Gitlab server cert fix

defaults/main.yml

@@ -25,7 +25,8 @@ gitlab_runner_check_interval: 0
 
 # GitLab coordinator URL
 gitlab_runner_coordinator_url: https://gitlab.com
-# GitLab registration token
+
+# GitLab registration token.
 gitlab_runner_registration_token: ""
 
 # Gitlab runner registration token type:
@@ -37,11 +38,8 @@ gitlab_runner_registration_token_type: "registration-token"
 
 gitlab_runner_sentry_dsn: ""
 
-# GitLab server IP
-gitlab_server_ip: ""
-
 # GitLab TLS CA file
-tls_ca_file: ""
+tls_ca_file: "/etc/pki/ca-trust/source/anchors/gitlab-server.crt"
 
 # Prometheus Metrics & Monitoring
 gitlab_runner_listen_address: ""
@@ -118,6 +116,8 @@ gitlab_runner_runners:
     # The executor used by the runner.
     executor: shell
     # Set maximum build log size in kilobytes.
+    # token:
+    # Set maximum build log size in kilobytes.
     output_limit: 4096
     # Maximum number of jobs to run concurrently on this specific runner.
     # Defaults to 0, simply means don't limit.

tasks/register-runner.yml

@@ -1,13 +1,28 @@
 ---
-- name: Accept gitlab server self signed cert as valid CA
-  ansible.builtin.shell: >
-    set -o pipefail
+# - name: Accept gitlab server self signed cert as valid CA
+#   ansible.builtin.shell: >
+#     set -o pipefail
+
+#     openssl s_client -connect {{ gitlab_runner_coordinator_url | regex_replace('https?:\/\/([^\/]+)\/?.*', '\\1') }}:443 -showcerts </dev/null 2>/dev/null |
+#     sed -e '/-----BEGIN/,/-----END/!d' | tee {{ tls_ca_file }} >/dev/null
+#   args:
+#     executable: /usr/bin/bash
+#   when: force_accept_gitlab_server_self_signed
 
-    openssl s_client -connect {{ gitlab_server_ip }}:443 -showcerts </dev/null 2>/dev/null |
-    sed -e '/-----BEGIN/,/-----END/!d' | tee {{ tls_ca_file }} >/dev/null
-  args:
-    executable: /usr/bin/bash
+- name: Accept gitlab server self signed cert as valid CA
   when: force_accept_gitlab_server_self_signed
+  block:
+    - community.crypto.get_certificate:
+        host: "{{ gitlab_runner_coordinator_url | regex_replace('https?:\/\/([^\/]+)\/?.*', '\\1') }}"
+        port: 443
+        asn1_base64: true # need to hard code to prevent depreciation warning
+      register: gitlab_server_cert
+    - name: Save the GitLab server self signed cert to the default CA path
+      ansible.builtin.copy:
+        content: "{{ gitlab_server_cert.cert }}"
+        dest: "{{ tls_ca_file }}"
+    - name: Update CA bundle with self signe cert of the gitlab server
+      ansible.builtin.import_tasks: update-ca-bundle.yml
 
 - name: Update CA bundle with self signe cert of the gitlab server
   ansible.builtin.import_tasks: update-ca-bundle.yml