[Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Petr Spacek
Hello, there is an interesting idea that installers should be idempotent. I have heard it on LinuxAlt conference 2013 in Brno, Czech republic and it is implemented e.g. by project Chef [1] and it is used e.g. by OpenStack installer [2] (used e.g. by SUSE). What Wikipedia says about idempoten

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Derek Moore
As someone who has fought with using/modifying/QA'ing unstable FreeIPA installers from the nightly repos, I wholeheartedly second this motion! Make sure the oVirt guys get wind of this idea also! ;) PS: semi-related note — Can FreeIPA be made to consume the CSR that results from the ovirt-host-de

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Derek Moore
PPS: you guys might be able to borrow oVirt's "otopi" installer engine, it seems to have been created to make install scripts more declarative. Although to the end-user otopi can seem dense, complicated, and mysterious (e.g., its weird .conf file syntax). They might need your help making otopi more

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Jan Pazdziora
On Thu, Nov 14, 2013 at 03:40:52PM +0100, Petr Spacek wrote: > > In reality, it means that you can re-run OpenStack installer on the > same machine/set of machines (with the same configuration, of > course!) and it will re-do everything again. You can re-run The point is that it should *not* redo

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread James
On Thu, Nov 14, 2013 at 11:41 AM, Derek Moore wrote: > PPS: you guys might be able to borrow oVirt's "otopi" installer engine, it > seems to have been created to make install scripts more declarative. If you like declarative, you should consider using my puppet-ipa module to install this. It does

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-14 Thread Petr Spacek
On 15.11.2013 02:14, Jan Pazdziora wrote: On Thu, Nov 14, 2013 at 03:40:52PM +0100, Petr Spacek wrote: In reality, it means that you can re-run OpenStack installer on the same machine/set of machines (with the same configuration, of course!) and it will re-do everything again. You can re-run

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-15 Thread Jan Pazdziora
On Fri, Nov 15, 2013 at 08:38:11AM +0100, Petr Spacek wrote: > > The point is that you have a chance to fix the problem (reconfigure > firewall, DNS etc.), run the installer again and it will finish the > installation or fail later on some other problem. It means that you > don't need to start fro

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-15 Thread Rob Crittenden
Jan Pazdziora wrote: On Thu, Nov 14, 2013 at 03:40:52PM +0100, Petr Spacek wrote: In reality, it means that you can re-run OpenStack installer on the same machine/set of machines (with the same configuration, of course!) and it will re-do everything again. You can re-run The point is that it

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-15 Thread Derek Moore
> > Practically though, I think an idempotent installer opens a lot of cans of > worms. Do we limit some answers to their original? Take for instance the > REALM. Can someone change it on-the-fly? It would have some deep > repercussions. Similarly, changing the hostname. There are all kinds of > co

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-18 Thread Paul Robert Marino
I don't really agree with you that it is all that difficult to get a real LDAPv3 server up and running. I've built quite a few of them over the years and what I mostly found was it was just poorly documented.Although I will say putting it all into one uniform toolset is ambitious, its not the first

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-20 Thread Petr Spacek
On 15.11.2013 17:44, Derek Moore wrote: Practically though, I think an idempotent installer opens a lot of cans of worms. Do we limit some answers to their original? Take for instance the REALM. Can someone change it on-the-fly? It would have some deep repercussions. Similarly, changing the host

Re: [Freeipa-devel] idempotent installer [from LinuxAlt 2013]

2013-11-20 Thread Derek Moore
I meant to say the integration of components and subsystems and providing some automation is what is truly difficult. Back then I was coming from Netware NDS, so I already got DNs and RDNs. For me the holy grail was sendmail + Cyrus IMAP + bind all serving from a deduped/normalized LDAP schema. I