Ansible 2.11 and Python 3.9 Compatibility

[sujit-jadhav]

The python38 module and versions of python higher than 3.8 does not include the same bindings to system tools -RPM, DNF, SELinux, and firewalld that are provided for the python36 module in CentOS.
As a result, playbooks handling installation of packages, adding ports to firewall and handling selinux policies throw errors.
But these modules (dnf, firewalld, selinux ) are an essential for Omnia workflow. So the users are compelled to install python3.6 using dnf on Centos.
On the Redhat site, the same is mentioned- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_basic_system_settings/using-python3_configuring-basic-system-settings

[DeepikaKrishnaiah]

To use dnf, firewalld and selinux package one needs to use python3 interpreter.
The same is mentioned here, https://github.com/ansible-collections/ansible.posix/blob/main/docs/ansible.posix.firewalld_module.rst
According to the above mentioned link, firewalld Requires the python2 bindings of firewalld, which may not be installed by default. For distributions where the python2 firewalld bindings are unavailable (e.g Fedora 28 and later) you will have to set the ansible_python_interpreter for these hosts to the python3 interpreter path and install the python3 bindings.

So we will have to compel the user to use python3.6 and install the same using dnf. And ansible version 2.9 or 2.10.

[lwilson]

Will this be a problem moving from CentOS7 to CentOS/RockyLinux 8? We've already begun the process of being able to deploy on RHEL8 clones (see #314 and #315). Do we know if Ansible 3 has workarounds for this problem?

[DeepikaKrishnaiah]

We cannot proceed with Centos7.9. The reasons are, Centos7 depends on python2.7 which has attained EOL and support for the same would be removed. Also ansible has deprecated many modules of docker, so we have to use python_interpreter3 to use those modules. So porting to Centos8 is inevitable.
In Centos8, if python3.6 is installed using dnf package manager, the python bindings supporting dnf, firewalld and selinux are provided.
But if any other versions>3.6 is installed from source (since dnf install python is not provided), the above mentioned python bindings are absent. As a workaround (if user installs python version >3.6 to have ansible 2.11) since the python bindings of dnf, firewalld and other such modules are not provided, the specific module can be made to pick ansible_python_interpreter3. In this case we have to make sure python3.6 is also installed using dnf along with other python versions.

[lwilson]

Makes sense. I agree the move to a RHEL8 clone is inevitable (whether it's CentOS or RockyLinux is still up for debate). If the user sticks with the default system python installation, it should be 3.6, correct? In that case we should simply list python==3.6 as a requirement.

As RHEL bumps up the system python version, we may have to re-evaluate. The Ansible team will be tracking those changes, as well.

[DeepikaKrishnaiah]

In CentOS 8.3, python is not installed by default. The user has to install python using dnf install python3 (And python3.6.8 would be installed). This has all the necessary python bindings to support the modules which we use in ansible.
We can update the python version support as 3.6 in our install guide.

[lwilson]

There is a system python that gets installed (it's needed for dnf) and should be 3.6. I did an Omnia deploy on CentOS 8.3 without any additional setup on the host.

All I had to fix was the name of elrepo, which I resolved in #314.