ipaclient: Increase minimum supported IPA version to 4.6.8#1419

[t-woerner]

This is preparation work for the SIX removal in Ansible that will drop support for RHEL-7 (Python 2) and together with this support for IPA versions prior to 4.8.4.

The goal is to remove code that was needed for IPA versions prior to 4.6.8. Also to mark the code and special cases with the IPA versions that needed these.

Summary by Sourcery

Raise the minimum supported FreeIPA server version for the ipaclient role and simplify compatibility handling accordingly.

Enhancements:

• Remove legacy code paths and conditionals for FreeIPA versions older than 4.6.8, enforcing a runtime minimum version check.
• Standardize on the modern ipaclient discovery API and update references from ipadiscovery to discovery across modules and documentation strings.
• Simplify CA certificate retrieval and time configuration logic now that only newer FreeIPA interfaces need to be supported.
• Centralize and streamline initialization of the installer options and logging objects in the ipaclient module.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• The new global logger initialization at the bottom of ansible_ipa_client.py uses logging.getLogger but logging is no longer imported in this refactored path, so you should add a top-level import logging to avoid a NameError at import time.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new global logger initialization at the bottom of ansible_ipa_client.py uses `logging.getLogger` but `logging` is no longer imported in this refactored path, so you should add a top-level `import logging` to avoid a NameError at import time.

## Individual Comments

### Comment 1
<location path="roles/ipaclient/module_utils/ansible_ipa_client.py" line_range="259-265" />
<code_context>
+# pylint: enable=too-few-public-methods, useless-object-inheritance
+
+
+# Initialize installer and options
+installer = installer_obj()
+options = installer
+
+# Initialize logger
+logger = logging.getLogger("ipa-client-install")
+root_logger = logger
</code_context>
<issue_to_address>
**issue (bug_risk):** Logger initialization can fail when imports fail, potentially masking the intended import error handling.

With `logger = logging.getLogger("ipa-client-install")` now outside the `try ... except ImportError` block, it will execute even when an earlier import fails and `ANSIBLE_IPA_CLIENT_MODULE_IMPORT_ERROR` is set. If `logging` hasn’t been imported yet, this raises a `NameError` before `check_imports()` can surface the original `ImportError`. To keep the existing error-handling behavior, move logger initialization back inside the main import `try` (after `import logging`) or otherwise ensure it only runs after all imports succeed.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): Logger initialization can fail when imports fail, potentially masking the intended import error handling.

With logger = logging.getLogger("ipa-client-install") now outside the try ... except ImportError block, it will execute even when an earlier import fails and ANSIBLE_IPA_CLIENT_MODULE_IMPORT_ERROR is set. If logging hasn’t been imported yet, this raises a NameError before check_imports() can surface the original ImportError. To keep the existing error-handling behavior, move logger initialization back inside the main import try (after import logging) or otherwise ensure it only runs after all imports succeed.

[rjeffman]

I don't like to have commented out code, specially whithout a comment with the rationale.

[rjeffman]

In roles/ipaclient/library/ipaclient_api.py the code in lines 126-130 can be removed. The same code is found at lines 347-351 in roles/ipaclient/library/ipaclient_setup_nss.py.

README file should be also changed to reflect new minimum IPA version.

In roles/ipaclient/module_utils/ansible_ipa_client.py, lines 83-87 can be removed.