infra/tickets

Fork 1

RHEL10: migrate ipa clusters to rhel10 #13382

New issue

Open

opened 2026-06-01 21:55:25 +00:00 by kevin · 11 comments

kevin commented

2026-06-01 21:55:25 +00:00

Owner

Description of request

We should migrate our rhel9 ipa clusters (stg and then prod) to rhel10.

"9", ipa01.rdu3.fedoraproject.org
"9", ipa01.stg.rdu3.fedoraproject.org
"9", ipa02.rdu3.fedoraproject.org
"9", ipa02.stg.rdu3.fedoraproject.org
"9", ipa03.rdu3.fedoraproject.org
"9", ipa03.stg.rdu3.fedoraproject.org

Basically this involves installing a new rhel10 ipa server, adding it as a replica in the cluster, making it the ca issuer and other items, then retiring the old one and adding more rhel10 replicas until the cluster is all rhel10.

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/migrating_to_identity_management_on_rhel_10/index

@zlopez did our rhel8->9 move I think. Perhaps he would be willing to work on 9->10?

We will also need to make sure noggin works ok with things in staging before moving on to prod.

### Description of request We should migrate our rhel9 ipa clusters (stg and then prod) to rhel10. "9", ipa01.rdu3.fedoraproject.org "9", ipa01.stg.rdu3.fedoraproject.org "9", ipa02.rdu3.fedoraproject.org "9", ipa02.stg.rdu3.fedoraproject.org "9", ipa03.rdu3.fedoraproject.org "9", ipa03.stg.rdu3.fedoraproject.org Basically this involves installing a new rhel10 ipa server, adding it as a replica in the cluster, making it the ca issuer and other items, then retiring the old one and adding more rhel10 replicas until the cluster is all rhel10. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html-single/migrating_to_identity_management_on_rhel_10/index @zlopez did our rhel8->9 move I think. Perhaps he would be willing to work on 9->10? We will also need to make sure noggin works ok with things in staging before moving on to prod.

kevin referenced this issue

2026-06-01 21:57:06 +00:00

RHEL10 adoption #12712

zlopez commented

2026-06-02 07:37:43 +00:00

Owner

Yes, I did the previous move. It was painful as I made a few mistakes, but we get it working in the end and the ansible deployment was improved thanks to it.

I can do it for 9->10 as well. I should still have my notes from the previous move as well.

Yes, I did the previous move. It was painful as I made a few mistakes, but we get it working in the end and the ansible deployment was improved thanks to it. I can do it for 9->10 as well. I should still have my notes from the previous move as well.

zlopez added the

Priority

Medium

points

labels

2026-06-02 07:38:29 +00:00

kevin commented

2026-06-02 16:32:03 +00:00

Author

Owner

That would be great if you could!

Feel free to add it to whatever sprint you feel you can do it in.

That would be great if you could! Feel free to add it to whatever sprint you feel you can do it in.

zlopez was assigned by kevin

2026-06-02 16:32:14 +00:00

kevin added a new dependency

2026-06-02 16:33:18 +00:00

#12712 RHEL10 adoption

zlopez added this to the Current Sprint ( 2026-06-01 to 2026-06-14) project

2026-06-25 10:44:45 +00:00

zlopez modified the project from Current Sprint ( 2026-06-01 to 2026-06-14) to Sprint ( 2026-06-15 to 2026-06-28)

2026-06-25 10:46:52 +00:00

zlopez referenced this issue from a commit

2026-06-25 13:25:39 +00:00

[ipa] Move ipa03.stg to RHEL10

zlopez referenced this issue from infra/ansible

2026-06-25 13:26:13 +00:00

[ipa] Move ipa03.stg to RHEL10 #3440

zlopez referenced this issue from a commit

2026-06-25 14:40:36 +00:00

[ipa] Move ipa03.stg to RHEL10

zlopez commented

2026-06-26 09:05:08 +00:00

Owner

There is a bug open to request it, but no progress yet. I will look into that and see if I can build it by myself in COPR.

Currently working on ipa03.stg and trying to get it to RHEL10. The problem I hit right now is that there is no python3-freeipa package on EPEL10. It's used by some scripts that are being run around IPA, like clearing the stage users. There is a [bug](https://bugzilla.redhat.com/show_bug.cgi?id=2482962) open to request it, but no progress yet. I will look into that and see if I can build it by myself in COPR.

zlopez commented

2026-06-26 09:44:28 +00:00

Owner

There is no bodhi update for EPEL10 build, so I try to submit one and see if that will work https://bodhi.fedoraproject.org/updates/?packages=python-freeipa&page=1. But let's ask the maintainer first.

