Weird error while calling ipaserver from a playbook about ansible-freeipa HOT 10 CLOSED

So, I've added a small snippet in order to get some debug:

- name: debug result_ipaserver_test
  debug:
    var: result_ipaserver_test

Result is "nice":

"result_ipserver_test": {
  "changed": false,
  "dns_zone_exists": true,
  "failed": false
}

So I suspect something changed with ansible 2.7.1....

Care to have a look ? That would really be helpful - I'd rather avoid deploying my freeIPA by hand if there's an ansible way...

Thanks!

from ansible-freeipa.

Have you changes files in the ansible-freeipa repository?

from ansible-freeipa.

Nope, nothing - it's just a git pull right after your revert for the max_concurrent thingy.

from ansible-freeipa.

result_ipserver_test is ok when there is a zone overlap in the given zone (domain name). But there is a check in roles/ipaserver/tasks/install.yml to end playbook processing in this case:

- meta: end_play
  when: not result_ipaserver_test.changed and (result_ipaserver_test.dns_zone_exists is defined or result_ipaserver_test.client_already_configured is defined or result_ipaserver_test.server_already_configured is defined)

I do not understand why the playbook processing does not end for you. It ends for me also using ansible 2.7.1.

from ansible-freeipa.

I will transform this end_play into a fail in this case - this is the normal installer behavior.

from ansible-freeipa.

ok - still.... there are some issues with the way "domain" is set, apparently. I'd take the variables aren't taken at all, and this is sad, because that makes the whole role unusable if we want to integrate it in another playbook with variables set in some external files.

from ansible-freeipa.

I believe this is because you are using "example.com", which fails because that is a real domain that exists in the wild. Try using "example.test" and see if that is successful. I believe I encountered this in the past and was able to figure out that it fails because "dns_zone_exists" is true. This boolean means that the chosen DNS zone already can be found in DNS, so the install bails.

from ansible-freeipa.

@t-woerner The commit to make it fail is a good change, but it would be nice if there is a way to get a more useful failure message that explains what "dns_zone_exists: true" means. The user should be told to set an option to allow zone overlaps with options.allow_zone_overlap or to choose a different domain/realm name.

from ansible-freeipa.

@nkinder hmm nope, I was using one of my domains that exists. In the end I ended up with my own playbook, and it's working just fine. That was easier that way, especially since I need the infra now.

And I had to pass the option to allow averlaps, of course. But there the error message was pretty clear.

Cheers,

C.

from ansible-freeipa.

A lot of addtional tests for ipaserver_test have been added. The role is providing the same error messages as the command line installer since version 0.1.5.

from ansible-freeipa.