Skip to content

fix(build): stop replacing the pip bundled in the salt-master image - #5069

Open
ezekiel-alexrod wants to merge 1 commit into
development/134.0from
bugfix/MK8S-372-pin-pip-in-salt-master-image
Open

fix(build): stop replacing the pip bundled in the salt-master image#5069
ezekiel-alexrod wants to merge 1 commit into
development/134.0from
bugfix/MK8S-372-pin-pip-in-salt-master-image

Conversation

@ezekiel-alexrod

@ezekiel-alexrod ezekiel-alexrod commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Component: build, containers

Context:

Every image build has failed since yesterday evening, on every branch targeting
development/134.0, at _image_build:salt-master:

TypeError: InstallRequirement.install() got an unexpected keyword argument 'script_executable'

images/salt-master/Dockerfile upgraded pip with no version bound before
installing the Python dependencies. Salt ships its own pip inside the onedir and
patches it through relenv, so replacing that pip breaks every later
salt-pip install as soon as upstream changes the internals the patch relies on.
pip 26.2, published 2026-07-29 at 21:57 UTC, did exactly that. The last green
build of this branch, the nightly of 2026-07-28, still picked up 26.1.2. Only the
build job is affected: tests and lint pass.

MK8S-372.

Summary:

  • Drop the --upgrade pip rather than pin it. The bundled pip is by construction
    the one relenv supports, so nothing here has to track upstream pip releases and
    the build stops depending on whatever PyPI publishes that day.
  • Measured on Salt 3006.27: the onedir ships pip 25.2, and it installs
    etcd3gw ~= 2.6.0 and kubernetes ~= 33.1.0 on its own. The upgrade brought
    nothing. Should a future dependency really need a newer pip, the build will say
    so and the version can be pinned deliberately at that point.
  • SALT_MASTER_BUILD_ID goes to 2, since the image content changes. The tag
    becomes 3006.27-2 and propagates through CONTAINER_IMAGES; no other place
    hardcodes it.
  • development/133.0 is not affected: it still installs the system pip with
    its own pin, so there is nothing to merge up.

Acceptance criteria:

  • The build job goes green again, here and on every other open pull request
    once they pick this up.

  • Built locally from this branch: SUCCESS IMG BUILD salt-master:3006.27-2 in
    49 s, and inside the resulting image:

    pip 25.2 from /opt/saltstack/salt/lib/python3.11/site-packages/pip (python 3.11)
etcd3gw            2.6.0
kubernetes         33.1.0

    The bundled pip is untouched and both dependencies are installed.

An earlier revision of this branch pinned pip to 26.1.2 instead, on the
assumption that the bundled pip was too old for those dependencies. A probe
build disproved it, hence the simpler change.

No CHANGELOG entry: the regression never reached a release, and the images this
produces behave exactly as before.

@ezekiel-alexrod
ezekiel-alexrod requested a review from a team as a code owner July 30, 2026 14:18
@bert-e

bert-e commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Hello ezekiel-alexrod,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options
name description privileged authored
/after_pull_request Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval Bypass the pull request author's approval ⭐
/bypass_build_status Bypass the build and test status ⭐
/bypass_commit_size Bypass the check on the size of the changeset TBA ⭐
/bypass_incompatible_branch Bypass the check on the source branch prefix ⭐
/bypass_jira_check Bypass the Jira issue check ⭐
/bypass_peer_approval Bypass the pull request peers' approval ⭐
/bypass_leader_approval Bypass the pull request leaders' approval ⭐
/approve Instruct Bert-E that the author has approved the pull request. ✍️
/create_pull_requests Allow the creation of integration pull requests.
/create_integration_branches Allow the creation of integration branches.
/no_octopus Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity Change review acceptance criteria from one reviewer at least to all reviewers
/wait Instruct Bert-E not to run until further notice.
Available commands
name description privileged
/help Print Bert-E's manual in the pull request.
/status Print Bert-E's current status in the pull request TBA
/clear Remove all comments from Bert-E from the history TBA
/retry Re-start a fresh build TBA
/build Re-start a fresh build TBA
/force_reset Delete integration branches & pull requests, and restart merge process from the beginning.
/reset Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

@bert-e

bert-e commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Waiting for approval

The following approvals are needed before I can proceed with the merge:

  • the author

  • 2 peers

Peer approvals must include at least 1 approval from the following list:

@claude

claude Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

LGTM

Review by Claude Code

@ezekiel-alexrod
fix(images): stop replacing the pip bundled in the salt-master image
90954b2 
Every image build fails since pip 26.2 was published (2026-07-29 21:57 UTC):

    TypeError: InstallRequirement.install() got an unexpected keyword
    argument 'script_executable'

The Dockerfile upgraded pip with no version bound before installing the
Python dependencies. Salt ships its own pip inside the onedir and patches it
through relenv, so replacing that pip breaks every later `salt-pip install`
as soon as upstream changes the internals the patch relies on. pip 26.2 did
exactly that. The last green build of this branch, on 2026-07-28, still
picked up 26.1.2.

Drop the upgrade rather than pin it: the bundled pip is by construction the
one relenv supports, so nothing here has to track upstream pip releases, and
the build stops depending on whatever PyPI publishes. Measured on Salt
3006.27: the onedir ships pip 25.2, which installs `etcd3gw` and
`kubernetes` on its own, so the upgrade brought nothing.

Should a future dependency really need a newer pip, the build will say so,
and the version can be pinned deliberately at that point.

`SALT_MASTER_BUILD_ID` goes to 2, since the image content changes.

`development/133.0` is not affected: it still installs the system pip with
its own pin, so there is nothing to merge up.
@ezekiel-alexrod
ezekiel-alexrod force-pushed the bugfix/MK8S-372-pin-pip-in-salt-master-image branch from 144bda7 to 90954b2 Compare July 30, 2026 14:27
@ezekiel-alexrod ezekiel-alexrod changed the title Pin the pip installed in the salt-master image Stop replacing the pip bundled in the salt-master image Jul 30, 2026
@claude

claude Bot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

LGTM

Review by Claude Code

@ezekiel-alexrod ezekiel-alexrod changed the title Stop replacing the pip bundled in the salt-master image fix(build): stop replacing the pip bundled in the salt-master image Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ezekiel-alexrod @bert-e