Enable AlmaLinux 8 and Rocky Linux 8 Calico CI with Python 3.12 bootstrap (#13593)

* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI

Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.

EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.

Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* Fix EL8 containerd compatibility and SELinux runtime transitions

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

roles/bootstrap_os/tasks/centos.yml

@@ -1,4 +1,42 @@
 ---
+- name: Bootstrap Python
+  when: bootstrap_os_install_python
+  block:
+    - name: Check if Python bootstrap is needed
+      vars:
+        python_interpreter: "{{ lookup('config', 'INTERPRETER_PYTHON') | trim }}"
+        python_candidates: >-
+          {{ lookup('config', 'INTERPRETER_PYTHON_FALLBACK')
+             if python_interpreter in ['', 'auto', 'auto_silent'] else [python_interpreter] }}
+      raw: |
+        for python in {{ python_candidates | map('quote') | join(' ') }}; do
+          if command -v "$python" >/dev/null 2>&1; then
+            "$python" -c 'import sys; sys.exit(sys.version_info[:2] < (3, 9))'
+            exit $?
+          fi
+        done
+        exit 1
+      register: need_bootstrap
+      changed_when: false
+      failed_when: need_bootstrap.rc not in [0, 1]
+      check_mode: false
+
+    # Keep platform-python for the ansible-core DNF helper.
+    - name: Install Python 3.12
+      raw: >-
+        yum --assumeyes
+        {% if not skip_http_proxy_on_os_packages and http_proxy is defined %}
+        --setopt={{ ('proxy=' ~ http_proxy) | quote }}
+        {% endif %}
+        install python3.12
+      become: true
+      register: bootstrap_python
+      until: bootstrap_python is succeeded
+      retries: "{{ pkg_install_retries }}"
+      delay: "{{ retry_stagger | random + 3 }}"
+      timeout: "{{ pkg_install_timeout }}"
+      when: need_bootstrap.rc != 0
+
 - name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
   setup:
     gather_subset: '!all'
@@ -61,8 +99,6 @@
     - (ansible_facts['distribution_version'] | float) >= 7.6
     - (ansible_facts['distribution_version'] | float) < 9
 
-# CentOS ships with python installed
-
 - name: Check presence of fastestmirror.conf
   stat:
     path: /etc/yum/pluginconf.d/fastestmirror.conf

roles/bootstrap_os/tasks/debian.yml

@@ -49,4 +49,5 @@
     DEBIAN_FRONTEND=noninteractive apt-get install -y python3-minimal
   become: true
   when:
+    - bootstrap_os_install_python
     - need_bootstrap.rc != 0

roles/bootstrap_os/tasks/fedora-coreos.yml

@@ -12,24 +12,24 @@
   raw: "podman network rm podman"
   become: true
   ignore_errors: true  # noqa ignore-errors
-  when: need_bootstrap.rc != 0
+  when: bootstrap_os_install_python and need_bootstrap.rc != 0
 
 - name: Clean up possible pending packages on fedora coreos
   raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree cleanup -p }}"
   become: true
-  when: need_bootstrap.rc != 0
+  when: bootstrap_os_install_python and need_bootstrap.rc != 0
 
 - name: Install required packages on fedora coreos
   raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree install --allow-inactive {{ fedora_coreos_packages | join(' ') }}"
   become: true
-  when: need_bootstrap.rc != 0
+  when: bootstrap_os_install_python and need_bootstrap.rc != 0
 
 - name: Reboot immediately for updated ostree
   raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
   become: true
   ignore_errors: true  # noqa ignore-errors
   ignore_unreachable: true
-  when: need_bootstrap.rc != 0
+  when: bootstrap_os_install_python and need_bootstrap.rc != 0
 
 - name: Wait for the reboot to complete
   wait_for_connection:
@@ -37,4 +37,4 @@
     connect_timeout: 20
     delay: 5
     sleep: 5
-  when: need_bootstrap.rc != 0
+  when: bootstrap_os_install_python and need_bootstrap.rc != 0

roles/bootstrap_os/tasks/fedora.yml

@@ -27,4 +27,5 @@
   raw: "dnf install --assumeyes python3 python3-dnf libselinux-python3"
   become: true
   when:
+    - bootstrap_os_install_python
     - need_bootstrap.rc != 0

roles/bootstrap_os/tasks/flatcar.yml

@@ -14,6 +14,7 @@
   become: true
   environment: "{{ proxy_env }}"
   when:
+    - bootstrap_os_install_python
     - need_bootstrap.rc != 0
 
 # Workaround ansible https://github.com/ansible/ansible/pull/82821