Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy + Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel, because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to bind only in 1 local interface and not to the VIP interface ?
King regard
Hi Karim,
On Tue, Jun 11, 2019 at 1:56 PM Karim Bourenane via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy + Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel, because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to bind only in 1 local interface and not to the VIP interface ?
Binding to the local interface is in no way expected and will result in some components not working.
I am not aware of any scenario where adding HAProxy+Keepalived in front of FreeIPA would provide a tangible benefit. Could you please explain the reasoning behind such a decision?
Regards, François
King regard _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
Thanks François, for your reply.
The goal, is to have the service IPA available always, if the server 1 will be down, and also for load sharing.
I thought about roundrobin dns, but sharing service is not mastered for effective sharing and the life test is not present.
Bien à vous
Mr Karim Bourenane +33686464439 +32493866354
Le mar. 11 juin 2019 à 14:03, François Cami fcami@redhat.com a écrit :
Hi Karim,
On Tue, Jun 11, 2019 at 1:56 PM Karim Bourenane via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy +
Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel,
because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to
bind only in 1 local interface and not to the VIP interface ?
Binding to the local interface is in no way expected and will result in some components not working.
I am not aware of any scenario where adding HAProxy+Keepalived in front of FreeIPA would provide a tangible benefit. Could you please explain the reasoning behind such a decision?
Regards, François
King regard _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
On Tue, Jun 11, 2019 at 2:54 PM Karim Bourenane karim.bourenane@gmail.com wrote:
Thanks François, for your reply.
The goal, is to have the service IPA available always, if the server 1 will be down, and also for load sharing.
Load-balancing is normally done automatically by servers/replicas and clients.
If you'd like having a single point of entry for administrative workloads https://www.adelton.com/freeipa/freeipa-behind-load-balancer should work as-is but you will need a HTTP proxy machine in front of your FreeIPA servers.
I thought about roundrobin dns, but sharing service is not mastered for effective sharing and the life test is not present.
Bien à vous
Mr Karim Bourenane +33686464439 +32493866354
Le mar. 11 juin 2019 à 14:03, François Cami fcami@redhat.com a écrit :
Hi Karim,
On Tue, Jun 11, 2019 at 1:56 PM Karim Bourenane via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy + Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel, because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to bind only in 1 local interface and not to the VIP interface ?
Binding to the local interface is in no way expected and will result in some components not working.
I am not aware of any scenario where adding HAProxy+Keepalived in front of FreeIPA would provide a tangible benefit. Could you please explain the reasoning behind such a decision?
Regards, François
King regard _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
IPA als already highly available, from the service side using DNS and multiple records for all services, on the web side: every server has a working web interface. If you want to redirect users to any working interface, a generic load balancer without keepalive works, redirect them to the IP and the IPA server will take care of redirecting to HTTPS and the domain name. No need to do anything yourself.
John
On 11 Jun 2019, at 14:54, Karim Bourenane via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Thanks François, for your reply.
The goal, is to have the service IPA available always, if the server 1 will be down, and also for load sharing.
I thought about roundrobin dns, but sharing service is not mastered for effective sharing and the life test is not present.
Bien à vous
Mr Karim Bourenane +33686464439 +32493866354
Le mar. 11 juin 2019 à 14:03, François Cami <fcami@redhat.com mailto:fcami@redhat.com> a écrit : Hi Karim,
On Tue, Jun 11, 2019 at 1:56 PM Karim Bourenane via FreeIPA-users <freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org> wrote:
Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy + Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel, because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to bind only in 1 local interface and not to the VIP interface ?
Binding to the local interface is in no way expected and will result in some components not working.
I am not aware of any scenario where adding HAProxy+Keepalived in front of FreeIPA would provide a tangible benefit. Could you please explain the reasoning behind such a decision?
Regards, François
King regard _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org mailto:freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org mailto:freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
On 11/6/19 11:33 pm, John Keates via FreeIPA-users wrote:
IPA als already highly available, from the service side using DNS and multiple records for all services, on the web side: every server has a working web interface. If you want to redirect users to any working interface, a generic load balancer without keepalive works, redirect them to the IP and the IPA server will take care of redirecting to HTTPS and the domain name. No need to do anything yourself.
This presumes that all such IPA hosts are directly accessible from the outside world.
Thanks you for all informations.
Karim Bourenane +33686464439 +32475753687
Le mar. 11 juin 2019 à 15:33, John Keates john@keates.nl a écrit :
IPA als already highly available, from the service side using DNS and multiple records for all services, on the web side: every server has a working web interface. If you want to redirect users to any working interface, a generic load balancer without keepalive works, redirect them to the IP and the IPA server will take care of redirecting to HTTPS and the domain name. No need to do anything yourself.
John
On 11 Jun 2019, at 14:54, Karim Bourenane via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Thanks François, for your reply.
The goal, is to have the service IPA available always, if the server 1 will be down, and also for load sharing.
I thought about roundrobin dns, but sharing service is not mastered for effective sharing and the life test is not present.
Bien à vous
Mr Karim Bourenane +33686464439 +32493866354
Le mar. 11 juin 2019 à 14:03, François Cami fcami@redhat.com a écrit :
Hi Karim,
On Tue, Jun 11, 2019 at 1:56 PM Karim Bourenane via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Hello team
Hope you are well.
After an existing installation, we decide to implement a Haproxy +
Keepalive in all our IPA's servers.
The haproxy / keepalive work weel but now the IPA doent run weel,
because he want to listen on all interface in the servers.
Ho i can to modify the IPA (+ all modules KRB5/DNS...) conf server, to
bind only in 1 local interface and not to the VIP interface ?
Binding to the local interface is in no way expected and will result in some components not working.
I am not aware of any scenario where adding HAProxy+Keepalived in front of FreeIPA would provide a tangible benefit. Could you please explain the reasoning behind such a decision?
Regards, François
King regard _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
freeipa-users@lists.fedorahosted.org
-
François Cami -
John Keates -
Karim Bourenane -
Peter Fern