Editing Tornedo.tetrain.com Runbook (section)

== Phase 5 — SRV-based cutover (not an IP/identity handoff) ==

Checked first: '''confirm no DNS SRV records already exist''' for the domain (<code><nowiki>dig</nowiki></code> — if every client is relying purely on the literal hostname, this is your situation and this approach applies). This is simpler than making <code><nowiki>ipa.tetrain.com</nowiki></code> impersonate <code><nowiki>tornedo.tetrain.com</nowiki></code>'s identity (fragile, not well-supported) — instead, publish real SRV records under the *old* hostname's zone, pointing at the new server's *own* name:

<pre>
<nowiki>
_ldap._tcp.tornedo.tetrain.com.            SRV 0 100 389  ipa.tetrain.com.
_kerberos._tcp.tornedo.tetrain.com.        SRV 0 100 88   ipa.tetrain.com.
_kerberos._udp.tornedo.tetrain.com.        SRV 0 100 88   ipa.tetrain.com.
_kerberos-master._tcp.tornedo.tetrain.com. SRV 0 100 88   ipa.tetrain.com.
_kerberos-master._udp.tornedo.tetrain.com. SRV 0 100 88   ipa.tetrain.com.
_kpasswd._tcp.tornedo.tetrain.com.         SRV 0 100 464  ipa.tetrain.com.
_kpasswd._udp.tornedo.tetrain.com.         SRV 0 100 464  ipa.tetrain.com.
</nowiki>
</pre>

(Plain client-discovery SRV records — '''not''' the <code><nowiki>_msdcs.</nowiki></code>-style records <code><nowiki>ipa-adtrust-install</nowiki></code> prints, which are for actual Windows AD trust interop and weren't needed here.)

Every <code><nowiki>sssd.conf</nowiki></code> in this fleet already has <code><nowiki>ipa_server = _srv_, tornedo.tetrain.com</nowiki></code> — SRV lookup first, literal-name fallback second — so once these records exist, enrolled clients discover and switch to <code><nowiki>ipa.tetrain.com</nowiki></code> with '''zero client-side config changes''', and <code><nowiki>tornedo.tetrain.com</nowiki></code>'s A record can stay up as a fallback the whole time.

Client published all 7 records. Verify:

<pre>
<nowiki>
dig SRV _ldap._tcp.tornedo.tetrain.com +short
dig SRV _kerberos._tcp.tornedo.tetrain.com +short
# ... (repeat for all 7) — all should resolve, correct priority/weight/port, target ipa.tetrain.com.
</nowiki>
</pre>

End-to-end proof it's actually working, from a real enrolled client:

<pre>
<nowiki>
systemctl restart sssd
cat /var/lib/sss/pubconf/kdcinfo.TORNEDO.TETRAIN.COM
# should now show ipa.tetrain.com's IP, not tornedo.tetrain.com's — this is the literal
# artifact SSSD writes with its discovery result, the most reliable way to confirm SRV
# discovery actually worked (vs. just "dig succeeded")
</nowiki>
</pre>

----