHEL should be straight-forward. The only difference in ipa
package in CentOS is (de)-branding. I admit, I have no tests of the
reinstall for that. If ipa-server-upgrade ran during package reinstall
would find something weird, this could be a bug to report and fix.
Honestly I'd suggest using a the normal upgrade/OS migration strategy of
creating new servers and decommissioning the old ones once things are
proven to be working.
Backup/restore is not going to do it.
rob
1:34 a.m.
New subject: freeIPA Status Debian/Ubuntu
On ke, 09 joulu 2020, Rob Crittenden via FreeIPA-users wrote:
Alexander Bokovoy via FreeIPA-users wrote:
> On ke, 09 joulu 2020, Charles Hedrick wrote:
>> thanks. There’s enough jargon in this that I’m not sure I understand.
>> What’s the difference in level of QA between freeipa in Stream and
>> RHEL? I’d be happy to have new versions of IPA sooner, if they’ve
>> actually been tested well enough that they’re ready for the next RHEL
>> release. Are things in good enough shape that it would make sense to
>> convert to stream now?
>
> Difference in QA: I hope there will be very little difference. After
> all, C8S (hopefully) will be an automated build of what is accepted into
> RHEL 8.x build, after that one passed through QA. If any bug is found in
> RHEL 8.x build that would require a rebuild, it means as soon as the
> new build gets into RHEL 8.x compose, it is built for C8S.
>
> All the above is my understanding of what is essentially still being
> created -- as announcement said yesterday, C8S will be in full use by
> end of 2021.
>
>> Do you think the in-place upgrade of Centos to RHEL would be safe to do
>> with freeipa? I’d assume there’s no actual difference in the packages.
>
> CentOS to RHEL should be straight-forward. The only difference in ipa
> package in CentOS is (de)-branding. I admit, I have no tests of the
> reinstall for that. If ipa-server-upgrade ran during package reinstall
> would find something weird, this could be a bug to report and fix.
>
>
Honestly I'd suggest using a the normal upgrade/OS migration strategy of
creating new servers and decommissioning the old ones once things are
proven to be working.
Backup/restore is not going to do it.
Right -- this is IPA-specific thing. It is much easier to do 'stand the
replica, migrate services, remove the original replica' for IPA use
case.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
1226
days inactive
1227
days old
freeipa-users@lists.fedorahosted.org
9 comments
5 participants
participants (5)
-
Alexander Bokovoy -
Charles Hedrick -
Nico Maas -
Rob Crittenden -
Vinícius Ferrão