Enable AlmaLinux 8 and Rocky Linux 8 Calico CI with Python 3.12 bootstrap (#13593)

* Enable AlmaLinux 8 and Rocky Linux 8 Calico CI

Install Python 3.12 with yum before gathering facts when the interpreter
selected by Ansible is missing or older than Python 3.9, and add
bootstrap_os_install_python to control distribution-specific Python
bootstrap installation.

EL8 only ships the libselinux Python bindings for the distribution
Python 3.6, so ansible.posix.selinux fails once Kubespray runs with
Python 3.12. Keep using the module when the bindings are importable and
otherwise set the policy in /etc/selinux/config and apply the runtime
state with setenforce.

Enable rockylinux8-calico in regular PR CI, add almalinux8-calico as a
manual job, and document the RHEL 8 family lifecycle.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

* Fix EL8 containerd compatibility and SELinux runtime transitions

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

---------

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

roles/kubernetes/preinstall/tasks/0079-selinux.yml

@@ -0,0 +1,60 @@
+---
+# The ansible.posix.selinux module needs the libselinux Python bindings, which
+# some distributions only package for their system Python. When Kubespray runs
+# with another interpreter (for example the Python 3.12 bootstrapped on EL8)
+# the bindings are missing, so fall back to editing the configuration file.
+- name: Check for the libselinux Python bindings
+  command: "{{ ansible_facts['python']['executable'] }} -c 'import selinux'"
+  register: selinux_bindings
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Set selinux policy
+  ansible.posix.selinux:
+    policy: targeted
+    state: "{{ selinux_state }}"
+  when: selinux_bindings.rc == 0
+
+- name: Set selinux policy without the libselinux Python bindings
+  when: selinux_bindings.rc != 0
+  block:
+    - name: Gather selinux facts
+      setup:
+        gather_subset: selinux
+
+    - name: Set selinux policy type
+      lineinfile:
+        path: /etc/selinux/config
+        regexp: '^SELINUXTYPE='
+        line: "SELINUXTYPE=targeted"
+        mode: "0644"
+        backup: "{{ leave_etc_backup_files }}"
+      when: selinux_state != 'disabled'
+
+    - name: Set selinux state
+      lineinfile:
+        path: /etc/selinux/config
+        regexp: '^SELINUX='
+        line: "SELINUX={{ selinux_state }}"
+        mode: "0644"
+        backup: "{{ leave_etc_backup_files }}"
+
+    # Disabling SELinux requires a reboot; use permissive mode until then.
+    - name: Update selinux runtime state
+      vars:
+        selinux_runtime_state: "{{ (selinux_state == 'enforcing') | ternary('enforcing', 'permissive') }}"
+      when:
+        - ansible_facts['selinux']['status'] == 'enabled'
+        - ansible_facts['selinux']['mode'] != selinux_runtime_state
+      block:
+        - name: Apply selinux state at runtime
+          command: setenforce {{ (selinux_runtime_state == 'enforcing') | ternary('1', '0') }}
+          changed_when: true
+          when: not ansible_check_mode
+
+        - name: Report selinux runtime change in check mode
+          debug:
+            msg: "SELinux runtime state would change to {{ selinux_runtime_state }}"
+          changed_when: true
+          when: ansible_check_mode

roles/kubernetes/preinstall/tasks/0080-system-configurations.yml

@@ -12,9 +12,9 @@
   register: slc
 
 - name: Set selinux policy
-  ansible.posix.selinux:
-    policy: targeted
-    state: "{{ preinstall_selinux_state }}"
+  include_tasks: 0079-selinux.yml
+  vars:
+    selinux_state: "{{ preinstall_selinux_state }}"
   when:
     - ansible_facts['os_family'] == "RedHat"
     - "'Amazon' not in ansible_facts['distribution']"

roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml

@@ -83,9 +83,9 @@
         - ansible_facts['os_family'] == "RedHat"
 
     - name: Put SELinux in permissive mode, logging actions that would be blocked.
-      ansible.posix.selinux:
-        policy: targeted
-        state: permissive
+      include_tasks: 0079-selinux.yml
+      vars:
+        selinux_state: permissive
       when:
         - ansible_facts['os_family'] == "RedHat"
         - ansible_facts.selinux.status == 'enabled'
@@ -96,9 +96,9 @@
         name: "{{ ntp_timezone }}"
 
     - name: Re-enable SELinux
-      ansible.posix.selinux:
-        policy: targeted
-        state: "{{ preinstall_selinux_state }}"
+      include_tasks: 0079-selinux.yml
+      vars:
+        selinux_state: "{{ preinstall_selinux_state }}"
       when:
         - ansible_facts['os_family'] == "RedHat"
         - ansible_facts.selinux.status == 'enabled'