Question: Adding a CA to the Ansible python env

[gaspode]

Question

I'm using the docker version of Semaphore. We have an SSL-scanning firewall which means we have to add the CA certificate to all hosts. I mounted the host's /etc/ssl/certs directory to the same location in the docker container and this means Semaphore is now able to pull the repository without an SSL error.

However, when I try running a playbook, it throws an SSL error trying to connect to AWS. I need some way of adding a CA cert to the bundle in the venv that certifi uses. Alternatively, I need some way of specifying additional python packages that should be installed into the venv (as I can then create a package that adds the cert)

Any suggestions?

Related to

No response

[gaspode]

Used hacky bodge for now. The host has the required certs so mounted /etc/ssl/certs:/etc/ssl/certs and changed the entrypoint to :

cp /etc/ssl/certs/ca-certificates.crt /opt/semaphore/apps/ansible/11.1.0/venv/lib/python3.11/site-packages/certifi/cacert.pem && exec /sbin/tini -- /usr/local/bin/server-wrapper

It's nasty and I feel dirty but it'll do for now.