Topology
The replication topology between masters: nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and that replication status lives on the CLI.
Every IDMatrix server is a writable master and data is kept in sync by multi-master replication. The topology graph shows the servers (nodes) and the replication segments between them (edges). A single-server deployment is one dot; after adding a replica (Replica) the edge appears by itself.
What is drawn
| Element | Meaning |
|---|---|
| node | an IPA server, as listed by ipa server-find |
| edge | a replication segment: the agreement between two servers, two-way by default |
| suffix switch | domain (users, hosts, policy, everything) and ca (certificate data, only between servers running a CA). Each suffix has its own topology and each must be connected |
Add creates a segment: two servers and a suffix. Delete removes one, provided the graph stays connected afterwards; otherwise it is refused.
A healthy topology
- Every server has at least two edges, so losing one server does not split the graph.
- No server has more than 4 edges; replication load grows with the edge count.
- Two sites: full mesh inside a site, at least two edges between sites.
- Both
domainandcaconnected; only CA-bearing servers appear in thecasuffix.
ipa-replica-install creates the segment to the server it installed from; afterwards add edges and break up star shapes along the lines above.
Replication status
The graph does not show whether replication is running or backlogged. For that:
ipa topologysegment-find domain
ipa-replica-manage list -v webui.linux.ipa.test # last update time and status per agreement
ipa-healthcheck --source ipahealthcheck.ds.replicationlast update status: Error (...) or a last update ended far in the past means replication is broken; troubleshooting is under Replica.
Boundaries
- Deleting a server (
ipa server-del) removes all its segments; deleting a segment never removes a server. - Agreement attributes (e.g.
nsds5ReplicaStripAttrs) cannot be edited in the graph; useipa topologysegment-mod. - The layout changes on every refresh; node positions carry no meaning.
ID ranges
How the local range and each trusted domain's range decide uid / gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot simply be edited later.
Configuration
Global defaults: search limits, default shell / home / group / e-mail domain for new users, default authentication type, user and group object classes, the SELinux user list, CA renewal and PKINIT masters. Changes affect objects created afterwards.