How to add new certificate chain in AWX?

Get Help
, , ,
1

Hi
My team has just migrated GitLab instance from one to another domain (so fqdn change from git.domain1.com to git.domain2.com) and perform AWX projects migration.

By default, gitlab works in http, AWX was able to pull project using deploy tokens credentials.
However, since I set up SSL certificate on the new instance, every project pulling ends with :
Failed to download remote objects and refs: fatal: unable to access 'https://git.domain2.com/awx/test-linux-ping.git/': SSL certificate problem: self-signed certificate in certificate chain

For what I know, this error come from git client (so in our case, git command called by AWX) but here’s my questions :

  1. What should I update to enable AWX to trust the new certificate chain of domain2.com ?
  2. Which pods are responsible for git pull actions ?

(Moreover:
I’ll update my custom Execution Environment image by adding the cert chain in my dockerfile if some projects have to deal with *.domain2.com ) but in my case, the EE isn’t used when git pull any projects.

Thanks a lot for your help
Gael

2

Hi @motorbass

but in my case, the EE isn’t used when git pull any projects.

That’s right, I can’t 100% recall right now but I think the awx-task pod is used for Project updates, but don’t quote me on that :sweat_smile:

You will need to make sure that AWX is aware of your new CA chain. You can do this using the Trusting a Custom Certificate Authority - Ansible AWX Operator Documentation ):

bundle_cacert_secret