# Project sync SSH issues on brand-new AWX instance **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [February 9, 2022, 10:49pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314 "2022-02-09T22:49:33Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Max\_Hosel](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Max\_Hosel](https://forum.ansible.com/u/Max_Hosel)\ **Post date:** [February 9, 2022, 10:49pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314/1 "2022-02-09T22:49:33Z")
Hello! I’m trying to set up a fresh AWX instance and I’ve run into an issue while creating/syncing a project. I’m trying to pull a private repo from GitHub using an SSH credential, but no matter what I do, the sync job always hangs on the git project update task, with the message “The authenticity of host ‘[github.com](http://github.com) (140.82.121.3)’ can’t be established.”. Seems like GitHubs SSH host key is not being accepted for some reason? ![job.png](https://us1.discourse-cdn.com/ansible/original/2X/8/8c403d37742381a0f92f17d47f6ffa6d23434135.png) Below are the project settings. I’ve also tried a different URL syntax (ssh://github.com/username/project) but that didn’t do me any good either. Do I need to somehow inject the GitHub host key or should AWX just handle that itself? I don’t remember this ever being necessary on my previous AWX install. Perhaps I’m just missing something? ![project-settings.png](https://us1.discourse-cdn.com/ansible/original/2X/c/cf350875aed7f658a39ff78dcf448a9c4b170db0.png) The Credential is a standard Source Control Credential with a private key inside. As for my deployment: AWX Version: 19.5.1 Deployed via AWX-Operator 0.16.1 on a k3s cluster Any help would be highly appreciated! I’m happy to provide logs or other info if required ---
**Author:** ![Max\_Hosel](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Max\_Hosel](https://forum.ansible.com/u/Max_Hosel)\ **Post date:** [February 10, 2022, 2:07pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314/2 "2022-02-10T14:07:38Z")
Update: This seems to be related to some recent change in ansible/AWX-EE. I just manually created an Control Plane EE with Ansible-Runner pinned to stable-2.11 and configured my deployment to use it. The issue has now gone away, along with the warning about running a development version of Ansible. Semi-relevant GitHub issue: [https://github.com/ansible/awx-ee/issues/72](https://github.com/ansible/awx-ee/issues/72) ---
**Author:** ![Andrew\_Mulheirn](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@Andrew\_Mulheirn](https://forum.ansible.com/u/Andrew_Mulheirn)\ **Post date:** [February 10, 2022, 9:30pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314/3 "2022-02-10T21:30:32Z")
Thanks for posting - that is very interesting because I am getting that trying to get a project to sync for a customer today. When I set it up identically on my environment it works fine, but in the customer’s environment I get the message about being unable to verify the identity of [gitlab.com](http://gitlab.com) (in my case I’m using Gitlab). I will try your solution tomorrow for the customer and see if that helps. Is this how you have configured your EE? > **(attachments)** > > ![ee.jpg](https://us1.discourse-cdn.com/ansible/original/2X/8/81eb034d82a35d84238f11b6939bc782c33180b6.jpeg) ---
**Author:** ![Max\_Hosel](https://avatars.discourse-cdn.com/v4/letter/m/9fc348/32.png) [@Max\_Hosel](https://forum.ansible.com/u/Max_Hosel)\ **Post date:** [February 10, 2022, 11:05pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314/4 "2022-02-10T23:05:43Z")
Glad to hear I’m not the only one experiencing this, seems like it might a recent breakage in ansible-devel or something along those lines? Either way, something is breaking in the Control Plane EE, and while my solution is far from ideal, at least I can sync projects again: 1. Fork the AWX-EE repository on GitHub ([https://github.com/ansible/awx-ee](https://github.com/ansible/awx-ee)) 2. Adjust the Dockerfile by changing the EE\_BASE\_IMAGE and EE\_BUILDER\_IMAGE variables to point to a fixed release: ARG EE\_BASE\_IMAGE=[quay.io/ansible/ansible-runner:stable-2.11-latest](http://quay.io/ansible/ansible-runner:stable-2.11-latest) ARG EE\_BUILDER\_IMAGE=[quay.io/ansible/ansible-builder:stable-2.11-latest](http://quay.io/ansible/ansible-builder:stable-2.11-latest) As far as I know, this should force the AWX Control Plane stuff (like project updates) to run with a fixed, older Ansible version. I don’t think this is at all indented by the AWX team, but oh well. 1. Build that EE image and push it to some registry/upload it to your k8s cluster 2. Adjust your AWX deployments spec and add your custom Control Plane EE like so: apiVersion: [awx.ansible.com/v1beta1](http://awx.ansible.com/v1beta1) kind: AWX metadata: … spec: control\_plane\_ee\_image: [quay.io/your-custom/awx-ee](http://quay.io/your-custom/awx-ee) … other spec parameters Again, I don’t think this is a proper solution, just a hack to get up and running. But it’s better than nothing. I also don’t think it’s possible to achieve this via the UI, you need to change the operator deployment definition (see: [https://github.com/ansible/awx-ee/issues/72](https://github.com/ansible/awx-ee/issues/72)) Alternatively, you could probably use an older version of the official AWX EE (the tags are available here: [https://quay.io/repository/ansible/awx-ee?tab=tags](https://quay.io/repository/ansible/awx-ee?tab=tags)), but I haven’t tried that personally. ---
**Author:** ![Andrew\_Mulheirn](https://avatars.discourse-cdn.com/v4/letter/a/7993a0/32.png) [@Andrew\_Mulheirn](https://forum.ansible.com/u/Andrew_Mulheirn)\ **Post date:** [February 11, 2022, 1:29pm UTC](https://forum.ansible.com/t/project-sync-ssh-issues-on-brand-new-awx-instance/36314/5 "2022-02-11T13:29:44Z")
Hi Max, Thanks for taking the time to document your solution. I managed to fix it in a different way. I realised that the container was not trusting [gitlab.com](http://gitlab.com) and maybe it was asking a question about whether to trust it but that was not being displayed in AWX. So I started a shell and tried to clone the repo there, and sure enough, it asked whether I wanted to trust it. I said yes. The clone added the [gitlab.com](http://gitlab.com) host to the list of known hosts, then failed because I’m not using the right SSH key at the bash shell. However since then, it works in AWX! Here’s the output from my session: USER@ip-172-29-247-100:~$ kubectl get pods NAME READY STATUS RESTARTS AGE awx-operator-controller-manager-66d6589d78-r5hwc 2/2 Running 0 25h awx-postgres-0 1/1 Running 0 25h awx-76dc548cb-jfhts 4/4 Running 0 25h USER@ip-172-29-247-100:~$ kubectl exec -it awx-76dc548cb-jfhts /bin/bash -c awx-ee kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] – [COMMAND] instead. bash-4.4$ pwd /runner bash-4.4$ git clone [git@gitlab.com](mailto:git@gitlab.com):USER/REPO.git Cloning into ‘REPO’… The authenticity of host ‘[gitlab.com](http://gitlab.com) (172.65.251.78)’ can’t be established. ECDSA key fingerprint is SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes **Warning: Permanently added ‘[gitlab.com](http://gitlab.com),172.65.251.78’ (ECDSA) to the list of known hosts.** [git@gitlab.com](mailto:git@gitlab.com): Permission denied (publickey,keyboard-interactive). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists. bash-4.4$ Hope this helps… Cheers, Andy