Dmitry Perets via FreeIPA-users wrote:

Hi,

Really weird issue...

We build a docker container to run some ansible playbooks within it. We notice, that IF the container has "ipa-client" package installed, there is a HUGE performance degradation to execute the same playbook. E.g. 20 seconds without ipa-client vs 2 minutes with ipa-client (6 times worse!).

Note that:

• We DO NOT enroll the container. We don't run "ipa-client-install" at any point. We just have the "ipa-client" package INSTALLED (like "yum install ipa-client")
• The playbooks DO NOT talk to IPA in any way, neither do they run IPA commands. They are totally unrelated to ipa-client actually.

The delay seems to be during the connection - i.e. it doesn't matter WHAT exactly ansible task does. It gets stuck for all tasks on something like this (note timestamp):

<192.168.1.1> EXEC /bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-1574346920.3942568-62901531545767/AnsiballZ_stat.py && sleep 0' 852 1574346920.65004: opening command with Popen() 852 1574346920.65758: done running command with Popen() 852 1574346920.65791: getting output with communicate() 852 1574346921.00213: done communicating <<<<<< note the delay here, this happens for each task 852 1574346921.00227: done with local.exec_command()

So, JUST HAVING ipa-client installed somehow causes this slowness.

Any idea what ipa-client package can alter in system behavior, if we don't actually enroll in IPA domain?

P.S. You might be wondering WHY we actually have this ipa-client there... well, that's the point: it's totally unrelated to this particular thing... it's just that some of the playbooks need to use IPA commands, that's why we have ipa-client installed. But even NOT the playbook that we are testing above...

The package itself is just files, zero configuration except a bash completion script. There is a post-install script that should only fire on upgrades and even then only if the client is configured.

I'd see what else is pulled in my installing ipa-client.

rob