Revert EL8 Python bootstrap and Calico CI (#13596)

This reverts commit e19d1c9a55.

Allow further maintainer discussion without introducing additional changes.

Signed-off-by: Kay Yan <kay.yan@daocloud.io>

roles/bootstrap_os/defaults/main.yml

@@ -43,9 +43,6 @@ fedora_coreos_packages:
   - containernetworking-plugins  # required by crio
 
 ## General
-# Install Python through the distribution-specific bootstrap tasks
-bootstrap_os_install_python: true
-
 # Set the hostname to inventory_hostname
 override_system_hostname: true
 

roles/bootstrap_os/tasks/centos.yml

@@ -1,42 +1,4 @@
 ---
-- name: Bootstrap Python
-  when: bootstrap_os_install_python
-  block:
-    - name: Check if Python bootstrap is needed
-      vars:
-        python_interpreter: "{{ lookup('config', 'INTERPRETER_PYTHON') | trim }}"
-        python_candidates: >-
-          {{ lookup('config', 'INTERPRETER_PYTHON_FALLBACK')
-             if python_interpreter in ['', 'auto', 'auto_silent'] else [python_interpreter] }}
-      raw: |
-        for python in {{ python_candidates | map('quote') | join(' ') }}; do
-          if command -v "$python" >/dev/null 2>&1; then
-            "$python" -c 'import sys; sys.exit(sys.version_info[:2] < (3, 9))'
-            exit $?
-          fi
-        done
-        exit 1
-      register: need_bootstrap
-      changed_when: false
-      failed_when: need_bootstrap.rc not in [0, 1]
-      check_mode: false
-
-    # Keep platform-python for the ansible-core DNF helper.
-    - name: Install Python 3.12
-      raw: >-
-        yum --assumeyes
-        {% if not skip_http_proxy_on_os_packages and http_proxy is defined %}
-        --setopt={{ ('proxy=' ~ http_proxy) | quote }}
-        {% endif %}
-        install python3.12
-      become: true
-      register: bootstrap_python
-      until: bootstrap_python is succeeded
-      retries: "{{ pkg_install_retries }}"
-      delay: "{{ retry_stagger | random + 3 }}"
-      timeout: "{{ pkg_install_timeout }}"
-      when: need_bootstrap.rc != 0
-
 - name: Gather host facts to get ansible_distribution_version ansible_distribution_major_version
   setup:
     gather_subset: '!all'
@@ -99,6 +61,8 @@
     - (ansible_facts['distribution_version'] | float) >= 7.6
     - (ansible_facts['distribution_version'] | float) < 9
 
+# CentOS ships with python installed
+
 - name: Check presence of fastestmirror.conf
   stat:
     path: /etc/yum/pluginconf.d/fastestmirror.conf

roles/bootstrap_os/tasks/debian.yml

@@ -49,5 +49,4 @@
     DEBIAN_FRONTEND=noninteractive apt-get install -y python3-minimal
   become: true
   when:
-    - bootstrap_os_install_python
     - need_bootstrap.rc != 0

roles/bootstrap_os/tasks/fedora-coreos.yml

@@ -12,24 +12,24 @@
   raw: "podman network rm podman"
   become: true
   ignore_errors: true  # noqa ignore-errors
-  when: bootstrap_os_install_python and need_bootstrap.rc != 0
+  when: need_bootstrap.rc != 0
 
 - name: Clean up possible pending packages on fedora coreos
   raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree cleanup -p }}"
   become: true
-  when: bootstrap_os_install_python and need_bootstrap.rc != 0
+  when: need_bootstrap.rc != 0
 
 - name: Install required packages on fedora coreos
   raw: "export http_proxy={{ http_proxy | default('') }};rpm-ostree install --allow-inactive {{ fedora_coreos_packages | join(' ') }}"
   become: true
-  when: bootstrap_os_install_python and need_bootstrap.rc != 0
+  when: need_bootstrap.rc != 0
 
 - name: Reboot immediately for updated ostree
   raw: "nohup bash -c 'sleep 5s && shutdown -r now'"
   become: true
   ignore_errors: true  # noqa ignore-errors
   ignore_unreachable: true
-  when: bootstrap_os_install_python and need_bootstrap.rc != 0
+  when: need_bootstrap.rc != 0
 
