[khaledk2]

This PR fixes the check of Python and pip versions.
It will also update pip and certifi if the installed Python version is less than 3.11.18 or 3.12.16.

[pwalczysko]

I am afraid running against the RHEL9 VM on an env where the venvs were deleted before the run, I have a failure at the task TASK [python3_virtualenv : update the pip version if the python version is less than 3.11.18 or python 3.12.16]

The python version in the freshly created venv3 is

(base) [root@ome-train4-ap1 server]# source venv3/bin/activate
((venv-3.12) ) (base) [root@ome-train4-ap1 server]# python --version
Python 3.12.15

The ansible version used

ansible --version
ansible [core 2.18.8]

Run of the playbook with the final error:

TASK [python3_virtualenv : ansible.builtin.debug] *****************************************************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : ansible.builtin.include_tasks] *********************************************************************************
included: /Users/pwalczysko/Work/prod-playbooks/playbooks/roles/python3_virtualenv/tasks/redhat.yml for 134.36.5.145

TASK [python3_virtualenv : python venv | install packages] ********************************************************************************
ok: [134.36.5.145]

TASK [python3_virtualenv : ansible.builtin.include_tasks] *********************************************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : ansible.builtin.include_tasks] *********************************************************************************
included: /Users/pwalczysko/Work/prod-playbooks/playbooks/roles/python3_virtualenv/tasks/python-venv_installation.yml for 134.36.5.145

TASK [python3_virtualenv : python venv | check if the venv3 dir exists] *******************************************************************
ok: [134.36.5.145]

TASK [python3_virtualenv : python venv | register existing venv python version] ***********************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | Set a host_venv_version] *************************************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | Copy venv to a folder whose name includes the python version] ************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | Remove folder if it is not symlink] **************************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | create symlink if venv exists and is not symlink] ************************************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | create python virtualenv wrapper] ****************************************************************
ok: [134.36.5.145]

TASK [python3_virtualenv : python venv | setup virtualenv3] *******************************************************************************
changed: [134.36.5.145]

TASK [python3_virtualenv : python venv | Remove a symbolic link if exist and has different python version] ********************************
skipping: [134.36.5.145]

TASK [python3_virtualenv : python venv | create symlink for the new python] ***************************************************************
--- before
+++ after
@@ -1,4 +1,4 @@
 {
     "path": "/opt/omero/server/venv3",
-    "state": "absent"
+    "state": "link"
 }

changed: [134.36.5.145]

TASK [python3_virtualenv : check the installed python version] ****************************************************************************
ok: [134.36.5.145]

TASK [python3_virtualenv : ansible.builtin.set_fact] **************************************************************************************
ok: [134.36.5.145]

TASK [python3_virtualenv : update the pip version if the python version is less than 3.11.18 or python 3.12.16] ***************************
fatal: [134.36.5.145]: FAILED! => {"msg": "The conditional check '(python_version == '3.12' and int_py_version < 16) or (python_version == '3.11' and int_py_version < 18)' failed. The error was: Unexpected templating type error occurred on ({% if (python_version == '3.12' and int_py_version < 16) or (python_version == '3.11' and int_py_version < 18) %} True {% else %} False {% endif %}): '<' not supported between instances of 'AnsibleUnsafeText' and 'int'. '<' not supported between instances of 'AnsibleUnsafeText' and 'int'\n\nThe error appears to be in '/Users/pwalczysko/Work/prod-playbooks/playbooks/roles/python3_virtualenv/tasks/python-venv_installation.yml': line 85, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: update the pip version if the python version is less than 3.11.18 or python 3.12.16\n  ^ here\n"}

PLAY RECAP ********************************************************************************************************************************
134.36.5.145               : ok=43   changed=2    unreachable=0    failed=1    skipped=25   rescued=0    ignored=0   

[pwalczysko]

• the last commit fixed the syntax problem both on the older ansible as well as the newer (ansible-2.21.5-py314) is still working
• I have tested fresh install with default p3.12 for both server and web
• I have tested on top of the successfull install a p3.11 switch for omero-web
• all 3 venvs were created as expected, the pip and certifi inside them had sufficiently high versions, see example output below. The testing of the "emudhra..." urls from these python venvs had the expected output, see below. The python versions were falling each time under the most recent version (which is probably typical case imho).

Example of the 3.11 situation (omero-web)

...
Testing https://dv-g3b-emudhra.we-have-a-problem.com/
URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1004)>

Testing https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1004)>
...
(venv-3.11) (base) [root@ome-train4-ap1 ~]# python -m pip --version
python -m pip show certifi | grep -E '^(Name|Version|Location):'
python -c 'import certifi; print("certifi bundle:", certifi.where())'
pip 26.2.2 from /opt/omero/web/venv-3.11/lib64/python3.11/site-packages/pip (python 3.11)
Name: certifi
Version: 2026.10.23
Location: /opt/omero/web/venv-3.11/lib64/python3.11/site-packages
certifi bundle: /opt/omero/web/venv-3.11/lib64/python3.11/site-packages/certifi/cacert.pem
(venv-3.11) (base) [root@ome-train4-ap1 ~]# python --version
Python 3.11.13