Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 8.3 Status: intermediate replica (<code><nowiki>ipa8.tetrain.com</nowiki></code>) — DONE, validated ===

Built from scratch, full authorization given by client to build without per-step confirmation (cutover explicitly excluded — still gated). Real obstacles hit and resolved, in order:

# Wrong SSH user/key initially assumed — actual: <code><nowiki>root</nowiki></code> / <code><nowiki>proxy_id_rsa</nowiki></code> (not <code><nowiki>id_rsa_curio</nowiki></code>).
# <code><nowiki>firewalld</nowiki></code> active locally (unlike the other two boxes) — opened freeipa-ldap/freeipa-ldaps/dns/http/https/kerberos services + 464 + 8080/8443 explicitly.
# EL8 packages IPA via a DNF '''module''' (<code><nowiki>idm:DL1</nowiki></code>), not a plain package — needed <code><nowiki>dnf module enable idm:DL1</nowiki></code> before <code><nowiki>dnf install @idm:DL1/server</nowiki></code> would resolve.
# Cloud-init's default <code><nowiki>/etc/hosts</nowiki></code> template mapped the box's own hostname to '''both''' <code><nowiki>127.0.0.1</nowiki></code> and <code><nowiki>::1</nowiki></code> — IPA's installer explicitly refuses a hostname that resolves to loopback. Fixed by rewriting <code><nowiki>/etc/hosts</nowiki></code> to map the hostname to its real IP, and disabled <code><nowiki>manage_etc_hosts</nowiki></code> so cloud-init won't revert it on a future reboot.
# Reverse-DNS mismatch for the '''old''' server (same AWS-default-PTR issue as Section 3.1), recurring here since it's a property of the old server, not the new one — same fix, an <code><nowiki>/etc/hosts</nowiki></code> entry for <code><nowiki>tornedo.tetrain.com</nowiki></code> on this box too.
# <code><nowiki>ipa-replica-install</nowiki></code>'s <code><nowiki>check_creds</nowiki></code> needs actual admin Kerberos credentials, not just the host keytab from enrollment — client ran <code><nowiki>kinit admin</nowiki></code> + the install command together in their own session so the admin password never passed through this session.
# Each <code><nowiki>ipa-server-install --uninstall</nowiki></code> cleanup (needed after every failed attempt above) also wipes client enrollment, requiring a fresh OTP each retry (<code><nowiki>ipa host-disable</nowiki></code> + <code><nowiki>ipa host-mod --random</nowiki></code> on the source server, since the host object already exists after the first attempt).

Once all of the above were resolved, <code><nowiki>ipa-replica-install --setup-ca --unattended</nowiki></code> completed successfully. Two non-fatal warnings during install (<code><nowiki>acmeIPAServerCert</nowiki></code> profile import failure, <code><nowiki>dnaHostname</nowiki></code> lookup timeout) — both are known/common transient issues during replica install; resolved by running <code><nowiki>ipa-server-upgrade</nowiki></code> immediately after, which completed successfully and re-migrated certificate profiles.

'''Validated''': <code><nowiki>ipactl status</nowiki></code> — all 7 services RUNNING (Directory Service, krb5kdc, kadmin, httpd, ipa-custodia, pki-tomcatd, ipa-otpd). All certs <code><nowiki>MONITORING</nowiki></code>, no errors. LDAP search via LDAPI succeeds. Kerberos ticket issuance confirmed working.