Hi,
Fedora project has released Fedora 28 last week. Unfortunately, FreeIPA 4.6.90.pre1 in Fedora 28 is not ready for production. We do not recommend to upgrade to Fedora 28 on your FreeIPA masters at this time.
We are working on finalizing FreeIPA 4.7 release that should replace 4.6.90.pre1 in Fedora 28. Right now the delta between Fedora 28 alpha where 4.6.90.pre1 was released and FreeIPA git master is about two months of work and dozens of fixes, including fixes for upgrade issues.
The reason why FreeIPA 4.7 is delayed is due to a need to coordinate with a number of other projects. FreeIPA moved to mod_ssl; Fedora 28 moved to use SQL backend in nss as a new default which broke a lot of assumptions in both FreeIPA and Dogtag. Tomcat version was upgrade and Dogtag needed to adapt which all took a lot of time. Unfortunately, some issues could only be discovered when you are moving forward past the fixes already made, so we are in a ping-pong game across a number of projects.
A nightly CI was added to FreeIPA upstream which allows us to test a wider set of configurations against Fedora 27 and 28.
We are planning to release another FreeIPA 4.7 prelease this week. It should help with a general upgrade path stabilization from Fedora 27 to 28.
Thus, I'd recommend to not upgrade to Fedora 28 until we provide an additional guidance.
Thank you,
freeipa-users@lists.fedorahosted.org