Markus markuskreitzer

Configuring OpenAI Codex CLI with Azure OpenAI: A Working Solution

If you've been trying to get OpenAI's Codex CLI working with Azure OpenAI Service, you're not alone in facing configuration headaches. The ongoing transition at Azure, combined with inconsistent documentation and API version differences, can make this setup feel like navigating a maze blindfolded.

After countless hours of debugging 404 errors, stream failures, and authentication issues, here's a working configuration that actually works with Azure AI Foundry and GPT-4o.

The Challenge

The Codex CLI documentation provides a basic Azure configuration example, but the reality is more complex:

You can use the following syntax:

getcerts google.com 443
getcerts google.com

Place the following line in your aliases file:

alias getcerts='function _getcerts() { echo | openssl s_client -connect "${1}:${2:-443}" | sed -n "/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p"; }; _getcerts '

Deploying Ollama and OpenWebUI to Kubernetes

Deployment Order

Create the PVs and PVCs for ollama and open-webui.
Deploy the ollama Deployment and Service.
Deploy the open-webui Deployment and Service.
Finally, apply the Ingress for open-webui.

kubectl apply -f ollama-pv.yaml

Sync Time on Linux

Some quirky systems out there doesn't have the usual utilities to sync time. If they have access to the internet, here's a quick way. I found this somewhere on the internet, but don't remember where.

DATE=$(wget -qSO- --max-redirect=0 google.com 2>&1 | grep Date: | cut -d' ' -f5-8)
sudo date -s "${DATE}Z"

Running Ollama on Docker Compose

Assuming you start with a vanilla Ubuntu, you need to install Nvidia stuff

Add Nvidia apt registries:

curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
  && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
    sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list

Create a secure SSH server with a static IP or DNS entry. It is important to set up keys and cache public key of destination server prior to these steps. There are many guides on doing this, so we'll skip over those.

The Script

Create a script with the following content. You can save it as /root/revese_ssh.sh for this example.

#!/usr/bin/env bash

REMOTE_PORT=22

	#!/bin/sh

	echo "Running Checks..."
	poetry run flake8 src tests \
	&& poetry run black src tests \
	&& poetry run isort src tests \
	&& poetry run pytest \
	&& poetry run bandit src \
	&& poetry run pip-audit . \
	&& poetry run mypy src tests

	import re
	from typing import List, Tuple
	import requests
	from pathlib import Path
	from ollama import AsyncClient
	import asyncio
	from tqdm import tqdm
	import sys
	import json

	import gitlab
	import argparse
	from typing import Iterable

	def fix_cicd(project: Project, replacements:Iterable, branch='gitlab-ultimate-migration'):
	f = project.files.get('.gitlab-ci.yml', ref=branch)
	f_new = f.content
	for replacement in replacements:
	f_new.replace(replacement[0], repalcement[1])

	version: '3.6'
	services:
	web:
	image: 'gitlab/gitlab-ee:latest'
	platform: 'linux/amd64'
	restart: always
	hostname: 'g.example.dev'
	environment:
	GITLAB_OMNIBUS_CONFIG: \|
	external_url 'https://g.example.dev:8443'