1. Run workflow ... into LDAP machine to create the reverse hosted zone ipa dnszone-add --name-from-ip=10.0.0.0/24 https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/managing-reverse-dns-zones
2. create LDAP replica instance type
3. run workflow to switch LDAP from old to new
4. Check everything is fine
5. Remove old LDAP

Admins part

Procedure for existing LDAPs

pre-requisite

ansible script:

• iterate on every openstack from vault
• create app credentials
• create vault entry under ewc-tenant-credentials
• create app role for each tenancy entry in ewc-tenant-credentials and add it to the corresponding Cypher in each tenancy
  
  • every Cypher of every tenancy has the following info to access Vault:
    • secret/vault_approleid
    • secret/vault_secretid

ansible script:

• iterate on every openstack from vault

• add port 636 to ldap security group

changes:

• every new tenant gets port 636 added for ldap security group

backup existing ldap server before starting

run workflow to create dns reverse zone into LDAP

New instance type replica

Creating a new LDAP to migrate to

1. 1. deploy a new machine with
      1. rocky 9
      2. ldap security group
      3. plan??
   2. stop and disable firewalld on the machine systemctl stop firewalld && systemctl disable firewalld
   3. create a local user with sudo rights
   4. become sudo
   5. add old ldap IP and domain of the machine acting as LDAP in one line to /etc/hosts on this machine

   6. [test234@test-podman2 ~]$ cat /etc/hosts <!-- BEGIN ANSIBLE MANAGED BLOCK --> 10.0.0.133 test-podman2.eumetsat.sandbox.ewc 10.0.0.63 ldap.eumetsat.sandbox.ewc <!-- END ANSIBLE MANAGED BLOCK -->

   7. Install ipa-replica-install command (dnf install ipa-server -y)
   8. Install ipa-server-dns because it is required for the option in the ipa-replica-install (dnf install ipa-server-dns -y)
   9. Run the following command to install the LDAP replica

   10. ipa-replica-install --domain "eumetsat.sandbox.ewc" --principal sandbox-ldap-admin --admin-password hunter2 --server ldap.eumetsat.sandbox.ewc --setup-ca --setup-dns --force-join --forwarder=8.8.8.8 --forwarder=1.1.1.1 --no-host-dns

       add --verbose for more logs

   11. on the new ldap machine specify which ldap to be master (using command: ipa-csreplica-manage set-renewal-master)

   12. DON'T DO IT, see next steps comment on why → create an A record for existing ldap domain to point to the new LDAP ipa dnsrecord-add eumetsat.sandbox.ewc. ldap --a-rec <NEW_LDAP_IP> 
       

   13. Modify the DNS primary in Network (cannot be done by a user, unless we give permissions to modify networks) and wait some time (1 week? ) or do manual action on each machine to make the changes: (lease time ~5.20 hours)
       
       1. for Ubuntu a restart of the machine or the newotk systemctl restart networking or maybe after while you will get it (TBT)
       2. for Rocky 9 network manager has priority on resolve.conf
       3. for Rocky 8 happening in sandbox but not in mcat, one option either remove /etc/resolve.conf and dhclient or ??
   14. Change the secret/ldap_hostname to point to the new ipa host

   15. sudo ipactl stop on the old LDAP machine (check if this step can be removed on another test run)

   16. ipa-replica-manage del ldap.eumetsat.sandbox.ewc --force delete the replica ldap

Missing part

/etc/resolv.conf needs to be manually updated?? 

Next steps:

• reboot more VMs to see if they recover → not changing
• understand why the resolv.conf didn't update → for rocky it changes only on newer deployment machine from cloud-init, not on rebooted machines, Ubuntu has an internal dns server
  
  • for Ubuntu a restart of the machine or the nework systemctl restart networking or maybe after while you will get it (TBT)
  • for Rocky either remove /etc/resolve.conf and dhclient 
• create a fresh VM to see if the ldap workflow works → tested and we had to remove the ldap A record and therefore change the secret/ldap_hostname in order to work
• destroy the new ldap and recover the old one, then try to repeat the migration without stopping IPA on the old LDAP when deleting it → we have to specify which ldap to be master (using command: ipa-csreplica-manage set-renewal-master)

Automation to be run from any machine beside LDAP

alternative path from 10.

11. detach the interface from the old LDAP 

11.2 update the ip in the /etc/hosts and remove the old LDAP record

12. ipa-replica-manage del ldap.eumetsat.sandbox.ewc --force delete the replica ldap

13. replace the new ldap IP with the IP of the interface of the old LDAP → 

 ipa dnsrecord-mod eumetsat.sandbox.ewc. ipa-ca --a-rec OLD_LDAP_IP

ipa dnsrecord-mod eumetsat.sandbox.ewc. NEW_ldap_hostname --a-rec OLD_LDAP_IP

14. swtich off the new LDAP

15. remove interface 

16. add interface with the IP of the old LDAP

17 restart new LDAP machine

18 add security groups to new LDAP

Procedure for new LDAPs

• Modify the ldap base image to be rocky 9

LDAP machine

1. check if reverse zone exists and add dns reverse into deployment
2. populate it for all existing machines in the tenancy (needs script dumping the forward zone)

• include reverse zone flag (nope, we have this and it seems not to work for private IP ranges, we have to do it manually) → create manually the reverse zone in the workflow - probably just add ipa dnszone-add --name-from-ip=192.0.2.0/24 to the ansible

enrolling workflow

1. we modify the enroll script to include --subids and we add an extra line at the end of the default workflow for machines to run sudo rpm --restore shadow-utils
2. Remove /etc/NetworkManager/conf.d/99-cloud-init.conf

   
   

Write a script that verifies whether a machine is gone (how? no ping? for a long time?)  and destroys ldap entries relating to it.  Put this in the crontab on all ldaps.