Respawn modules to use the system python interpreter #460
Conversation
|
Build failed. ✔️ ansible-changelog-fragment SUCCESS in 14s |
|
recheck |
|
Build succeeded. ✔️ ansible-changelog-fragment SUCCESS in 16s |
|
The FreeBSD tests timed out |
|
/azp run |
|
Commenter does not have sufficient privileges for PR 460 in repo ansible-collections/ansible.posix |
|
Build succeeded. ✔️ ansible-changelog-fragment SUCCESS in 14s |
|
I marked this as draft. I'd like to refactor this so that there's less duplicated code. |
The seboolean, selinux, firewalld, and firewalld_info modules depend on system bindings that are only available for the default system python interpreter. ansible-core is not packaged for the default system python interpreter on RHEL 8 and 9. When automatic interpreter discovery does not occur (e.g. when using implicit localhost [1]), ansible-core will not use the system interpreter to run ansible modules and the aforementioned modules will not work even if the bindings are installed. The RHEL ansible-core maintainers as well as the EPEL ansible and ansible-collection-* package maintainers (inc. me) have gotten multiple bug reports about this. We have been telling people to fix their setup to use the correct Python interpreter. Fortunately, ansible-core 2.11 and above have a module utility that'll respawn modules to use the correct system interpreter. [1] https://docs.ansible.com/ansible/latest/inventory/implicit_localhost.html
|
Build succeeded. ✔️ ansible-changelog-fragment SUCCESS in 15s |
|
Ready for review |
|
rebuild_merge |
|
Build succeeded (gate pipeline). ✔️ ansible-changelog-fragment SUCCESS in 16s |
softwarefactory-project-zuul
bot
merged commit 6f95c8b
into
ansible-collections:main
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ansible.posix](https://github.com/ansible-collections/ansible.posix) | galaxy-collection | minor | `1.5.4` -> `1.6.0` | --- ### Release Notes <details> <summary>ansible-collections/ansible.posix (ansible.posix)</summary> ### [`v1.6.0`](https://github.com/ansible-collections/ansible.posix/blob/HEAD/CHANGELOG.rst#v160) [Compare Source](https://github.com/ansible-collections/ansible.posix/compare/1.5.4...1.6.0) \====== ## Release Summary This is the minor release of the `ansible.posix` collection. This changelog contains all changes to the modules and plugins in this collection that have been added after the release of `ansible.posix` 1.5.4. ## Major Changes - Dropping support for Ansible 2.9, ansible-core 2.15 will be minimum required version for this release ## Minor Changes - Add summary_only parameter to profile_roles and profile_tasks callbacks. - firewalld - add functionality to set forwarding ([https://github.com/ansible-collections/ansible.posix/pull/548](https://github.com/ansible-collections/ansible.posix/pull/548)). - firewalld - added offline flag implementation ([https://github.com/ansible-collections/ansible.posix/pull/484](https://github.com/ansible-collections/ansible.posix/pull/484)) - firewalld - respawn module to use the system python interpreter when the `firewall` python module is not available for `ansible_python_interpreter` ([https://github.com/ansible-collections/ansible.posix/pull/460](https://github.com/ansible-collections/ansible.posix/pull/460)). - firewalld_info - Only warn about ignored zones, when there are zones ignored. - firewalld_info - respawn module to use the system python interpreter when the `firewall` python module is not available for `ansible_python_interpreter` ([https://github.com/ansible-collections/ansible.posix/pull/460](https://github.com/ansible-collections/ansible.posix/pull/460)). - mount - add no_log option for opts parameter ([https://github.com/ansible-collections/ansible.posix/pull/563](https://github.com/ansible-collections/ansible.posix/pull/563)). - seboolean - respawn module to use the system python interpreter when the `selinux` python module is not available for `ansible_python_interpreter` ([https://github.com/ansible-collections/ansible.posix/pull/460](https://github.com/ansible-collections/ansible.posix/pull/460)). - selinux - respawn module to use the system python interpreter when the `selinux` python module is not available for `ansible_python_interpreter` ([https://github.com/ansible-collections/ansible.posix/pull/460](https://github.com/ansible-collections/ansible.posix/pull/460)). ## Removed Features (previously deprecated) - skippy - Remove skippy pluglin as it is no longer supported([https://github.com/ansible-collections/ansible.posix/issues/350](https://github.com/ansible-collections/ansible.posix/issues/350)). ## Bugfixes - Bugfix in the documentation regarding the path option for authorised_key([https://github.com/ansible-collections/ansible.posix/issues/483](https://github.com/ansible-collections/ansible.posix/issues/483)). - seboolean - make it work with disabled SELinux - synchronize - maintain proper formatting of the remote paths ([https://github.com/ansible-collections/ansible.posix/pull/361](https://github.com/ansible-collections/ansible.posix/pull/361)). - sysctl - fix sysctl to work properly on symlinks ([https://github.com/ansible-collections/ansible.posix/issues/111](https://github.com/ansible-collections/ansible.posix/issues/111)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC43Ny4wIiwidXBkYXRlZEluVmVyIjoiMzguNzcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUvYW5zaWJsZSIsInR5cGUvbWlub3IiXX0=--> Co-authored-by: lumiere-bot[bot] <98047013+lumiere-bot[bot]@users.noreply.github.com>
@gotmax23 can you explain what this means - "ansible-core is not packaged for the default system python interpreter on RHEL 8 and 9"? I'm wondering if this is the same problem as https://access.redhat.com/solutions/6726561: If this is the problem - what we tell RHEL System Roles customers is this. " " and these are the workarounds: Resolution Choose one of the options below to workaround the issue:
Unfortunately the solution in this PR is causing a problem with the way we 'vendor' in the ansible.posix modules for RHEL customers (since ansible.posix is unsupported for RHEL customers). There is some deep failure when the python code is loaded, before the module is even executed. I've been beating my head against the wall trying to figure out why this line (as part of the vendoring, we rewrite the module) is causing the problems: from ansible.module_utils.selinux_lsr._respawn import respawn_module, HAS_RESPAWN_UTILAlso note the older legacy role form (we vendor the module into the rhel-system-roles.selinux role). We do the same sort of vendoring for lots of other modules in lots of other system roles, and I do not have an issue. At any rate, if this is the same problem as I linked to above https://access.redhat.com/solutions/6726561 - then I think I can just remove the respawn import line, and create mock
|
SUMMARY
The seboolean, selinux, firewalld, and firewalld_info modules depend on
system bindings that are only available for the default system python
interpreter. ansible-core is not packaged for the default system python
interpreter on RHEL 8 and 9. When automatic interpreter discovery does
not occur (e.g. when using implicit localhost [1]), ansible-core will
not use the system interpreter to run ansible modules and the
aforementioned modules will not work even if the bindings are installed.
The RHEL ansible-core maintainers as well as the EPEL ansible and
ansible-collection-* package maintainers (inc. me) have gotten multiple
bug reports about this. We have been telling people to fix their setup
to use the correct Python interpreter. Fortunately, ansible-core 2.11
and above have a module utility that'll respawn modules to use the
correct system interpreter.
[1] https://docs.ansible.com/ansible/latest/inventory/implicit_localhost.html
ISSUE TYPE
COMPONENT NAME
seboolean
selinux
firewalld
firewalld_info