Topology
The replication topology between masters, with nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and where replication status is read.
This page covers the Topology and Topology graph pages under IPA Server. Every IDMatrix server is a writable master and data is kept in sync by multi-master replication. The topology graph shows the servers (nodes) and the replication segments between them (edges). A single-server deployment is one node; after adding a replica (Replica) the edge appears by itself.
Elements
| Element | Meaning |
|---|---|
| Node | An IPA server, as listed by ipa server-find |
| Edge | A replication segment: the agreement between two servers, two-way by default |
| Suffix switch | domain (users, hosts, policy, everything) and ca (certificate data, only between servers running a CA). Each suffix has its own topology and each must be connected |
Add creates a segment from two servers and a suffix. Delete removes one, provided the graph stays connected afterwards; otherwise it is refused.
A healthy topology
| Criterion | Notes |
|---|---|
| Every server has at least two edges | Losing one server does not split the graph |
| No server has more than 4 edges | Replication load grows with the edge count |
| Two sites | Full mesh inside a site, at least two edges between sites |
Both domain and ca connected | Only CA-bearing servers appear in the ca suffix |
ipa-replica-install creates the segment to the server it installed from. Afterwards, add edges and break up star shapes along the lines above.
Replication status
The graph does not show whether replication is running or backlogged. For that:
ipa topologysegment-find domain
ipa-replica-manage list -v webui.linux.ipa.test # last update time and status per agreement
ipa-healthcheck --source ipahealthcheck.ds.replicationlast update status: Error (...), or a last update ended far in the past, means replication is broken. Troubleshooting is under Replica.
Boundaries
| Topic | Notes |
|---|---|
| Deleting a server | ipa server-del removes all its segments. Deleting a segment never removes a server |
| Agreement attributes | Cannot be edited in the graph (such as nsds5ReplicaStripAttrs); use ipa topologysegment-mod |
| Layout | Changes on every refresh; node positions carry no meaning |
ID ranges
How the local range and each trusted domain's range decide uid and gid, what the range types mean, how an AD user's uid is derived from its SID, and why a range cannot be edited freely later.
Configuration
Global defaults, including search limits, default shell, home, group and e-mail domain for new users, default authentication type, user and group object classes, the SELinux user list, CA renewal and PKINIT masters. Changes affect objects created afterwards.