Reconsider logic around resolv.conf.ipa and updating nameserver in resolv.conf.

[adelton]

Since 357a70b we tried to properly recreate the /etc/resolv.conf setups upon container startup, to match the state in which ipa-server-install left it. In 707f9dd we changed the logic to set nameserver to 127.0.0.1, to use FreeIPA's internal DNS server for resolution, and in 33822d3 we covered the creation of the resolv.conf.ipa (which indicates that the mechanism should be triggered) with

if systemctl is-active -q named-pkcs11 || [ -f /run/ipa/ipa-server-ip ] ; then

Once we achieved correct behaviour with read-only root, we documented in 9f49a2f that folks should really be using --dns=127.0.0.1 when starting the container, as the container itself will not be able to update the /etc/resolv.conf itself.

In #642, a setup with DNS external to the FreeIPA container, together with the use of IPA_SERVER_IP environment varialbe (which propagates to /run/ipa/ipa-server-ip) uncovered that the logic that we use is likely not correct -- if there is no DNS server in the container, we do no want to set the namesrever 127.0.0.1. We rely on the proper authentication working against the external DNS server, and with #640 we are able to disable the IP address update, for situation when they are handled completely outside of the logic on the FreeIPA container.

We might want to reconsider the logic around out handling of resolv.conf, to fix use cases like #642, but possibly to make the setup more predictable in general.

[adelton]

One possibility is to remove the logic around creating and following the existence of resolv.conf.ipa. We would assume users are able to set the resolv.conf content properly when creating the container.

It would be an incompatible change, so we might want to consider all implications of such change, and how to deprecate the behaviour for easy transition.

[adelton]

In #646 we document that --dns=127.0.0.1 should be used (not just for read-only containers) and we add

NOTE:
Consider setting --dns=127.0.0.1 when using internal DNS server.
The mechanism which sets it now will be removed from images in April 2025.

to the output both for initial configuration of FreeIPA containers and when they start and we detect internal DNS but not nameserver 127.0.0.1.

After the three months we would then remove the logic which manipulates the resolv.conf completely, as shown in ed39d8f.