Product SiteDocumentation Site

18.9. Removing a Replica

Deleting or demoting a replica removes the FreeIPA replica from the server/replica topology so that it no longer processes FreeIPA requests and it also remove the host machine itself from the FreeIPA domain.
  1. On an FreeIPA server, obtain a Kerberos ticket before running FreeIPA tools.
    [root@replica ~]#kinit admin
  2. List all of the configured replication agreements for the FreeIPA domain.
    [root@replica ~]# ipa-replica-manage list
    Directory Manager password: 
    
    ipaserver.example.com: master
    ipaserver2.example.com: master
    replica.example.com: master
    replica2.example.com: master
  3. Removing the replica from the topology involves deleting all the agreements between the replica and the other servers in the FreeIPA domain and all of the data about the replica in the domain configuration.
    [root@replica ~]# ipa-replica-manage del replica.example.com
  4. If the replica was configured with its own CA, then also use the ipa-csreplica-manage command to remove all of the replication agreements between the certificate databases for the replica.
    This is required if the replica itself was configured with a Dogtag Certificate System CA. It is not required if only the master server or other replicas were configured with a CA.
    [root@replica ~]# ipa-csreplica-manage del replica.example.com
  5. On the replica, uninstall the replica packages.
    [root@replica ~]# ipa-server-install --uninstall -U