Found out the package was already built for epel10.2 and epel10.3 https://koji.fedoraproject.org/koji/packageinfo?packageID=31158, but it's not in the EPEL10 repository. Not sure what is happening here. There is no bodhi update for EPEL10 build, so I try to submit one and see if that will work https://bodhi.fedoraproject.org/updates/?packages=python-freeipa&page=1. But let's ask the maintainer first.

zlopez modified the project from Sprint ( 2026-06-15 to 2026-06-28) to Current Sprint ( 2026-06-29 to 2026-07-12)

2026-06-29 14:24:03 +00:00

zlopez commented

2026-07-01 12:48:22 +00:00

Owner

So I built few missing packages for RHEL10 for IPA in epel10-infra tag:

journal-to-fedora-messaging
- python-journal-to-fedora-messaging-messages
- python-pytest-twisted

But it's failing during install on GPG check. I'm not sure what I missed

Fedora Infrastructure tag 10 - x86_64                                                                                                                                                                       163 kB/s | 1.6 kB     00:00    
Importing GPG key 0x47DD8EF9:
 Userid     : ""
 Fingerprint: 1D69 8E02 822F 64CA 1ACB 9A32 8059 815E 47DD 8EF9
 From       : https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS
Is this ok [y/N]: y
error: Certificate 8059815E47DD8EF9:
  Policy rejects 8059815E47DD8EF9: No binding signature at time 2026-07-01T12:42:54Z
Key import failed (code 2). Failing package is: journal-to-fedora-messaging-1.0.0-1.el10_2.noarch
 GPG Keys are configured as: https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS
Public key for python3-journal-to-fedora-messaging-messages-1.0.1-1.el10_2.noarch.rpm is not installed. Failing package is: python3-journal-to-fedora-messaging-messages-1.0.1-1.el10_2.noarch
 GPG Keys are configured as: https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: GPG check FAILED

So I built few missing packages for RHEL10 for IPA in epel10-infra tag: * journal-to-fedora-messaging * python-journal-to-fedora-messaging-messages * python-pytest-twisted But it's failing during install on GPG check. I'm not sure what I missed ``` Fedora Infrastructure tag 10 - x86_64 163 kB/s | 1.6 kB 00:00 Importing GPG key 0x47DD8EF9: Userid : "" Fingerprint: 1D69 8E02 822F 64CA 1ACB 9A32 8059 815E 47DD 8EF9 From : https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS Is this ok [y/N]: y error: Certificate 8059815E47DD8EF9: Policy rejects 8059815E47DD8EF9: No binding signature at time 2026-07-01T12:42:54Z Key import failed (code 2). Failing package is: journal-to-fedora-messaging-1.0.0-1.el10_2.noarch GPG Keys are configured as: https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS Public key for python3-journal-to-fedora-messaging-messages-1.0.1-1.el10_2.noarch.rpm is not installed. Failing package is: python3-journal-to-fedora-messaging-messages-1.0.1-1.el10_2.noarch GPG Keys are configured as: https://infrastructure.fedoraproject.org/repo/infra/RPM-GPG-KEY-INFRA-TAGS The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED ```

kevin commented

2026-07-01 18:57:30 +00:00

Author

Owner

Sad trombone... that key has some sha1 still in it. ;(

I'll make a new one, but... we either need to have a seperate public key link in the repo file for rhel10, or resign everything.
I guess I'd prefer to just change epel10-infra. Will try and do this later today.

Sad trombone... that key has some sha1 still in it. ;( I'll make a new one, but... we either need to have a seperate public key link in the repo file for rhel10, or resign everything. I guess I'd prefer to just change epel10-infra. Will try and do this later today.

kevin commented

2026-07-02 01:05:48 +00:00

Author

Owner

I didn't get to it today. ;( I can try soon... I'm out tomorrow, holiday on friday and out monday tho.

If someone like @jnsamyak wants to make the key in sigul, I'd call it something like 'fedora-infra-20260702' or whatever (so it's different from the existing one) Then it need autopen to have access to it and robosignatory config adjusted to use it for epel10-infra builds and finally a seperate file with the public key for the repo file.

I didn't get to it today. ;( I can try soon... I'm out tomorrow, holiday on friday and out monday tho. If someone like @jnsamyak wants to make the key in sigul, I'd call it something like 'fedora-infra-20260702' or whatever (so it's different from the existing one) Then it need autopen to have access to it and robosignatory config adjusted to use it for epel10-infra builds and finally a seperate file with the public key for the repo file.

zlopez commented

2026-07-02 07:44:23 +00:00

Owner

No worries, I'm out on Friday and Monday too. I will work on something else in the meantime.

kevin commented

2026-07-09 22:36:23 +00:00

Author

Owner

ok. I have rolled out a new happier rpm signing key for epel10-infra/stg... I was able to install those packages ok on ipa03.stg.

Let me know if you spot any further issues with it.

ok. I have rolled out a new happier rpm signing key for epel10-infra/stg... I was able to install those packages ok on ipa03.stg. Let me know if you spot any further issues with it.

zlopez commented

2026-07-10 06:53:30 +00:00

Owner

Thanks will try to work on this today.

jnsamyak commented

2026-07-10 07:11:58 +00:00

Member

Hello, ah, sad again, my notification settings weren't up to mark (fixed now), I could have chimed in, it seems like exciting/annoying work. But tag me if there is something I can help with 🗡️