Bump ansible from 2.9.20 to 2.10.7

[mkllnk]

If we want to keep using Ansible, we need to update to a modern version, supporting current versions of Python. This is just a first step.

Related:

• Upgrade Ubuntu #157
• Bump ansible from 2.9.20 to 7.0.0 #863

Dev notes

It may be necessary to remove the old version of Ansible entirely. This will do the trick:

pyenv virtualenv-delete ofn-install-3.10.15
./bin/pyenv-install

[dacook]

This is required for Ubuntu 20, due to ansible/ansible#68536

[dacook]

A workaround was to comment out this line. We should be able to re-instate it with this upgrade:
ed59a6b

[mkllnk]

Okay, linting disabled. CI doesn't cover everything. @dacook, you could try to run the next provisioning with this branch?

[dacook]

@mkllnk I just noticed that we don't have an upgrade method documented for ansible.
The new pyenv-install script only runs pip if it's instaling a new version of python. So in the case of this upgrade, it gets skipped and you have to manually run pip install -r requirements.txt.

I think the best fix is to simply move that command to after the if block.

[dacook]

FYI @mkllnk I got this message:

I got interrupted, but will try the suggested steps soon and hopefully it will be fine.

[mkllnk]

I would delete the current virtualenv and start again:

pyenv virtualenv-delete ofn-install-3.10.15
./bin/pyenv-install

We could include the Ansible version in the virtualenv name to avoid conflicts...

[dacook]

Sure, I've done that instead.
There's other package versions specified in requirements.txt, so if going down that path, maybe we should use a hash of that file in the virtualenv name.

[dacook]

Tested on ca_prod2:

• ✅ setup.yml
• ✅ provision.yml
• ✅ deploy.yml

[dacook]

Couple of notes, but I don't think worth changing. Good to go.

[dacook]

FYI Markdown strikeouts only need two tildes each side. But the intent is still clear.

[dacook]

I wonder if there's a way we could configure it to always skip. Then it would still show in GitHub as an action that doesn't run (and hence remind there's something broken to fix one day)

[dacook]

Deployed on uk_staging, but the other staging servers are older and it doesn't work:

ansible-playbook playbooks/setup_remote_deployment.yml -l all_staging
...
TASK [remote_deployment : install ansible]
ok: [staging.openfoodnetwork.org.uk]
fatal: [staging.coopcircuits.fr]: FAILED!
fatal: [staging.openfoodnetwork.org.au]: FAILED!
...
Failed to update apt cache: unknown reason

I'm not sure it's worth investigating further right now.
I think it's fine to leave Workaround for Ubuntu 20 with Ansible < 2.10 in place until further notice.

[mkllnk]

Looks like a different problem we should solve:

root@vps-2a25f087:~# apt update
Get:1 http://nova.clouds.archive.ubuntu.com/ubuntu bionic InRelease [242 kB]
Get:2 http://nova.clouds.archive.ubuntu.com/ubuntu bionic-updates InRelease [102 kB]                                                                                                               
Get:3 http://nova.clouds.archive.ubuntu.com/ubuntu bionic-backports InRelease [102 kB]                                                                                                             
Get:4 http://security.ubuntu.com/ubuntu bionic-security InRelease [102 kB]                                                                                                                         
Hit:5 http://nginx.org/packages/ubuntu bionic InRelease                                                                                                                                            
Get:6 https://deb.nodesource.com/node_14.x bionic InRelease [4584 B]                                                                                                                               
Hit:7 https://download.newrelic.com/infrastructure_agent/linux/apt bionic InRelease                                                     
Hit:8 http://ppa.launchpad.net/ansible/ansible/ubuntu bionic InRelease                                 
Hit:9 http://ppa.launchpad.net/certbot/certbot/ubuntu bionic InRelease
Hit:10 http://ppa.launchpad.net/redislabs/redis/ubuntu bionic InRelease
Err:5 http://nginx.org/packages/ubuntu bionic InRelease
  The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
Fetched 552 kB in 1s (424 kB/s)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
77 packages can be upgraded. Run 'apt list --upgradable' to see them.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: http://nginx.org/packages/ubuntu bionic InRelease: The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
W: Failed to fetch http://nginx.org/packages/ubuntu/dists/bionic/InRelease  The following signatures were invalid: EXPKEYSIG ABF5BD827BD9BF62 nginx signing key <signing-key@nginx.com>
W: Some index files failed to download. They have been ignored, or old ones used instead.