tripleoci: excludes in yum/dnf conf images can break testing beds

In infra images, this is coming from [1].

The whole history of that is long; and there's many comments in there about what's going on. The crux is that due to many setuptools/pip bugs over time, we *need* the latest versions (to be able to even deal with requirements files, but many other little bugs have crept in too). However, on centos7 era, pip and system packages do not live nicely together. That's why we install the packages, *then* overwrite with latest versions from pip, *then* put the packages on hold to stop them being removed+re-installed again, which overwrites the upstream versions and creates a big mess (yes ... this happens :)

Two things -- Fedora now does a better job of keeping pip installs and rpm installs separate (as debuntu has always done). I would welcome someone really digging into this to understand what we can do. Also, pabelanger was mentioning that there might be better ways to put the packages on hold with dnf, such that they don't appear as completely missing. If someone has ideas on that, it's welcome too.

[1] http://git.openstack.org/cgit/openstack/diskimage-builder/tree/diskimage_builder/elements/pip-and-virtualenv/install.d/pip-and-virtualenv-source-install/04-install-pip#n188

It seems that the decision to hack the system is hitting us hard, at least on fedora. I discovered that even removing the excludes does not repair the missing `virtualenv-3` executable. Now I have to perform a dnf reinstall and *hope* that this will bring the executable I am looking for.

I really need the virtualenv-3 executable because I want to assure a python3 approach works and ansible pip module which creates virtualenvs does require executable name (it cannot use the mocule calling method: `python -m virtualenv`).

I am not sure how much of damage-control I will need to do in order to make it work.

I think that we are better-off if we stop altering system images. If inidividual job really needs some hacks, it should do this on its own (risk).

As removing the package-hack would be really introsive, I propose to stop doing it for fedora only initially, keeping it for centos-7.

How I workaround the issue for testing:

  https://opendev.org/openstack/ansible-role-virtualenv/src/branch/master/tests/playbooks/pre.yaml#L30

Long term, I think we can switch from excludes to dnf versionlock plugin (untested).

Thanks Paul.

I am currently testing https://review.openstack.org/#/c/645626/ which should make the logic of picking the correct virtualenv command to use bit more flexible, so it would work on pure and adulterated systems too.