build,salt,script: Migrate to Salt Python3

Change salt-master image to use Python3 salt-master package and also
install Python3 dependencies, embed Python3 salt-minion version instead
of Python2.

In order to install Python3 salt-minion we need:
- to install python3
- to install python36-rpm as by default version comparaison for package
  installation is wrong
- to install python3 on nodes for being able to use `salt-ssh`

Sees: saltstack/salt#58039
Sees: saltstack/salt#57972
Fixes: #2203

buildchain/buildchain/salt_tree.py

@@ -622,6 +622,7 @@ def _get_parts(self) -> Iterator[str]:
     Path('salt/metalk8s/salt/master/certs/salt-api.sls'),
 
     Path('salt/metalk8s/salt/minion/configured.sls'),
+    Path('salt/metalk8s/salt/minion/dependencies.sls'),
     Path('salt/metalk8s/salt/minion/files/minion-99-metalk8s.conf.j2'),
     Path('salt/metalk8s/salt/minion/init.sls'),
     Path('salt/metalk8s/salt/minion/installed.sls'),

buildchain/buildchain/versions.py

@@ -353,6 +353,7 @@ def deb_full_name(self) -> str:
             version=SHORT_VERSION,
             release='1.el7'
         ),
+        PackageVersion(name='python36-rpm'),
         PackageVersion(name='yum-plugin-versionlock'),
         PackageVersion(name='yum-utils'),
     ),

images/salt-master/Dockerfile

@@ -8,20 +8,20 @@ ARG SALT_VERSION=3000.3
 # Install saltstack
 RUN printf "[saltstack-repo]\n\
 name=SaltStack repo for RHEL/CentOS \$releasever\n\
-baseurl=https://repo.saltstack.com/yum/redhat/\$releasever/\$basearch/archive/%s\n\
+baseurl=https://repo.saltstack.com/py3/redhat/\$releasever/\$basearch/archive/%s\n\
 enabled=1\n\
 gpgcheck=1\n\
-gpgkey=https://repo.saltstack.com/yum/redhat/\$releasever/\$basearch/archive/%s/SALTSTACK-GPG-KEY.pub\n" ${SALT_VERSION} ${SALT_VERSION} >/etc/yum.repos.d/saltstack.repo \
- && rpm --import https://repo.saltstack.com/yum/redhat/7/x86_64/archive/${SALT_VERSION}/SALTSTACK-GPG-KEY.pub \
+gpgkey=https://repo.saltstack.com/py3/redhat/\$releasever/\$basearch/archive/%s/SALTSTACK-GPG-KEY.pub\n" ${SALT_VERSION} ${SALT_VERSION} >/etc/yum.repos.d/saltstack.repo \
+ && rpm --import https://repo.saltstack.com/py3/redhat/7/x86_64/archive/${SALT_VERSION}/SALTSTACK-GPG-KEY.pub \
  && yum clean expire-cache \
  && yum install -y epel-release \
- && yum install -y python-pip \
- && pip install pip==20.1 \
- && pip install "etcd3 != 0.11.0" \
+ && yum install -y python3-pip \
+ && pip3 install pip==20.1 \
+ && pip3 install "etcd3 != 0.11.0" \
  && yum install -y git \
- && pip install "git+https://github.com/kubernetes-client/python.git@cef5e9bd10a6d5ca4d9c83da46ccfe2114cdaaf8#egg=kubernetes" \
+ && pip3 install "git+https://github.com/kubernetes-client/python.git@cef5e9bd10a6d5ca4d9c83da46ccfe2114cdaaf8#egg=kubernetes" \
  && yum remove -y git \
- && pip uninstall -y \
+ && pip3 uninstall -y \
      requests \
      urllib3 \
  && yum install -y salt-master salt-api salt-ssh openssh-clients \

packages/redhat/yum_repositories/saltstack.repo

@@ -1,6 +1,6 @@
 [saltstack]
 name=SaltStack repo for RHEL/CentOS $releasever
-baseurl=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/archive/@SALT_VERSION@
+baseurl=https://repo.saltstack.com/py3/redhat/$releasever/$basearch/archive/@SALT_VERSION@
 enabled=1
 gpgcheck=1
-gpgkey=https://repo.saltstack.com/yum/redhat/$releasever/$basearch/archive/@SALT_VERSION@/SALTSTACK-GPG-KEY.pub
+gpgkey=https://repo.saltstack.com/py3/redhat/$releasever/$basearch/archive/@SALT_VERSION@/SALTSTACK-GPG-KEY.pub

salt/metalk8s/orchestrate/deploy_node.sls

@@ -6,13 +6,24 @@
 {%- set roles = pillar.get('metalk8s', {}).get('nodes', {}).get(node_name, {}).get('roles', []) %}
 
 {%- if node_name not in salt.saltutil.runner('manage.up') %}
+# Salt-ssh need python3 to be installed on the destination host, so install it
+# manually using raw ssh
+Install python36:
+  metalk8s.saltutil_cmd:
+    - name: '[ "$EUID" -eq 0 ] && yum install -y python3 || sudo yum install -y python3'
+    - tgt: {{ node_name }}
+    - ssh: true
+    - raw_shell: true
+    - roster: kubernetes
+
 Deploy salt-minion on a new node:
   salt.state:
     - ssh: true
     - roster: kubernetes
     - tgt: {{ node_name }}
     - saltenv: metalk8s-{{ version }}
     - sls:
+      - metalk8s.salt.minion.dependencies
       - metalk8s.roles.minion
 
 Accept key:

salt/metalk8s/salt/minion/dependencies.sls

@@ -0,0 +1,17 @@
+# Salt need `python36-rpm` to do proper version comparaison and since we
+# use salt-ssh to install salt the first time, we want this rpm to be installed
+# before Salt-minion as salt-minion installation state will report a "failure"
+# because of version comparaison
+
+# See: https://github.com/saltstack/salt/issues/58039
+#      https://github.com/saltstack/salt/issues/57972
+
+{%- from "metalk8s/macro.sls" import pkg_installed with context %}
+
+include:
+  - metalk8s.repo
+
+Install python36-rpm:
+  {{ pkg_installed('python36-rpm') }}
+    - require:
+      - test: Repositories configured

salt/metalk8s/salt/minion/installed.sls

@@ -1,7 +1,7 @@
 {%- from "metalk8s/macro.sls" import pkg_installed with context %}
 
 include :
-  - metalk8s.repo
+  - .dependencies
   - .running
 
 Install salt-minion:

scripts/bootstrap.sh.in

@@ -58,6 +58,7 @@ SALT_CALL=${SALT_CALL:-salt-call}
 declare -a PACKAGES=(
     salt-minion-@@SALT_VERSION
     genisoimage
+    python36-rpm
 )
 
 # shellcheck disable=SC1090

scripts/restore.sh.in

@@ -72,6 +72,7 @@ SALT_CALL=${SALT_CALL:-salt-call}
 declare -a PACKAGES=(
     salt-minion-@@SALT_VERSION
     genisoimage
+    python36-rpm
 )
 
 # shellcheck disable=SC1090