github.com is not resolvable

[geoffritter]

When attempting to sync the demo project, I receive:
"Cloning into '/var/lib/awx/projects/_6__demo_project'...\nfatal: unable to access https://github.com/ansible/ansible-tower-samples/': Could not resolve host: github.com\n"

It might be helpful to allow a dns override or automatically use whatever DNS servers the host system is using. I suspect I'll get similar results attempting to point to git servers hosted within my own network.

[alqu]

Hm, same problem here. I tried to checkout another repo.

I tried it out on a CentOS 8 minimal machine.

[ikke-t]

something must have changed on the AWX side, I don't recall changing anything related to this.

[alqu]

I tried the same on a CentOS 7 machine - and it worked flawlessly.

[geoffritter]

possibly related? containers/podman#2383
I wasn't able to verify if that change made it to the version used by centos 8.
But it looks like some things did change regarding defaults for the dns settings within libpod it self.

[alqu]

@geoffritter seems like it.
I had no chance, to look closer at that issue, but it sounds familiar.

[Klaas-]

I think this is related to this issue: containers/podman#5335

[cfelder]

This is not an awx_pod issue.

I also stumbled across this on CentOS 8. This is related to CNI configuration of podman. When firewalld is enabled. Basically name resolution does not work whereas routing works fine when using ips directly. This is fixed upstream.

For further discussion see containers/podman#5568 which references containers/podman#5335 as well.

[geoffritter]

So.... not an issue with awx_pod then?

For Centos 8, it looks like the work around is to edit the default podman network interface and add firewalld as the backend?

/etc/cni/net.d/87-podman-bridge.conflist

[...]
},
{
  "type": "firewall",
  "backend": "firewalld"
}
[...]

Another, probably bad, option that worked was to add the podman interface to the trusted zone on the host firewall.

Quick test for dns resolution inside container.
podman run -it --rm centos ping -c 1 google.com

[ikke-t]

Yes, I run into the same a while back, and made an issue to podman. With their help it turned out it's the mis-detection of firewall. I fixed it for myself like you just wrote, by forcing firewalld. It's supposedly fixed in rhel/centos 8.2

[Klaas-]

I can confirm it's fixed in 8.2, the 'official' fix is not forcing firewalld but removing the backend line and let podman detect it.