Merge "Restart certmnonger after registering system with IPA" into stable/queens

extraconfig/services/ipaclient.yaml

@@ -181,7 +181,18 @@ outputs:
 
                 ipa-client-install $OPTS
 
-          - name: run enrollment script
-            shell: /root/setup-ipa-client.sh >> /var/log/setup-ipa-client-ansible.log 2>&1
-            args:
-              creates: /etc/ipa/default.conf
+          - name: determine if client is already enrolled
+            stat:
+              path: /etc/ipa/default.conf
+            register: ipa_default_conf
+
+          - block:
+            - name: run enrollment script
+              shell: /root/setup-ipa-client.sh >> /var/log/setup-ipa-client-ansible.log 2>&1
+
+            - name: restart certmonger service
+              systemd:
+                state: restarted
+                daemon_reload: true
+                name: certmonger.service
+            when: ipa_default_conf.stat.exists == False

releasenotes/notes/restart-certmonger-244416f537859bac.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - Restart certmnonger after registering system with IPA.  This
+    prevents cert requests not completely correctly when doing a
+    brownfield update.