The cryptography package now requires pip 19+ which is

not available by default when using the distribution packages
pyca/cryptography#5753

To resolve this, we upgrade pip in the virtualenv if it
is not new enough. We maintain the pin on <20 to ensure
that it is usable in both python2 and python3 environments
and that it doesn't bring any new setuptools requirements
into the mix.

Change-Id: I1adb92ee823558bd4e6b70ca961669ccf3e0434b

ansible/install/roles/rally/tasks/main.yml

@@ -15,6 +15,16 @@
     line: 'export REQUESTS_CA_BUNDLE={{ overcloud_ca_path }}'
   when: overcloud_ca_path is defined
 
+- name: Upgrade pip if it is old
+  shell: |
+    source "{{ rally_venv }}/bin/activate"
+    if [ "$(pip --version | cut -d' ' -f2 | cut -d'.' -f1)" -lt "19" ]; then
+       pip install --upgrade 'pip<20'
+    fi
+  args:
+    executable: /bin/bash
+    chdir: "{{ browbeat_path }}"
+
 - name: Install rally-requirements into rally-venv
   pip:
     requirements: "{{ browbeat_path }}/tools-requirements.txt"

requirements.txt

@@ -8,4 +8,6 @@ grafyaml>=0.0.7
 openstacksdk
 python-dateutil>=2.4.2
 python-openstackclient>=3.11.0
-pykwalify>=1.6.0
+pykwalify==1.7.0;python_version<'3'
+pykwalify>=1.8.0;python_version>='3'
+

test-requirements.txt

@@ -5,7 +5,8 @@
 hacking>=3.0.1,<3.1.0;python_version>='3' # Apache-2.0
 hacking>=1.1.0,<1.2.0;python_version<'3' # Apache-2.0
 
-pykwalify
+pykwalify==1.7.0;python_version<'3'
+pykwalify>=1.8.0;python_version>='3'
 coverage>=3.6
 pre-commit  # MIT
 pyrsistent==0.16.0;python_version<'3'