Erro AWX X509 usando imagem EE personalizada com pyopenssl

Atualmente, estou configurando uma plataforma AWX hospedada no cluster K8s para obter recursos de UI + adequados para fins multiusuários.

Contexto:
criei uma imagem EE enviada em um repositório Nexus que o AWX usa para ter todas as coleções de galáxias ansible que os projetos Ansible precisam (nutanix.ncp, community.hashi_vault, community.windows e ansible.windows) + módulos pip (ansible -pylibssh, hvac, paramiko, pexpect, pykerberos, pywinrm, criptografia, pyopenssl).

A criação de imagens EE e push/pull estão ok. Se necessário, posso compartilhar os arquivos requisitos.yml e requisitos.txt.

Aqui está o execução-environment.yml para referência:

---
version: 1

build_arg_defaults:
  EE_BASE_IMAGE: 'quay.io/ansible/awx-ee:latest'

dependencies:
  galaxy: requirements.yml
  python: requirements.txt

additional_build_steps:
  prepend: |
    RUN python3 -m pip install --upgrade pip
    RUN pip3 install --upgrade pip setuptools
    RUN whoami
    RUN cat /etc/os-release

  append:
  - RUN ls -la /etc

Então, quando configuro um projeto no AWX usando esta imagem EE, ele falha no erro X509_V_FLAG_CB_ISSUER_CHECK:

{
  "module_stdout": "",
  "module_stderr": "Traceback (most recent call last):\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 107, in <module>\n    _ansiballz_main()\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 99, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 47, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', init_globals=dict(_module_fqn='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', _modlib_path=modlib_path),\n  File \"/usr/lib64/python3.8/runpy.py\", line 207, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib64/python3.8/runpy.py\", line 97, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/usr/lib64/python3.8/runpy.py\", line 87, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/modules/ntnx_subnets_info.py\", line 188, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/subnets.py\", line 9, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/clusters.py\", line 7, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/prism.py\", line 5, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/entity.py\", line 13, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible/module_utils/urls.py\", line 115, in <module>\n  File \"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py\", line 46, in <module>\n    import OpenSSL.SSL\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/__init__.py\", line 8, in <module>\n    from OpenSSL import crypto, SSL\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1517, in <module>\n    class X509StoreFlags(object):\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1537, in X509StoreFlags\n    CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK\nAttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'\n",
  "exception": "Traceback (most recent call last):\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 107, in <module>\n    _ansiballz_main()\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 99, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)\n  File \"/root/.ansible/tmp/ansible-tmp-1694504214.889407-61-240849331705059/AnsiballZ_ntnx_subnets_info.py\", line 47, in invoke_module\n    runpy.run_module(mod_name='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', init_globals=dict(_module_fqn='ansible_collections.nutanix.ncp.plugins.modules.ntnx_subnets_info', _modlib_path=modlib_path),\n  File \"/usr/lib64/python3.8/runpy.py\", line 207, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/lib64/python3.8/runpy.py\", line 97, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/usr/lib64/python3.8/runpy.py\", line 87, in _run_code\n    exec(code, run_globals)\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/modules/ntnx_subnets_info.py\", line 188, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/subnets.py\", line 9, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/clusters.py\", line 7, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/prism/prism.py\", line 5, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible_collections/nutanix/ncp/plugins/module_utils/entity.py\", line 13, in <module>\n  File \"<frozen importlib._bootstrap>\", line 991, in _find_and_load\n  File \"<frozen importlib._bootstrap>\", line 975, in _find_and_load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 655, in _load_unlocked\n  File \"<frozen importlib._bootstrap>\", line 618, in _load_backward_compatible\n  File \"<frozen zipimport>\", line 259, in load_module\n  File \"/tmp/ansible_ntnx_subnets_info_payload_mpaf5bgi/ansible_ntnx_subnets_info_payload.zip/ansible/module_utils/urls.py\", line 115, in <module>\n  File \"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py\", line 46, in <module>\n    import OpenSSL.SSL\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/__init__.py\", line 8, in <module>\n    from OpenSSL import crypto, SSL\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1517, in <module>\n    class X509StoreFlags(object):\n  File \"/usr/local/lib/python3.8/site-packages/OpenSSL/crypto.py\", line 1537, in X509StoreFlags\n    CB_ISSUER_CHECK = _lib.X509_V_FLAG_CB_ISSUER_CHECK\nAttributeError: module 'lib' has no attribute 'X509_V_FLAG_CB_ISSUER_CHECK'\n",
  "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
  "rc": 1,
  "_ansible_no_log": false,
  "changed": false
}

Testes: Tentei os seguintes testes para tentar resolver:

• obtenha a versão mais recente de criptografia e pyopenssl
• faça downgrade da criptografia para 36.0.2/37.0.0 e da versão pyopenssl para 22.0.0, conforme visto em algumas postagens do stackoverflow
• EXECUTAR atualização pip3 no bloco adicional_build_steps > prepend na criação da imagem

Além disso, há algo que não entendo:
vi que o log de erros menciona o arquivo.\"/usr/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py Mas quando executo um shell, a imagem do docker não há pasta /usr/lib/python3.8, mas python3.9.

Perguntas: Quando faço login nos pods AWX, descobri que apenas o pod awx-operator-controller-manager que obteve esse caminho python3.8. Então, qual é a relação entre pods AWX/imagem EE ao tentar executar um projeto?

Sobre o pyopenssl, que outros testes/soluções posso testar?

Obrigado !