Upgrade ansible to v2.20.0 to support Python 3.14

[AndiDog]

Change description

Otherwise, with newer Python versions, we get the error Invalid conditional detected: module 'ast' has no attribute 'Str' in playbook runs.

Python 3.14, released in October 2025, removes ast.Str. Upgrading Ansible to a newer version ensures this isn't used anymore – I didn't look for the exact changelog item for that since we should anyway upgrade Ansible.

• Is this change including a new Provider or a new OS? (y/n) n
• If yes, has the Provider/OS matrix been updated in the readme? (y/n) n
• If adding a new provider, are you a representative of that provider? (y/n) n

Related issues

n/a

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kkeshavamurthy for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[AndiDog]

/test ?

[k8s-ci-robot]

@AndiDog: The following commands are available to trigger required jobs:

/test json-sort-check

/test pull-azure-vhds

/test pull-gcp-all

/test pull-goss-populate

/test pull-lint

/test pull-packer-validate

The following commands are available to trigger optional jobs:

/test pull-azure-sigs

/test pull-container-image-build

/test pull-ova-all

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[AndiDog]

/test pull-ova-all

[k8s-ci-robot]

@AndiDog: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-ova-all	bf2d55c	link	false	/test pull-ova-all

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mboersma]

Our build pipeline for Azure has nodes that still use Python 3.9, so we've kept this pinned here to avoid breaking that. And in the past when we've bumped this, users have complained it broke their builds. So jumping to 2.20 is likely to be problematic--is the ast.Str fix in an earlier ansible version?

We should also update the minimum Python version in ensure-python.sh to whatever ansible requires:

image-builder/images/capi/hack/ensure-python.sh

Lines 23 to 24 in d8f7a3c

	# Python 3.9 or later is required, specifically for Ansible 2.14 or later.
	minimum_python_version=3.9.0

I agree it's time to move forward with ansible and Python. I'll investigate how we can support a newer python for Azure builds.

[AndiDog]

The test error says that Python 3.12 is required at least, and that version is exactly two years old. One option to support older Python versions, probably with a very loud warning message, is to fall back to a slightly older Ansible version. Just an idea, even if I don't like it that much. @mboersma can you refer me to the Azure-related code that's problematic?

[mboersma]

can you refer me to the Azure-related code that's problematic?

The scripts for the pipelines are in images/capi/packer/azure/.pipelines, with stages.yaml as the top-level one. But there isn't any problematic code really, it's just that the actual Azure DevOps pipelines that run these for CAPZ reference images need to update Python on their build nodes.

It's something I can work around for now just by maintaining a fork. We should merge this so image-builder uses a version of Python that is actually supported. 😄 I was just hoping we could move the requirements forward more slowly, but I see 2.20.0 is the first version to support Python 3.14.

Let's do an image-builder release first, so we have an updated release tag that works with Python 3.9 - 3.11.

/hold for a checkpoint release

[mboersma]

Also it appears we're using Python 3.11 in the OVA build pipeline. 🫤