Editing Tornedo.tetrain.com Upgrade Plan (section)

== 3.3 Update (2026-07-23, later same day) — patched to latest 7.9 via Vault, still Phase A ==

Client ran a <code><nowiki>yum update</nowiki></code> pulling latest CentOS 7.9 packages from the Vault archive (the only source left now that CentOS 7's regular mirrors are gone). Rechecked via discovery + direct SSH:

* '''Still CentOS Linux 7''' — this was a point-release patch update, not a leapp hop. Kernel/ distro major version unchanged. This is good, necessary Phase A prep (matches "fully patch current release first"), not progress on the 7→Stream8→Stream9→Stream10 chain itself.
* '''Reboot now required, not yet done''': <code><nowiki>needs-restarting -r</nowiki></code> confirms glibc, systemd, openssl-libs, linux-firmware, and a new kernel (3.10.0-1160.119.1.el7) were all installed by the patch update but are not yet active — the box is still running the old 3.10.0-1127.13.1.el7 kernel/libraries in memory. This reboot is smaller/lower-risk than a leapp-hop reboot, but it's still real (brief) downtime for IPA's services and should be done deliberately, not as a surprise — holding for explicit go-ahead (see chat).
* '''Duplicate-RPM problem NOT resolved''': <code><nowiki>package-cleanup --dupes</nowiki></code> still shows ~497 lines of output. The patch update added new package versions without cleaning up the old ones — this is expected (that's what <code><nowiki>--cleandupes</nowiki></code> is for) but confirms the cleanup step is still required before <code><nowiki>leapp preupgrade</nowiki></code> will have a clean baseline.
* '''IPA health check — all green''': <code><nowiki>ipactl status</nowiki></code> shows every service RUNNING (Directory Service, krb5kdc, kadmin, httpd, ipa-custodia, ntpd, pki-tomcatd, ipa-otpd). All 9 certmonger-tracked certs show <code><nowiki>status: MONITORING</nowiki></code> with healthy future expiries, no <code><nowiki>ca-error</nowiki></code> on any of them. The identity service itself is currently in good shape.

'''Reboot completed.''' Verified post-reboot: running kernel is now <code><nowiki>3.10.0-1160.119.1.el7</nowiki></code> (matches installed), <code><nowiki>needs-restarting -r</nowiki></code> clean, all IPA services RUNNING, all 9 certs still healthy. This closes out the "fully patch current release" prep step.

'''<code><nowiki>ipa-backup</nowiki></code> completed''' (client ran it directly): full backup + logs at <code><nowiki>/var/lib/ipa/backup/ipa-full-2026-07-23-10-25-40</nowiki></code> on the box, 81M. Verified post-backup: all IPA services RUNNING again, all 9 certs still <code><nowiki>MONITORING</nowiki></code> with no errors. This item is closed.

Duplicate-RPM cleanup (<code><nowiki>package-cleanup --cleandupes</nowiki></code>) is the next open item before <code><nowiki>leapp preupgrade</nowiki></code> — client is running this step themselves; guidance given in chat (review the transaction list before confirming, watch for grub2/dracut/kernel entries, re-verify <code><nowiki>--dupes</nowiki></code>/<code><nowiki>yum check</nowiki></code>/<code><nowiki>ipactl status</nowiki></code>/<code><nowiki>getcert list</nowiki></code> afterward).