Editing Tornedo.tetrain.com Upgrade Plan (section)

== 11. Decommissioning plan — Phase 1 items 1-5 closed, Phase 2 (access-log readiness check) result: NO-GO (2026-07-24) ==

Phase 1 (pre-checks): items 1-4 confirmed closed by client. Item 5 (special/exclusive-role check) independently verified clear — <code><nowiki>tornedo.tetrain.com</nowiki></code> holds no CRL-generation or CA-renewal-master role (both already on <code><nowiki>ipa.tetrain.com</nowiki></code>); its remaining service flags (NTP, KDC, KPASSWD, KEYS, CA, OTPD, HTTP) are normal <code><nowiki>enabledService</nowiki></code> participation, not exclusive roles. Nothing needs to be moved before decommission on that front.

=== 11.1 Phase 2, point 6 — access-log readiness check (methodology) ===

Re-ran the dirsrv access-log "who's actually still connecting" analysis, this time scoped specifically at <code><nowiki>tornedo.tetrain.com</nowiki></code> and cross-checked against <code><nowiki>ipa.tetrain.com</nowiki></code>, so a host that has fully cut over shows up as absent-from-tornedo/present-on-ipa rather than a false negative.

* <code><nowiki>tornedo.tetrain.com</nowiki></code>: 4 rotated logs + current, covering <code><nowiki>2026-07-22 18:29</nowiki></code> → <code><nowiki>2026-07-24 06:56</nowiki></code> (~36.5h retention).
* <code><nowiki>ipa.tetrain.com</nowiki></code> (instance still named <code><nowiki>slapd-TORNEDO-TETRAIN-COM</nowiki></code>, inherited from the replica build): 1 rotated log + current, covering <code><nowiki>2026-07-23 14:22</nowiki></code> → <code><nowiki>2026-07-24 07:00</nowiki></code> (~16.6h retention).
* Extracted last-seen timestamp + connection count per source IP from both (<code><nowiki>grep "connection from"</nowiki></code>, field <code><nowiki>$8</nowiki></code> = IP), resolved fresh DNS for all 50 hosts in <code><nowiki>reports/ipa_hosts_final_2026-07-24.csv</nowiki></code>, and cross-referenced.
* For the 9 hosts with no forward DNS record (<code><nowiki>app.brijraj.in</nowiki></code>, <code><nowiki>app.brijraj.in-new</nowiki></code>, <code><nowiki>cloud-storage.triburg.co.in</nowiki></code>, <code><nowiki>dr-mobilepedia.tetrain.com</nowiki></code>, <code><nowiki>li1732-118</nowiki></code>/<code><nowiki>li1994-156 .members.linode.com</nowiki></code>, <code><nowiki>mail.curiocrafts.com</nowiki></code>, <code><nowiki>mobilepedia-sites.tetrain.com</nowiki></code>, <code><nowiki>tetra-demo.tetrain.com</nowiki></code>), ran reverse-DNS on unmatched tornedo-log IPs instead, which identified several of them directly connecting under a different IP than the CSV has on file.

=== 11.2 Result: traffic to tornedo is current and substantial, not near zero — target not met ===

63 distinct IPs hit tornedo in the 36.5h window, most with '''timestamps in the last few minutes before the log snapshot was taken''' (i.e. essentially live at time of check), at volumes (~100- 160 connections per host over the window) consistent with normal periodic SSSD traffic, not stragglers. This is the opposite of the "traffic near zero, sustained" target set for Phase 3.

'''Group A — fully migrated (tornedo stale/absent, ipa current): safe.''' <code><nowiki>koha.tetra.in</nowiki></code>, <code><nowiki>li2028-191</nowiki></code>/<code><nowiki>li2092-64</nowiki></code>/<code><nowiki>li2095-168.members.linode.com</nowiki></code>, <code><nowiki>mail.sceh.net</nowiki></code>, <code><nowiki>mail.sysnetglobal.com</nowiki></code>, <code><nowiki>mail.tetra.in</nowiki></code>, <code><nowiki>mail.isonemployees.com</nowiki></code>/<code><nowiki>single.tetra.in</nowiki></code>/ <code><nowiki>zm.isonemployees.co.za</nowiki></code> (shared IP), <code><nowiki>mbox1.mysecuremail.email</nowiki></code>, <code><nowiki>mbox2.mysecuremail.email</nowiki></code>, <code><nowiki>php-devel-1.tetra.in</nowiki></code>, <code><nowiki>relay.isgec.com</nowiki></code>, <code><nowiki>upyog.tetrain.com</nowiki></code>, <code><nowiki>zm.wbtea.com</nowiki></code>, <code><nowiki>zurt-ison.mysecuremail.email</nowiki></code>, <code><nowiki>zurt-sysnet.mysecuremail.email</nowiki></code>, <code><nowiki>devel-isonbpo-ihelpdesk.tetra.in</nowiki></code>. Confirms the two client-flagged "stragglers" <code><nowiki>mbox2.mysecuremail.email</nowiki></code> and <code><nowiki>devel-isonbpo-ihelpdesk.tetra.in</nowiki></code> are indeed resolved.

