Editing Tornedo.tetrain.com Upgrade Plan (section)

=== 8.7 Intermediate bridge (<code><nowiki>ipa8.tetrain.com</nowiki></code>) decommissioned — DONE ===

Attempting <code><nowiki>ipa server-del ipa8.tetrain.com --force</nowiki></code> directly failed with a topology-disconnect error: '''<code><nowiki>ipa8</nowiki></code> was the only link connecting <code><nowiki>tornedo.tetrain.com</nowiki></code> and <code><nowiki>ipa.tetrain.com</nowiki></code>''' — removing it would have split the topology into two disconnected islands with no path to sync future changes between them. IPA's own topology check caught this correctly rather than letting it happen silently. Fixed by adding a direct segment between the two remaining servers first, for both suffixes:

<pre>
<nowiki>
ipa topologysegment-add domain --leftnode=tornedo.tetrain.com --rightnode=ipa.tetrain.com
ipa topologysegment-add ca --leftnode=tornedo.tetrain.com --rightnode=ipa.tetrain.com
</nowiki>
</pre>

Verified both new agreements replicating successfully before retrying. <code><nowiki>ipa server-del ipa8.tetrain.com --force</nowiki></code> then completed cleanly.

'''Post-removal validation''': all 7 services RUNNING, all 9 certs <code><nowiki>MONITORING</nowiki></code> (no errors — ipa-custodia's renewal role wasn't disrupted despite <code><nowiki>ipa8</nowiki></code> having been its install-time "master peer"), <code><nowiki>ipa-custodia.service</nowiki></code> itself active/healthy, full LDAP+API roundtrip still works, and replication agreements now show only the direct <code><nowiki>tornedo.tetrain.com</nowiki></code> ↔ <code><nowiki>ipa.tetrain.com</nowiki></code> links — no remaining references to <code><nowiki>ipa8</nowiki></code> anywhere.

'''The <code><nowiki>ipa8.tetrain.com</nowiki></code> VM is now safe to shut down''' — cleanly removed from the topology first, so no broken replication agreements or stale data left behind.