Shadow mode
Ask a machine what it currently believes, and report the difference. It enforces nothing.
The migration feature that matters. Shadow mode asks the machine what it
currently believes (through real getent and real sudo) and reports the
difference against what Cardinal would say.
cardinal-agent shadow -server https://id.example.com
cardinal-agent shadow -server https://id.example.com -json > web-01.json
cardinal-agent shadow -server https://id.example.com -users deploy,backup
It enforces nothing: no socket, no sudoers file, no certificate. It is
safe to run on a production host that is still served by something else.
It does not care what it is replacing
It reads what the machine believes, not what the machine is configured with, so
it works the same against sssd bound to LDAP or Active Directory, nss_ldap,
or a hand-maintained /etc/passwd. There is no importer to write and no
credential for the old system to hand over.
The one finding that blocks a cutover
A uid or gid that disagrees. The moment Cardinal wins, every file that account owns is reattributed, so the answer is to adopt the numbers the machine already has, not to renumber the filesystem.
cardinal posix adopt -from web-01.json,web-02.json # shows the changes
cardinal posix adopt -from web-01.json,web-02.json -yes # applies them
A cutover, in order
- Enrol the host and run the agent in shadow mode.
- Adopt any conflicting numbers, from the reports.
- Re-run shadow until nothing blocks.
- Switch the agent to
run, non-production first. - Keep local root. It was never taken away.