Upgrade ansible to v2.20.0 to support Python 3.14

[AndiDog]

Change description

Otherwise, with newer Python versions, we get the error Invalid conditional detected: module 'ast' has no attribute 'Str' in playbook runs.

Python 3.14, released in October 2025, removes ast.Str. Upgrading Ansible to a newer version ensures this isn't used anymore – I didn't look for the exact changelog item for that since we should anyway upgrade Ansible.

• Is this change including a new Provider or a new OS? (y/n) n
• If yes, has the Provider/OS matrix been updated in the readme? (y/n) n
• If adding a new provider, are you a representative of that provider? (y/n) n

Related issues

n/a

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kkeshavamurthy for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[AndiDog]

/test ?

[AndiDog]

/test pull-ova-all

[mboersma]

Our build pipeline for Azure has nodes that still use Python 3.9, so we've kept this pinned here to avoid breaking that. And in the past when we've bumped this, users have complained it broke their builds. So jumping to 2.20 is likely to be problematic--is the ast.Str fix in an earlier ansible version?

We should also update the minimum Python version in ensure-python.sh to whatever ansible requires:

image-builder/images/capi/hack/ensure-python.sh

Lines 23 to 24 in d8f7a3c

	# Python 3.9 or later is required, specifically for Ansible 2.14 or later.
	minimum_python_version=3.9.0

I agree it's time to move forward with ansible and Python. I'll investigate how we can support a newer python for Azure builds.

[AndiDog]

The test error says that Python 3.12 is required at least, and that version is exactly two years old. One option to support older Python versions, probably with a very loud warning message, is to fall back to a slightly older Ansible version. Just an idea, even if I don't like it that much. @mboersma can you refer me to the Azure-related code that's problematic?

[mboersma]

can you refer me to the Azure-related code that's problematic?

The scripts for the pipelines are in images/capi/packer/azure/.pipelines, with stages.yaml as the top-level one. But there isn't any problematic code really, it's just that the actual Azure DevOps pipelines that run these for CAPZ reference images need to update Python on their build nodes.

It's something I can work around for now just by maintaining a fork. We should merge this so image-builder uses a version of Python that is actually supported. 😄 I was just hoping we could move the requirements forward more slowly, but I see 2.20.0 is the first version to support Python 3.14.

Let's do an image-builder release first, so we have an updated release tag that works with Python 3.9 - 3.11.

/hold for a checkpoint release

[mboersma]

Also it appears we're using Python 3.11 in the OVA build pipeline. 🫤

[mboersma]

@AndiDog we've updated our Azure build agents so they're now using python 3.12. So I remove that objection to this PR. 😄

If we can figure out how to get this to work with the OVA build pipeline, we can merge it.

[AndiDog]

/test pull-ova-all

[k8s-ci-robot]

@AndiDog: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-ova-all	25c8fea	link	false	/test pull-ova-all

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[AndiDog]

We only have Debian Bookworm with Python 3.11 in the kubekins image that we use in CI. Let's "just wait" until that gets updated in test-infra. I can keep the PR open.