Get up to 50% off on CKA, CKAD, CKS, KCNA, KCSA exams and courses!

Connecting Ansible Tower to Git Server with Self Signed Certificates

Connecting Ansible Tower to Git Server with Self Signed Certificates

So many questioned me when I mention git server in an Ansible Tower environment; and later I realized that, most of them are keeping their projects inside Ansible Tower !!!

Okay, that is just an option in Ansible Tower and Highly NOT Recommended for production setup or for environment with multiple teams accessing the Ansible Tower.

Why Should Not ?

Creating a new Project in Ansible Tower
- You need to give permission for each and every user to this Ansible Tower node and to this directory – `/var/lib/awx/projects` - It won’t be effective when you deploy Ansible Tower as multi-node cluster as you need to update the playbooks and project files in every node, under `/var/lib/awx/projects` - Less control on editing playbooks or files as you have to do everything from CLI (mostly Ansible Tower nodes installs on nodes without GUI) - Other users can easily access other projects and files if you didn’t configure your directory properly. - and many other reasons…

Also Read : How to Add Custom modules in A n sible

Ansible Tower supports most of the common SCM (Source Control Management) technologies as you can see below and yes, the easiest and simple one is using a Git server.

It can be GitHub, GitLab, BitBucket etc but most of the time, enterprise environments will be in a disconnected network – without internet access – and accessing those services will not work. So what, we have so many FREE/OpenSource/Enterprise git server alternatives like GiLab, BitBucket, Gogs etc and we can deploy this in our environment and keep our Ansible playbooks and project files there.

Read : How to install Git Server using Gogs

So, you have deployed a local git server using Gogs or GitLab CE/EE and connected project repos from there.

And you found the there is an error to connect to the git server from Ansible Tower !

{
    "stderr_lines": [
        "fatal: unable to access 'https://$encrypted$:$encrypted$@https://git.lab.local/ansible/dev-proj.git/': Peer's certificate issuer has been marked as not trusted by the user."
    ],
    .
    .
    .
    <truncated...>
    .
    .
    "stderr": "fatal: unable to access 'https://$encrypted$:$encrypted$@https://git.lab.local/ansible/dev-proj.git/': Peer's certificate issuer has been marked as not trusted by the user.\n",
    .
    .
    <truncated...>
    .
    .
    "msg": "fatal: unable to access 'https://$encrypted$:$encrypted$@https://git.lab.local/ansible/dev-proj.git/': Peer's certificate issuer has been marked as not trusted by the user."
}

And yes, most of the organizations will not spend money for CA/SSL Certificates and use self-signed certificates instead; even for Ansible Tower. And sometimes, even with CA Certificate, Ansible tower may not able to validate the Certificate.

And in our case, Ansible Tower cannot verify the certificate authority and shows Peer's certificate issuer has been marked as not trusted by the user Error. So, what is next ?

The Solution

Actually this is very simple, you can easily configure the same in Ansible Tower as EXTRA ENVIRONMENT VARIABLES .

Option 1 – Ignore SSL Verification

You can tell Ansible Tower to ignore the SSL verification as below.

{
  "GIT_SSL_NO_VERIFY": "True"
}

Option 2 – Provide Root Bundle Certificate

You can mention the root bundle Certificate from Certificate Authority

{
 "GIT_SSL_CAINFO": "/etc/custom-ca/bundle-ca.crt",
}

Where Should I Do this ?

Inside Ansible Tower GUI, goto Settings -> Job , and find the EXTRA ENVIRONMENT VARIABLES . Add variable in JSON format and Save it.

Test your project by syncing again and that’s it.

Share :

Related Posts

Ansible Deployment

Ansible Deployment

Hope you are clear on the concept and installation of Ansible program. Lets configure our Ansible environment now.

HashiCorp Certified Terraform Associate – Learning & Exam Tips

HashiCorp Certified Terraform Associate – Learning & Exam Tips

Introduction I started using Terraform somewhere in 2018, but very limited usage as I thought it is just another tool for provisioning infrastructure …

Managing Ansible Inventory

Managing Ansible Inventory

Inventory File An inventory file is a simple and plain text file where we store those host information ansible has to deal with. It can be simple in …

Ansible Tower – How to Backup and Restore

Ansible Tower – How to Backup and Restore

Image Background : datafloq.com Ansible Tower is a wonderful product which help to implement a central hub for IT automation. Ansible Tower is …

Build Your Own Git Server using Gogs

Build Your Own Git Server using Gogs

When it comes to VCS ( Version Control System ), we will have confusion as we have many products in the market with almost the same capabilities. …

Ansible and Jenkins integration – Red Hat Webinar

Ansible and Jenkins integration – Red Hat Webinar

Join this Red Hat webinar to see how to use Jenkins pipelines to deploy simple applications using Ansible Tower.