freeipa/daemons/dnssec
Florence Blanc-Renaud 73ced07e2e dnssec: concurrency issue when disabling old replica key
When dnssec role is removed from the local node, the uninstaller
creates a new replica key and marks the older replica keys as disabled
(both in the local HSM and in LDAP).
If ipa-ods-exporter runs in the middle of this operation, the old replica
key may be disabled in the local HSM but not yet in LDAP and
ipa-ods-exporter believes that it is a new replica key that needs to be
imported from LDAP to local hsm. The op fails as there is already the key
in the local HSM.

The error can be ignored, ipa-ods-exporter simply needs to log a warning.

Fixes: https://pagure.io/freeipa/issue/8654
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2021-03-09 16:52:38 +01:00
..
ipa-dnskeysync-replica.in ipa-dnskeysyncd: Raise loglevel to DEBUG 2020-08-31 09:42:31 +03:00
ipa-dnskeysyncd.in ipa-dnskeysyncd: Raise loglevel to DEBUG 2020-08-31 09:42:31 +03:00
ipa-dnskeysyncd.service.in systemd: enforce en_US.UTF-8 locale in systemd units 2020-12-10 14:38:05 +02:00
ipa-ods-exporter.in dnssec: concurrency issue when disabling old replica key 2021-03-09 16:52:38 +01:00
ipa-ods-exporter.service.in systemd: enforce en_US.UTF-8 locale in systemd units 2020-12-10 14:38:05 +02:00
ipa-ods-exporter.socket.in Fix various OpenDNSSEC 2.1 issues 2020-04-21 21:37:06 +02:00
Makefile.am Fix various OpenDNSSEC 2.1 issues 2020-04-21 21:37:06 +02:00