7.8.7. Upgrading IPA services
If TLS everywhere is enabled in your environment, add an additional permission to the Nova Host Manager role to allow the creation of DNS zone entries.
Procedure
-
Log in to the undercloud host as the
stackuser. Source the
stackrcundercloud credentials file:$ source ~/stackrcCheck whether the
Nova Host Managementpermission is included in your environment:$ ipa privilege-show "Nova Host Management"If you do not have the
Nova Host Managementpermission, add it:$ kinit admin $ ipa privilege-add-permission 'Nova Host Management' --permission 'System: Modify Realm Domains'Create an environment file called
ipa_environment.yamland include the following configuration:resource_registry: OS::TripleO::Services::IpaClient: /usr/share/openstack-tripleo-heat-templates/deployment/ipa/ipaservices-baremetal-ansible.yaml parameter_defaults: IdMServer: $IPA_FQDN IdMDomain: $IPA_DOMAIN IdMInstallClientPackages: False- Save the environment file.