Add root and intermediate CA creation with GitLab TLS support

[embtom]

No description provided.

[Copilot]

🟡 Changes recommended

The GitLab Omnibus TLS settings appear mis-scoped in gitlab.rb.j2 (likely ignored) and the runner service task now restarts the runner on every run, which is operationally disruptive.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a local PKI workflow (root + intermediate CA) and wires GitLab + GitLab Runner to use PKI-issued TLS, including runner trust injection into the custom runner image.

Changes:

• Introduces an Ansible pki role to generate root/intermediate CAs and a GitLab TLS certificate, plus chain verification.
• Switches GitLab (and registry) to HTTPS and deploys cert/key material into the GitLab service volume.
• Updates GitLab Runner to trust the PKI root CA (runner registration + runtime trust) and adds an image entrypoint to install the CA into the runner image trust store.

File summaries

File	Description
scripts/deploy.py	Skips become password prompting when running only the pki tag.
requirements.yml	Adds community.crypto collection dependency for PKI modules.
containers/gitlab-runner-image/scripts/install-root-ca.sh	Installs a mounted root CA into the container trust store at startup.
containers/gitlab-runner-image/Containerfile.runner	Wires the CA installer as ENTRYPOINT for the runner image.
ansible/roles/pki/tasks/verify_chain.yml	Adds OpenSSL chain verification tasks for intermediate + server cert.
ansible/roles/pki/tasks/root-ca.yml	Generates root CA key/CSR/cert on the controller.
ansible/roles/pki/tasks/main.yml	Orchestrates PKI role flow (root → intermediate → GitLab cert → verify).
ansible/roles/pki/tasks/intermediate-ca.yml	Generates intermediate CA key/CSR/cert signed by root.
ansible/roles/pki/tasks/gitlab-certificate.yml	Issues a GitLab server certificate signed by the intermediate.
ansible/roles/pki/defaults/main.yml	Defines PKI defaults and output paths on the controller.
ansible/roles/gitlab_service/templates/gitlab.rb.j2	Switches GitLab + registry external URLs to HTTPS and configures cert paths.
ansible/roles/gitlab_service/tasks/volume.yml	Creates TLS dir and deploys cert/key into the GitLab config volume.
ansible/roles/gitlab_service/defaults/main.yml	Adds TLS path defaults and aligns external host with gitlab_external_host.
ansible/roles/gitlab_runner/tasks/service.yml	Adjusts runner systemd management (currently restarts unconditionally).
ansible/roles/gitlab_runner/tasks/register.yml	Adds CA distribution and config updates for TLS runner registration and job trust.
ansible/roles/gitlab_runner/tasks/build_and_ship_image.yml	Switches local image build step to an explicit podman build command.
ansible/roles/gitlab_runner/defaults/main.yml	Updates runner URL to HTTPS and adds CA-related defaults.
ansible/playbooks/gitlab_setup.yml	Ensures PKI role runs (tagged) and defines gitlab_external_host.
.vscode/tasks.json	Adds a VS Code task for running the PKI tag via deploy script.

Review details

• Files reviewed: 19/19 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.