ipareplica: Refactor CA file handling in replica deployment

The call `install_ca_cert()` is not used in FreeIPA and is to be
removed in the near future (freeipa/freeipa#6620).

ipareplica can be modified to only use the function once it is
available, otherwise, `ipa-certupdate` will be used during replica
prepare.

roles/ipareplica/library/ipareplica_install_ca_certs.py

@@ -297,6 +297,12 @@ def main():
     config.ca_host_name = config_ca_host_name
     config.ips = config_ips
 
+    if install_ca_cert is None:
+        ansible_module.exit_json(
+            changed=False,
+            config_master_host_name=config.master_host_name,
+            config_ca_host_name=config.ca_host_name)
+
     remote_api = gen_remote_api(config.master_host_name, paths.ETC_IPA)
     installer._remote_api = remote_api
 

roles/ipareplica/library/ipareplica_prepare.py

@@ -275,7 +275,8 @@
     check_domain_level_is_supported, errors, ScriptError, setup_logging,
     logger, check_dns_resolution, service, find_providing_server, ca, kra,
     dns, no_matching_interface_for_ip_address_warning, adtrust,
-    constants, api, redirect_stdout, replica_conn_check, tasks
+    constants, api, redirect_stdout, replica_conn_check, tasks,
+    is_ipa_client_configured, install_ca_cert,
 )
 from ansible.module_utils import six
 
@@ -601,10 +602,20 @@ def main():
     ansible_log.debug("-- CA_CRT --")
 
     cafile = paths.IPA_CA_CRT
-    if not os.path.isfile(cafile):
-        ansible_module.fail_json(
-            msg="CA cert file is not available! Please reinstall"
-            "the client and try again.")
+    if install_ca_cert is not None:
+        if not os.path.isfile(cafile):
+            ansible_module.fail_json(
+                msg="CA cert file is not available! Please reinstall"
+                "the client and try again.")
+    else:
+        if is_ipa_client_configured(on_master=True):
+            # host was already an IPA client, refresh client cert stores to
+            # ensure we have up to date CA certs.
+            try:
+                ipautil.run([paths.IPA_CERTUPDATE])
+            except ipautil.CalledProcessError:
+                ansible_module.fail_json(
+                    msg="ipa-certupdate failed to refresh certs.")
 
     ansible_log.debug("-- REMOTE_API --")
 

roles/ipareplica/module_utils/ansible_ipa_replica.py

@@ -49,7 +49,7 @@
            "dnsname", "kernel_keyring", "krbinstance", "getargspec",
            "adtrustinstance", "paths", "api", "dsinstance", "ipaldap", "Env",
            "ipautil", "installutils", "IPA_PYTHON_VERSION", "NUM_VERSION",
-           "ReplicaConfig", "create_api"]
+           "ReplicaConfig", "create_api", "is_ipa_client_configured", ]
 
 import sys
 import logging
@@ -134,14 +134,24 @@ def getargspec(func):
                 find_providing_servers, find_providing_server)
         from ipaserver.install.installutils import (
             ReplicaConfig, load_pkcs12)
+        try:
+            from ipalib.facts import is_ipa_client_configured
+        except ImportError:
+            is_ipa_client_configured = None
         try:
             from ipalib.facts import is_ipa_configured
         except ImportError:
             from ipaserver.install.installutils import is_ipa_configured
         from ipaserver.install.replication import (
             ReplicationManager, replica_conn_check)
+        try:
+            from ipaserver.install.server.replicainstall import (
+                install_ca_cert
+            )
+        except ImportError:
+            install_ca_cert = None
         from ipaserver.install.server.replicainstall import (
-            make_pkcs12_info, install_replica_ds, install_krb, install_ca_cert,
+            make_pkcs12_info, install_replica_ds, install_krb,
             install_http, install_dns_records, create_ipa_conf, check_dirsrv,
             check_dns_resolution, configure_certmonger,
             remove_replica_info_dir,