'''Group B — dual-hitting, still transitional:''' <code><nowiki>cloud-storage.tetra.in</nowiki></code>, <code><nowiki>ihelpdesk-belpoc.tetra.in</nowiki></code>, <code><nowiki>www.mobilepedia.in</nowiki></code>, <code><nowiki>nextcloud.tetra.in</nowiki></code>, <code><nowiki>tetra-demo2.tetrain.com</nowiki></code>, <code><nowiki>www.tetrain.com</nowiki></code>, <code><nowiki>zurt.tetrain.com</nowiki></code> — hitting both servers currently, ipa share growing but not yet exclusive. Not blockers, but not done either.

'''Group C — tornedo-only or tornedo-dominant, live right now — hard blockers:''' <code><nowiki>app-1.tetrain.com</nowiki></code>, <code><nowiki>mail.energoconstruction.com</nowiki></code>/<code><nowiki>mail.energoproducts.com</nowiki></code> (shared IP), <code><nowiki>nic.tetra.in</nowiki></code>, <code><nowiki>server-relay.tetrain.com</nowiki></code>, <code><nowiki>server-relay-2.tetrain.com</nowiki></code>, <code><nowiki>indorama-relay.tetrain.com</nowiki></code>, <code><nowiki>app.brijraj.in</nowiki></code>, <code><nowiki>tetra-demo.tetrain.com</nowiki></code>, <code><nowiki>cloud-storage.triburg.co.in</nowiki></code>, and — '''important discrepancy''' — <code><nowiki>mail.tetrain.com</nowiki></code>/ <code><nowiki>zimbra-test.tetra.in</nowiki></code> (shared IP <code><nowiki>139.84.171.188</nowiki></code>): 161 live connections to tornedo vs. a single stray hit on ipa 13+ hours ago. This one was on the client's "confirmed closed" list for Phase 1 but the log data says it has '''not''' cut over — worth a direct re-check on that host's <code><nowiki>sssd.conf</nowiki></code>/<code><nowiki>krb5.conf</nowiki></code> before trusting it as closed.

'''Group D — active clients hitting tornedo that aren't in the 50-host inventory at all:''' <code><nowiki>server-relay-1.tetra.in</nowiki></code> (52.199.95.254), <code><nowiki>mail.prime-sdec.com</nowiki></code> (111.93.232.170), an Airtel static/NAT IP (182.72.51.106), two bare AWS EC2 IPs with no reverse hostname (3.6.120.132, 3.111.216.210), and one IP that timed out on reverse lookup (139.84.143.206) — all with live, recent, regular (~100-150 count) traffic. These need identifying and adding to inventory before decommission, since they're real current dependents we don't otherwise have visibility into.

'''Background noise, not decommission-relevant:''' <code><nowiki>172.26.27.51</nowiki></code> (private VPC IP, highest count of all at 250 — almost certainly <code><nowiki>ipa.tetrain.com</nowiki></code>'s own replication connection to tornedo over the internal network, expected until topology is formally torn down in a later phase); <code><nowiki>127.0.0.1</nowiki></code>/<code><nowiki>::1</nowiki></code> (local health checks); <code><nowiki>65.20.78.116</nowiki></code> (old <code><nowiki>ipa8.tetrain.com</nowiki></code> IP, last seen 16h+ before window close — dead, matches its decommission); <code><nowiki>13.232.220.151</nowiki></code> (old <code><nowiki>ipa.tetrain.com</nowiki></code> IP pre-cutover, 1 stray hit); ~15 single/low-count IPs from Jul 22-23 consistent with the SSH-brute-force scanning residue documented in section 10, not real IPA clients.

=== 11.3 Verdict ===

'''No-go on Phase 3.''' At minimum 10 known hosts (Group C) plus 5-6 unidentified active clients (Group D) are currently, live, dependent on tornedo — several exclusively. Recommend: fix Group C's SRV/<code><nowiki>dns_lookup_kdc</nowiki></code> config (same pattern as section 9's fleet sweep), identify and enroll Group D properly, re-run this exact check in 24-48h, and only proceed to Phase 3 once Group C/D traffic drops to the same stale/absent pattern Group A already shows.