This is the currently expected behavior before pacemaker-attrd has learned a node is remote. Once it does learn it, it will update the attribute cache entry and write it out.

With the recent TLS changes, I think we have all the pieces in place and this should be a simple matter of gluing them together. Most everything in remote CIB admin/Pacemaker Remote gnutls connection management land is pretty well broken into functions now. It might simply be a matter of passing the right cred_type around - it's probably more work to check the environment or command line (or whatever) to decide what connection type it is than it will be to actually implement this.

@nrwahl2 , that's part of T727

@kgaillot I don't think the existing XSLT error handler sets config warning, FYI. If we want that, we'll want a wishlist task for it, because it looks like it's gonna require some rearranging of cib_upgrade_err() that might be tricky to avoid redundant logs.