ipa-upgradeconfig may report errors when some part of the configuration upgrade process fails. However, the errors are not reported to user even though they may be important and user should follow on and investigate. Few examples of such error messages:

root_logger.error('Cannot enable serial_autoincrement in %s: %s',
...
root_logger.error('Cannot move CRL files to new directory: %s', e)

We should enable stderr for ipa-upgradeconfig in our %post scriptlet, just like we did with ipa-ldap-updater. The error level log messages would be then also reported to the user at least during RPM update. We also need to make sure that there is an actual log file with output of ipa-upgradeconfig.