Pipenv

changelog/fragments/use-pipenv-for-python-package-installation.yaml

@@ -0,0 +1,10 @@
+entries:
+  - description: >
+      For Ansible-based operators, Python package installation in the Docker
+      image is delegated to a pipenv managed Pipfile and Pipfile.lock, pinning
+      both the main installed packages and their subdependencies. This prevents
+      installing conflicting (sub)dependencies
+
+    kind: change
+
+    breaking: false

images/ansible-operator/Dockerfile

@@ -10,21 +10,22 @@ ENV HOME=/opt/ansible \
     USER_NAME=ansible \
     USER_UID=1001
 
-# Install python dependencies
+# Copy python dependencies specs to be installed using Pipenv
+COPY Pipfile* ./
+# Instruct pip(env) not to keep a cache of installed packages,
+# to install into the global site-packages and
+# to clear the pipenv cache as well
+ENV PIP_NO_CACHE_DIR=1 \
+    PIPENV_SYSTEM=1 \
+    PIPENV_CLEAR=1
 # Ensure fresh metadata rather than cached metadata in the base by running
 # yum clean all && rm -rf /var/yum/cache/* first
 RUN yum clean all && rm -rf /var/cache/yum/* \
   && yum -y update \
-  && yum install -y libffi-devel openssl-devel python38-devel gcc python38-pip python38-setuptools \
-  && pip3 install --no-cache-dir \
-    ansible-runner==1.3.4 \
-    ansible-runner-http==1.0.0 \
-    ipaddress==1.0.23 \
-    kubernetes==10.1.0 \
-    openshift==0.10.3 \
-    ansible==2.9.15 \
-    jmespath==0.10.0 \
-  && yum remove -y gcc libffi-devel openssl-devel python38-devel \
+  && yum install -y python38-pip \
+  && pip3 install pipenv==2020.11.15 \
+  && pipenv install --deploy \
+  && pipenv check \
   && yum clean all \
   && rm -rf /var/cache/yum
 

images/ansible-operator/Pipfile

@@ -0,0 +1,17 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+ansible-runner = "==1.4.6"
+ansible-runner-http = "==1.0.0"
+ipaddress = "==1.0.23"
+openshift = "==0.11.2"
+ansible = "==2.9.15"
+jmespath = "==0.10.0"
+
+[dev-packages]
+
+[requires]
+python_version = "3.8"