PVE and AD domain join...

PVE and AD domain join...

[Marco Gaiarin]

I've read a bit PVE9 changelogs, impressive!


We have some sets of asymmetric clusters, composed by two 'new' servers that
do horsepower, and a third, tipically old, server that do mostly quorum and
disk space for backup.

For better manage some aspects of our backup we are thinking to join that
third node via SSSD/Winbind to our AD domain, adding samba shares of some stuff.


I've read wikis and forums, and seems to me that this is not explicitly
promoted nor forbidden: still PVE9 use AD accounts directly, and forums are
full of people that have joined one node (or the cluster) via SSSD/Winbind.


I'm asking explicitly if i could get some trouble doing this; for example:

1) if i join only one server in a cluster, i can get trouble;

2) the pretty high UID/GID generated by SSSD/Winbind for users and groups can be
 problematic for LXC, because could clash.


Having some experience on Debian and PVE, seems to me that there will no
trouble at all.


But i prefere to ask. Thanks.

-- 

PVE and AD domain join...

[Marco Gaiarin]

I'm still seeking feedback... if i was not clear, please say me.

Thanks.

[ This is a repost of the following article:                               ]
[ From: Marco Gaiarin <gaio@lilliput.linux.it>                             ]
[ Subject: PVE and AD domain join...                                       ]
[ Newsgroups: lists.pve.user                                               ]
[ Message-ID: <k8sojm-r701.ln1@leia.lilliput.linux.it>                     ]


I've read a bit PVE9 changelogs, impressive!


We have some sets of asymmetric clusters, composed by two 'new' servers that
do horsepower, and a third, tipically old, server that do mostly quorum and
disk space for backup.

For better manage some aspects of our backup we are thinking to join that
third node via SSSD/Winbind to our AD domain, adding samba shares of some stuff.


I've read wikis and forums, and seems to me that this is not explicitly
promoted nor forbidden: still PVE9 use AD accounts directly, and forums are
full of people that have joined one node (or the cluster) via SSSD/Winbind.


I'm asking explicitly if i could get some trouble doing this; for example:

1) if i join only one server in a cluster, i can get trouble;

2) the pretty high UID/GID generated by SSSD/Winbind for users and groups can be
 problematic for LXC, because could clash.


Having some experience on Debian and PVE, seems to me that there will no
trouble at all.


But i prefere to ask. Thanks.

-- 

--