Problem: cert_file issue with get_url and python 3.12

[choman]

Issue

Encountering an issue when running against hosts such as Ubuntu 24.04 LTS. The version of python on these hosts begins at python 3.12.3. The issues I am running into in the semaphore output

#15	
—
TASK [ansible-role-direnv : Fetch install script "direnv"] *********************
12:19:41 PM
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: TypeError: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file'
12:19:41 PM
fatal: [dev05.lan]: FAILED! => {"changed": false, "content": "", "elapsed": 0, "msg": "Status code was -1 and not [200]: An unknown error occurred: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file'", "

The issue is that cert_file and key_file are deprecated parameters and is best documented in ansible here: ansible/ansible#80490

Impact

Ansible (task execution), Semaphore Project

Installation method

Docker

Browser

No response

Semaphore Version

v2.9.75

Ansible Version

This is an ansible issue, I am assuming it begins with the version of ansible inside the semaphore docker image


ansible [core 2.14.5]
  config file = None
  configured module search path = ['/home/semaphore/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.11/site-packages/ansible
  ansible collection location = /home/semaphore/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.8 (main, Feb 19 2024, 22:58:08) [GCC 12.2.1 20220924] (/usr/bin/python3)
  jinja version = 3.1.2
  libyaml = True

Internal python is 3.11.8

### Logs & errors

_No response_

### Manual installation - system information

_No response_

### Configuration

_No response_

### Additional information

- digging into this, the "fix" appears to be backported to ansible 2.15.  But recommend bumping anisble to latest (2.16)

[tboerger]

Contributions are welcome, just upgrade ansible from 9.4.0 to 9.6.0 until renovate gets activated for this project:

https://github.com/semaphoreui/semaphore/blob/develop/deployment/docker/server/Dockerfile#L52

https://github.com/semaphoreui/semaphore/blob/develop/deployment/docker/runner/Dockerfile#L52

:)

[tboerger]

In the meantime you should be able to upgrade ansible by mounting a requirements.txt to /etc/semaphore with a version constraint.

[choman]

@tboerger It might take me a few days to get back to this. But I will attempt to report back any findings. Thanks for the suggestions

[choman]

@tboerger

So my environment at work is pretty dumb, so I took the low bridge approach of creating the requirements.txt. Ansible now returns as

ansible [core 2.16.7]
  config file = None
  configured module search path = ['/home/semaphore/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/semaphore/.local/lib/python3.11/site-packages/ansible
  ansible collection location = /home/semaphore/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.8 (main, Feb 19 2024, 22:58:08) [GCC 12.2.1 20220924] (/usr/bin/python3)
  jinja version = 3.1.2
  libyaml = True

Unfortunately, this must not be as back ported as I was led to believe as I still receive the following error

 1:07:19 PM
fatal: [dev06.lan]: FAILED! => {"changed": false, "dest": "/usr/local/bin/yq", "elapsed": 0, "msg": "An unknown error occurred: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file'", "url": "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64"}
1:07:19 PM
fatal: [dev05.lan]: FAILED! => {"changed": false, "dest": "/usr/local/bin/yq", "elapsed": 0, "msg": "An unknown error occurred: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file'", "url": "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64"}
1:07:19 PM 

I am starting to think the dockerfile approach may be the best and the version of alpine needs to be bumped to 3.20 as this appears to be when python 3.12 makes it into the alpine repos

[choman]

@tboerger

So I pulled the latest semaphore docker image today: v2.9.109-e32ce6b-1716748351

• The primary issue appears now resolved
• Cannot just call ansible on the cli anymore, needs the full path to the executable in the venv

Having said that, I believe this ticket can be closed. If the issue comes up again I will open a new ticket