Outils pour utilisateurs

Outils du site


blog

Notes gitlab - certificats CA

cp -p *.crt /usr/local/share/ca-certificates/
update-ca-certificates
# curl -I https://arty.acme.local
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
# curl --cacert /usr/local/share/ca-certificates/acme-subca1.crt -I https://arty.acme.local
HTTP/1.1 200 OK
...
# wget https://arty.acme.local
--2026-06-11 11:41:00--  https://arty.acme.local/
Resolving arty.acme.local (arty.acme.local)... 10.245.208.69, 10.245.208.36
Connecting to arty.acme.local (arty.acme.local)|10.245.208.69|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 23381 (23K) [text/html]
Saving to: ‘index.html’

index.html                                           100%[====================================================================================================================>]  22.83K  --.-KB/s    in 0.02s

2026-06-11 11:41:00 (1.00 MB/s) - ‘index.html’ saved [23381/23381]
# which curl
/opt/gitlab/embedded/bin/curl
# cat /opt/gitlab/etc/gitaly/env/SSL_CERT_DIR  ; echo
/opt/gitlab/embedded/ssl/certs/

# cat /opt/gitlab/embedded/ssl/certs/README
This directory is managed by omnibus-gitlab.
 Any file placed in this directory will be ignored
. Place certificates in /etc/gitlab/trusted-certs.

# ls -l /etc/gitlab/trusted-certs
total 0

Solution

cp -p /usr/local/share/ca-certificates/* /etc/gitlab/trusted-certs/

Redémarrer Gitlab

FIXME

2026/06/18 11:42 · Jean-Baptiste

Notes Gitlab-ci pipeline - API

Exemple 1 - avec Access Token ou Personnal Access tokens

Avec Access Token (associé au projet)

  • Aller dans le projet - puis : Settings / Access tokens
  • Attention : par défaut les Access Tokens ont une date d'expiration

Avec Personnal Access tokens (associé au compte utilisateur)

  • Profile / Edit profile / Access Token / Personal Access Tokens
  • Attention : par défaut les Personal Access Tokens ont une date d'expiration

Launch pipeline with API call - with Private / Personal access tokens

curl --request POST \
  --header "PRIVATE-TOKEN: saltxx-8888888888" \
  --header "Content-Type: application/json" \
  --data '{ "ref": "master", "variables": [ {"key": "VAR1", "value": "plop"}, {"key": "VAR2", "value": "plop"}, {"key": "VAR3", "value": "plop"}, {"key": "VAR4", "value": ""} ] }' \
  --url "${CI_API_V4_URL}/projects/100/pipeline"

Voir https://docs.gitlab.com/api/rest/

Notes

CI_API_V4_URL est une variable magique dont la valeur est de la forme : http://gitlab.acme.local/api/v4

Dans notre cas la variable ref correspond au nom de la branche

Exemple 2 - Avec Trigger Tokens

Voir :

Voir aussi :

Aller dans le projet, puis Settings/ CI/CD / Pipeline trigger tokens

Trigger pipeline with the API / Pass CI/CD variables in the API call

curl --request POST \
     --form token=glptt-99999999999999 \
     --form ref=master \
     --form "variables[VAR1]=plop" \
     --form "variables[VAR2]=plop" \
     --form "variables[VAR3]=plop" \
     --form "variables[VAR4]=plop" \
     "${CI_API_V4_URL}/projects/100/trigger/pipeline"  

Avec Ansible

.gitlab-ci.yml

launch:
  tags:
    # - gitlab-runner-sh-001
    - gitlab-runner-docker-001
  image: registry.acme.local/repository/local-docker/ansible-builder:0.0.4
  stage: build
  script: ansible-playbook play-launch-ci.yml -e url="${CI_API_V4_URL}" -e token="${TRIGGER_TOKEN}"

play-launch-ci.yml

#! /usr/bin/env ansible-playbook
 
---

- name: Launch CI
  gather_facts: false
  hosts: localhost

  vars:
    branch: "{{ lookup('env', 'BRANCH') }}"
    line: "{{ lookup('env', 'LINE') }}"
    kind: "{{ lookup('env', 'KIND') }}"

  tasks:
    - name: Assert check environment vars are correctly defined
      ansible.builtin.assert:
        that:
          - url is defined and url != ''
          - token is defined and token != ''
          - branch is defined and branch != ''
          - line is defined and line != ''
          - kind is defined and kind != ''
        msg: "Env var must be defined"

