mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-09-03 20:52:56 -05:00
Florence Blanc-Renaud
6ddd9d978a
The upgrade on RHEL9 needs to update /etc/sysconfig/ipa-dnskeysyncd with DNSSEC_TOKENS_DIR and DNSSEC_SOFTHSM_PIN because those environment variables are used by the systemd unit for ipa-dnskeysyncd. Currently the upgrade skips this step because of a wrong comparison when defining the constants: HAS_PKCS11_OPENSSL_ENGINE = osinfo.version_number == (9,) The above evaluates to false because osinfo.version_number is a tuple with (9, minor_version). Replace the comparison with osinfo.version_number[0] == 9 to make sure that the upgrade code is properly called on RHEL 9.x Fixes: https://pagure.io/freeipa/issue/9913 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
IPA platform abstraction
The ipaplatform package provides an abstraction layer for
supported Linux distributions and flavors. The package contains
constants, paths to commands and config files, services, and tasks.
- base abstract base platform
- debian Debian- and Ubuntu-like
- redhat abstract base for Red Hat platforms
- fedora Fedora
- fedora_container freeipa-container on Fedora
- rhel RHEL and CentOS
- rhel_container freeipa-container on RHEL and CentOS
- suse OpenSUSE and SLES
[base]
├─ debian
├─[redhat]
│ ├─ fedora
│ │ └─ fedora_container
│ └─ rhel
│ └─ rhel_container
└─ suse
(Note: Debian and SUSE use some definitions from Red Hat namespace.)
freeipa-container platform
The fedora_container and rhel_container platforms are flavors
of the fedora and rhel platforms. These platform definitions
are specifically designed for
freeipa-container.
The FreeIPA server container implements a read-only container. Paths
like /etc, /usr, and /var are mounted read-only and cannot
be modified. The image uses symlinks to store all variable data like
config files and LDAP database in /data.
- Some commands don't write through dangling symlinks. The IPA
platforms for containers prefix some paths with
/data. ipa-server-upgradeverifies that the platform does not change between versions. To allow upgrades of old containers, sysupgrade maps$distro_containerto$distroplatform.- The container images come with authselect pre-configured with
sssd with-sudooption. The tasksmodify_nsswitch_pam_stackandmigrate_auth_configurationare no-ops.ipa-restoredoes not restore authselect settings.ipa-backupstill stores authselect settings in backup data. - The
--mkhomediroption is not supported.