In roles/base/tasks/main.yml we have this task:
- name: Upgrade pip
pip: name=pip state=latest
tags:
- packages
- skip_ansible_lint
It appears that this command runs outside of the virtualenvironment, so I'm not sure why we need to upgrade pip here. This also begs the question as to whether we need to move this task so that it's part of the sequence where the virtualenv is already activated instead of here, where we're installing system packages on Ubuntu.