 - name: Wait for the reboot to complete
   wait_for_connection:
@@ -37,4 +37,4 @@
     connect_timeout: 20
     delay: 5
     sleep: 5
-  when: bootstrap_os_install_python and need_bootstrap.rc != 0
+  when: need_bootstrap.rc != 0

roles/bootstrap_os/tasks/fedora.yml

@@ -27,5 +27,4 @@
   raw: "dnf install --assumeyes python3 python3-dnf libselinux-python3"
   become: true
   when:
-    - bootstrap_os_install_python
     - need_bootstrap.rc != 0

roles/bootstrap_os/tasks/flatcar.yml

@@ -14,7 +14,6 @@
   become: true
   environment: "{{ proxy_env }}"
   when:
-    - bootstrap_os_install_python
     - need_bootstrap.rc != 0
 
 # Workaround ansible https://github.com/ansible/ansible/pull/82821

roles/kubernetes/preinstall/tasks/0079-selinux.yml

@@ -1,60 +0,0 @@
----
-# The ansible.posix.selinux module needs the libselinux Python bindings, which
-# some distributions only package for their system Python. When Kubespray runs
-# with another interpreter (for example the Python 3.12 bootstrapped on EL8)
-# the bindings are missing, so fall back to editing the configuration file.
-- name: Check for the libselinux Python bindings
-  command: "{{ ansible_facts['python']['executable'] }} -c 'import selinux'"
-  register: selinux_bindings
-  changed_when: false
-  failed_when: false
-  check_mode: false
-
-- name: Set selinux policy
-  ansible.posix.selinux:
-    policy: targeted
-    state: "{{ selinux_state }}"
-  when: selinux_bindings.rc == 0
-
-- name: Set selinux policy without the libselinux Python bindings
-  when: selinux_bindings.rc != 0
-  block:
-    - name: Gather selinux facts
-      setup:
-        gather_subset: selinux
-
-    - name: Set selinux policy type
-      lineinfile:
-        path: /etc/selinux/config
-        regexp: '^SELINUXTYPE='
-        line: "SELINUXTYPE=targeted"
-        mode: "0644"
-        backup: "{{ leave_etc_backup_files }}"
-      when: selinux_state != 'disabled'
-
-    - name: Set selinux state
-      lineinfile:
-        path: /etc/selinux/config
-        regexp: '^SELINUX='
-        line: "SELINUX={{ selinux_state }}"
-        mode: "0644"
-        backup: "{{ leave_etc_backup_files }}"
-
-    # Disabling SELinux requires a reboot; use permissive mode until then.
-    - name: Update selinux runtime state
-      vars:
-        selinux_runtime_state: "{{ (selinux_state == 'enforcing') | ternary('enforcing', 'permissive') }}"
-      when:
-        - ansible_facts['selinux']['status'] == 'enabled'
-        - ansible_facts['selinux']['mode'] != selinux_runtime_state
-      block:
-        - name: Apply selinux state at runtime
-          command: setenforce {{ (selinux_runtime_state == 'enforcing') | ternary('1', '0') }}
-          changed_when: true
-          when: not ansible_check_mode
-
-        - name: Report selinux runtime change in check mode
-          debug:
-            msg: "SELinux runtime state would change to {{ selinux_runtime_state }}"
-          changed_when: true
-          when: ansible_check_mode

roles/kubernetes/preinstall/tasks/0080-system-configurations.yml

@@ -12,9 +12,9 @@
   register: slc
 
 - name: Set selinux policy
-  include_tasks: 0079-selinux.yml
-  vars:
-    selinux_state: "{{ preinstall_selinux_state }}"
+  ansible.posix.selinux:
+    policy: targeted
+    state: "{{ preinstall_selinux_state }}"
   when:
     - ansible_facts['os_family'] == "RedHat"
     - "'Amazon' not in ansible_facts['distribution']"

roles/kubernetes/preinstall/tasks/0081-ntp-configurations.yml

@@ -83,9 +83,9 @@
         - ansible_facts['os_family'] == "RedHat"
 
     - name: Put SELinux in permissive mode, logging actions that would be blocked.
-      include_tasks: 0079-selinux.yml
-      vars:
-        selinux_state: permissive
+      ansible.posix.selinux:
+        policy: targeted
+        state: permissive
       when:
         - ansible_facts['os_family'] == "RedHat"
         - ansible_facts.selinux.status == 'enabled'
@@ -96,9 +96,9 @@
         name: "{{ ntp_timezone }}"
 
     - name: Re-enable SELinux
-      include_tasks: 0079-selinux.yml
-      vars:
-        selinux_state: "{{ preinstall_selinux_state }}"
+      ansible.posix.selinux:
+        policy: targeted
+        state: "{{ preinstall_selinux_state }}"
       when:
         - ansible_facts['os_family'] == "RedHat"
         - ansible_facts.selinux.status == 'enabled'