Add check to prevent removal of last KRA

https://pagure.io/freeipa/issue/6538

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>

ipaserver/plugins/server.py

@@ -494,6 +494,19 @@ class server_del(LDAPDelete):
                       "without a DNS."), ignore_last_of_role)
 
         if self.api.Command.ca_is_enabled()['result']:
+            try:
+                vault_config = self.api.Command.vaultconfig_show()['result']
+                kra_servers = vault_config.get('kra_server_server', [])
+            except errors.InvocationError:
+                # KRA is not configured
+                pass
+            else:
+                if kra_servers == [hostname]:
+                    handler(
+                        _("Deleting this server is not allowed as it would "
+                          "leave your installation without a KRA."),
+                        ignore_last_of_role)
+
             ca_servers = ipa_config.get('ca_server_server', [])
             ca_renewal_master = ipa_config.get(
                 'ca_renewal_master_server', [])