👋 Introduction

In this section, we will create an execution environment using ansible-builder.

For this challenge, we are going to fix the SSL errors that we faced in the last challenge properly instead of just ignoring the certificate errors.

A quick note before we dive in — the editor we are using is VS Code and it may be unfamiliar for some folks. We will keep the instructions simple enough and gradually build upon what we are doing in each challenge. If you are confused at any time, there is a folder called solution-definition adjacent to execution-environment.yml which will have the solution for each challenge. You can copy and replace content for your current definition file if you are unable to solve any YAML errors.

Please go through the tasks in this challenge to understand how to interact with ansible-builder v3.

☑️ Task - Definition file from last challenge

On the VS Code tab on the left side you will see that we have a tab called "file." Click File→Open folder and select the directory opened called minimal-downstream-from-hub-certs and this directory has a file called execution-environment.yml.

This file is the same as the one we created from the last challenge when we pulled the collection from Automation Hub. This will be the starting point for this challenge, and we will fix the SSL error from the last challenge without using a workaround.

For this task, just verify the content of the definition file to ensure that it matches with what we learned in the last challenge.

☑️ Task - Intermediate certificate file

We have created a cert.pem file that is the intermediate certificate needed to do SSL verification. It is placed in the files directory adjacent to the execution-environment.yml file.

Our challenge is to inform ansible-builder about this file and add this file to the correct location in the execution environment. This way, the builder will be able to download the collections without SSL verification errors.

☑️ Task - Remove the workaround from the last challenge

Firstly, we will remove the workaround that we added to ignore certificates from our definition file.

Go ahead and remove the following lines from the execution-environment.yml file:

build_arg_defaults:
  ANSIBLE_GALAXY_CLI_COLLECTION_OPTS: '--ignore-certs'

Once removed, you can either try to replicate the error again or just move ahead to the next task. To replicate, run the following command in the terminal:

ansible-builder build -v 3

☑️ Task - Add the certificate to our definition file

Our task is to add the cert.pem file to our execution environment. To do so, we want to create a section like the prepend_galaxy section in our definition file.

This section is called prepend_base and it is another stage in our execution environment creation. As this is a certificate addition, we want to do this at an initial stage, and base is the exact right spot to do so.

Do the following changes in your execution-environment.yml below the prepend_galaxy section:

prepend_base:
  - COPY _build/configs/cert.pem /etc/pki/ca-trust/source/anchors/
  - RUN update-ca-trust

This section is part of the additional_build_steps section in the definition file. After the addition, your section should look like this:

additional_build_steps:
  prepend_galaxy:
    - COPY _build/configs/ansible.cfg /etc/ansible/ansible.cfg
  prepend_base:
    - COPY _build/configs/cert.pem /etc/pki/ca-trust/source/anchors/
    - RUN update-ca-trust

You must be wondering if this is the initial stage, why are we adding this below the prepend_galaxy stage? You can do this because the definition schema is a YAML dictionary — the name matters instead of the position. You can try changing the position of these sections and check the behavior of ansible-builder.

☑️ Task - Let’s try our fix

Now that you have added the fix for the certificate, let’s try rebuilding our execution environment.

Run the following command:

ansible-builder build -v 3

Hopefully, if you have done everything correctly, you should have your new execution environment.

☑️ Task - Let’s check what’s built

Run the following command to check the image that was created:

podman images

You will see that it builds an execution environment called localhost/ansible-execution-env by default. This is our execution environment built with the collection we need from Automation Hub with the certificate fix.

You can tag the image post-build if you want, using the Podman CLI:

podman tag localhost/ansible-execution-env localhost/netcommon-hub-cert-ee

Hurray! You have now created an execution environment with a collection from Automation Hub by fixing the certificate error.

☑️ Task - Let’s push this EE to Automation Hub

Automation Hub also acts as a registry to store your custom execution environments. To push this execution environment to Automation Hub, you need to first tag the EE with a new name and address of the Automation Hub. Run the following commands:

podman login control.lab --tls-verify=false

Username: admin Password: ansible123!

Tag your local image:

podman tag localhost/ansible-execution-env control.lab/netcommon-hub-cert-ee

Push image to Automation Hub:

podman push control.lab/netcommon-hub-cert-ee --tls-verify=false

Let’s verify if the image is pushed to Automation Hub:

Go to the Automation Hub tab
Login using the below credentials Username: admin Password: ansible123!
Go to the Execution Environments section on the left-hand side and you should see the recent execution environment pushed to Automation Hub.

✅ Next Challenge

Press the Next button below to go to the next challenge once you’ve completed the tasks.

🐛 Encountered an issue?

If you have encountered an issue or have noticed something not quite right, please open an issue:

https://github.com/ansible/workshops/issues