    - name: Call API
      # no_log: true
      register: reg_uri
      until: reg_uri.status == 201
      retries: 3
      delay: 5    # Every 5 seconds
      ansible.builtin.uri:
        url: "{{ url }}/projects/100/trigger/pipeline"
        # validate_certs: false
        status_code: 201
        follow_redirects: none
        method: POST
        body_format: json
        headers:
          Content-Type: "application/json"
        body: |
          {
            "ref": "main",
            "token": "{{ token }}",
            "variables": {
              "BRANCH": "{{ branch }}",
              "KIND": "{{ kind }}",
              "LINE": "{{ line }}"
            }
          }

Voir https://docs.gitlab.com/ci/triggers/

Autres
000-colo-switch:prod:
  stage: deploy
  variables:
    PROJECT: "projectname"
  rules: # whether to include the job in the pipeline
    - if: $CI_PIPELINE_SOURCE == "trigger"
      when: always
    - when: never

Source: https://forum.gitlab.com/t/triggering-a-specific-job-of-the-pipeline-via-api/42397/2

2026/06/17 17:27 · Jean-Baptiste

PKI - CA - Cert - Ajouter une autorité de certification

Source : https://gist.github.com/cmwylie19/39da645a979d9f514402c67619ae1b45

Voir aussi :

Adding trusted root certificates to the server

Linux (Ubuntu, Debian)

apt install ca-certificates
# Copy your CA to dir /usr/local/share/ca-certificates/
sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt
sudo update-ca-certificates
# To remove/rebuild
sudo update-ca-certificates --fresh

Linux (CentOS 6)

yum install ca-certificates
#Enable the dynamic CA configuration feature:
update-ca-trust force-enable
 
#Add it as a new file to /etc/pki/ca-trust/source/anchors/:
cp foo.crt /etc/pki/ca-trust/source/anchors/
 
update-ca-trust extract

Linux (CentOS 5)

#Append your trusted certificate to file /etc/pki/tls/certs/ca-bundle.crt
cat foo.crt >> /etc/pki/tls/certs/ca-bundle.crt

Mac OS X

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/new-root-certificate.crt
sudo security delete-certificate -c "<name of existing certificate>"

windows

certutil -addstore -f "ROOT" new-root-certificate.crt
certutil -delstore "ROOT" serial-number-hex

Ajouter une CA

Voir :

curl http://satellite.example.com/pub/katello-server-ca.crt -o /etc/pki/ca-trust/source/anchors/satellite-ca.crt
 
update-ca-trust

FIXME

2026/06/11 15:14 · Jean-Baptiste

Pb DNS bind9

Err - address not available resolving

18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:503:c27::2:30#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:7fd::1#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:200::b#53
18-Nov-2025 04:23:26.860 address not available resolving 'ecs.office.com/A/IN': 2001:500:12::d0d#53
Solution

Pb IPv6. Il faut lancer le daemon avec l'option -4

Err - resolver priming query complete: timed out

10-Jun-2026 17:02:54.990 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)                                                 17:04:24 [18/1937]10-Jun-2026 17:02:54.990 managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete)
10-Jun-2026 17:03:04.986 resolver priming query complete: timed out
10-Jun-2026 17:03:11.222 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.1#53
10-Jun-2026 17:03:11.234 chase DS servers resolving 'platform.aws.gts/DS/IN': 192.168.10.2#53
10-Jun-2026 17:03:21.192 resolver priming query complete: timed out
10-Jun-2026 17:03:21.219 broken trust chain resolving 'z1.acme.local/A/IN': 192.168.10.1#53

Solution : Ajouter dnssec-validation no;

named.conf

options {
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-validation no;
    allow-recursion { trusted; };
    allow-query { trusted; };
};

DNSSEC resolution on BIND in 'forwarder' mode fails with SERVFAIL or 'broken trust chain' errors

Source : https://access.redhat.com/solutions/5633621

BIND server fails with resolution of DNSSEC addresses.

The logs contain following errors:

broken trust chain resolving 'DDD.CCC.BBB.AAA.in-addr.arpa/PTR/IN'

client ... (DDD.CCC.BBB.AAA.in-addr.arpa): view internal: query failed (SERVFAIL) for DDD.CCC.BBB.AAA.in-addr.arpa/IN/PTR at ../../../bin/named/query.c:8580

Deactivation of DNSSEC resolution restores main DNS functionality:

dnssec-enable no;
dnssec-validation no;

Note : Il suffit parfois de dnssec-validation no;

Autres

options {
    minimal-responses yes;
    edns-udp-size 512;
 
    dnssec-validation auto;
};

FIXME

2026/06/10 17:43 · Jean-Baptiste
blog.txt · Dernière modification : de 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki