python error during task

[Michael DiDomenico]

sorry for the cross post, i sent this to the devel list by mistake
---
i have compiled a separate version of openssl 1.1.1, python 3.10.5,
and ansible 2.13.2 into my home directory. i have the
interpreter_python set in the ansible.cfg file to point to the version
of python in my home directory.

on some hosts my playbook runs okay, but on others i'm getting the
below error. what i think the problem is, is that python is finding
modules in the 2.7 system libs on particular hosts and not others. on
the hosts that work i'm guessing python isn't picking up the 2.7
system lib versions

i'm new to ansible and python, so i'm not sure where the error lies.
i'm hedging a bet, it's in the way i compiled python in my home
directory. it happened when i pip installed ansible with my custom
python. but i'm not sure which or how exactly to debug this
dependency issue

TASK [install ntpd if missing]
**********************************************************************************************************************************************************************************
task path: /home1/user/ansible_ccm/playbooks/ntpd/main.yml:15
Friday 22 July 2022 11:10:46 -0700 (0:00:01.705) 0:00:01.731 ***********
Friday 22 July 2022 11:10:46 -0700 (0:00:01.706) 0:00:01.730 ***********
Running ansible.legacy.yum
Using module file
/u/user/ansible/lib/python3.10/site-packages/ansible/modules/yum.py
Pipelining is enabled.
<host1> ESTABLISH LOCAL CONNECTION FOR USER: root
<host1> EXEC /bin/sh -c
'PYTHONPATH=/u/user/ansible/lib/python3.10/site-packages/:/u/mdidome1/ansible/lib64/python3.10/site-packages/
LD_LIBRARY_PATH=/u/user/ansible/lib:/u/user/ansible/lib64
/u/user/ansible/bin/python3.10 && sleep 0'
The full traceback is:
Traceback (most recent call last):
File "<stdin>", line 16, in <module>
File "/usr/lib64/python2.7/runpy.py", line 176, in run_module
fname, loader, pkg_name)
File "/usr/lib64/python2.7/runpy.py", line 82, in _run_module_code
mod_name, mod_fname, mod_loader, pkg_name)
File "/usr/lib64/python2.7/runpy.py", line 72, in _run_code
exec code in run_globals
File "/tmp/ansible_ansible.legacy.yum_payload_aa9h7s_4/ansible_ansible.legacy.yum_payload.zip/ansible/modules/yum.py",
line 405, in <module>
File "/tmp/ansible_ansible.legacy.yum_payload_aa9h7s_4/ansible_ansible.legacy.yum_payload.zip/ansible/module_utils/urls.py",
line 116, in <module>
File "/usr/lib/python2.7/site-packages/urllib3/contrib/pyopenssl.py",
line 46, in <module>
import OpenSSL.SSL
File "/usr/lib/python2.7/site-packages/OpenSSL/__init__.py", line 8,
in <module>
from OpenSSL import rand, crypto, SSL
File "/usr/lib/python2.7/site-packages/OpenSSL/rand.py", line 12, in <module>
from OpenSSL._util import (
File "/usr/lib/python2.7/site-packages/OpenSSL/_util.py", line 6, in <module>
from cryptography.hazmat.bindings.openssl.binding import Binding
File "/u/user/ansible/lib/python3.10/site-packages/cryptography/__init__.py",
line 13, in <module>
from cryptography.utils import CryptographyDeprecationWarning
File "/u/user/ansible/lib/python3.10/site-packages/cryptography/utils.py",
line 30
def _check_bytes(name: str, value: bytes) -> None:
^
SyntaxError: invalid syntax

[Michael DiDomenico]

for anyone that might come across this in the future, it looks like
this might boil down to a dependecy hell problem

python3 and ansible2.13 require 37.0.4 which is not compatible with python2.7

the yum utils require python2 in order to run, which are not
compatible with cryptography or python3. so when you use 'package' in
an ansible playbook, it spawns /usr/bin/python (which is 2.7 in my) to
run the yum utils.

you might think i could switch to ansible.builtin.dnf which is python3
compatible, however, python3-dnf doesn't exist on rhel7, only rhel8

i might not have that all straight, but that's the jist of it

[Dick Visser]

Compiling everything correctly is not trivial - as you found out. What is the reason you're doing this? And not use one of the recommended installation methods?

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CABOsP2MtVxdtZrwLHFuT8Unpb7zrBsekR22Y9ED78mj3VyJwVg%40mail.gmail.com.

--

Sent from Gmail Mobile

[Todd Lewis]

This is the problem that Execution Environments allow you to avoid.

Or, if you're rather more cynical, this is the type of problem that emerges due to relying on execution environments.

RHEL7 users - myself included, paying for the privilege, thanks - might feel put out that a supported operating system/distro doesn't have a path forward from python2, but in fact it does: it's "move to RHEL8 or RHEL9." I shouldn't be surprised that I can't get a Mr. Fusion adaptor for my Edsel. Technically, python3 can "be done" on RHEL7, but why put the effort into digging your technical debt hole even deeper. (And by "you" I mean "me", because I'm really arguing myself into scrapping the Edsel and getting on with life.)

It would be easier to spin up a RHEL8 vm or an execution environment compatible with whatever version of Ansible you want to run than building and running a python3 application environment atop a RHEL7 installation. You're / I'm solving the wrong problem.
--
Todd

[Nico Kadel-Garcia]

On Fri, Jul 22, 2022 at 2:35 PM Michael DiDomenico
<mdidom...@gmail.com> wrote:
>
> sorry for the cross post, i sent this to the devel list by mistake
> ---
> i have compiled a separate version of openssl 1.1.1, python 3.10.5,
> and ansible 2.13.2 into my home directory. i have the
> interpreter_python set in the ansible.cfg file to point to the version
> of python in my home directory.

> i'm new to ansible and python, so i'm not sure where the error lies.

May I suggest you stop right there?

First, you're using ansible-core 2.13.2. ansible-core is everything
that really matters, including the primary ansible tools and modules.
The "ansible" package is quite useless for most, a bundle of more than
100 ansible galaxy collection modules. Yes, it's confusing, I've
argued before that "ansible-core" should have been left named
"ansible" as it was back with ansible 2.9, and the ansible collection
should match the name of the directories it actually insalls, namely
"ansible_collections". But good luck trying to get *that* revised.

So, if you're new to python, why are you trying to hurt yourself by
building your own python and openssl? We can't even deduce where you
put them and how you reference them. You're in the position of someone
new to electronics who decided to make their own battery. One of the
advantages of the open source and free software world is you can start
from already working tools, and focus on the bits vital to your
project. So why are you starting with openssl and python? Ansible is
designed, when talking to remte hosts, to do a lot of deduction about
the remote python and use the built-in python there. Based on your
error messages, that's a RHEL environment with "/usr/bin/python" being
linked to python 2.7.

If you need to build your own updated ansible-core, may I strongly
urge you to work from the RHEL published ansible packages, or if you
need a more recent ansible-core RPM, take a look at my RPM building
tools over at https:/github.com/n kadel/ansiblerepo/ ? It's quite
tricky to update ansible-core past version 2.11 on RHEL 7, you need to
use steps like "pip3 install -user ansible-core"

[Nico Kadel-Garcia]

On Sat, Jul 23, 2022 at 7:35 AM Todd Lewis <uto...@gmail.com> wrote:
>
> This is the problem that Execution Environments allow you to avoid.
>
> Or, if you're rather more cynical, this is the type of problem that emerges due to relying on execution environments.

That's a pretty fundamental architectural issue, you're unlikely to
get a lot of traction on installing a local daemon with its own
functional python on every remote host for ansible execution.

> RHEL7 users - myself included, paying for the privilege, thanks - might feel put out that a supported operating system/distro doesn't have a path forward from python2, but in fact it does: it's "move to RHEL8 or RHEL9." I shouldn't be surprised that I can't get a Mr. Fusion adaptor for my Edsel. Technically, python3 can "be done" on RHEL7, but why put the effort into digging your technical debt hole even deeper. (And by "you" I mean "me", because I'm really arguing myself into scrapping the Edsel and getting on with life.)

It gets funnier that, when ansible makes demands for python modules
unavailable on contemporary RHEL releases, the response for providing
RPMS that include them is to violate pretty basic python packaging
guidelines for Fedora and RHEL and internalize them inside the SRPM,
with git commit labeled tarballs rather than release numbered
tarballs. Someone out there decided to get strange and ignora Fedora
guidelines. I now publish RPM update tools for those dependencies,
over at https://github.com/nkadel/ansiblerepo.

On RHEL 7, if you really need ansible-core 2.13.2, I think we're SOL.
Building up a fresh python 3.8 or later for it is more work than most
of us need. Use RHEL 8 or CentOS 8, and use the python38 packages. And
the published ansible-core 2.12 is plenty for most uses there until,
for example, RHEL straightens out the modularity mucked up dnf
installation of the "python38-packaging" package to allow gracefully
building up the dependency suite for ansible-core 2.13. I ran into
that last week. I'm pretty unhappy about Red Hat allowing the RPM
"modularity" pecularities near any system RPMs.

> It would be easier to spin up a RHEL8 vm or an execution environment compatible with whatever version of Ansible you want to run than building and running a python3 application environment atop a RHEL7 installation. You're / I'm solving the wrong problem.

Or docker container.

"python3" isn't so much the problem. You can install with the built-in
python3 packages for RHEL 7.

sudo yum install python3-devel
sudo yum install python3-pip
pip3 install -m ansible-core # will only provide ansible-core up
to 4.11 on RHEL 7 built-in python 3.6

> --
> You received this message because you are subscribed to the Google Groups "Ansible Project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.

> To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/3c0bb1a8-19db-b866-39f3-9d4375be79c1%40gmail.com.