Python 3.5 is EOL and will stop being supported on pip >= 21 (expected in Jan 2021), so we should start making newer python versions available for tool developers to be able to create venvs without having to compile/download python themselves.
This is specially relevant because in the tutorials and help wikis the way of installing a python webservice/app is by creating the venv locally in the bastion environment.
Python 3.5 last release: https://www.python.org/downloads/release/python-3510/
People are encouraged to use the kubernetes system and containers, but not for jobs yet. https://wikitech.wikimedia.org/wiki/Help:Toolforge/Web/Python#Virtual_Environments_and_Packages.
Any tutorials that we host should suggest that procedure if the code is intended to be run on kubernetes as a web app. That said, we will be required to deprecate Debian Stretch pretty soon-ish even if we don't want to (and we do!). However, grid stuff still needs working python, and ideally virtualenvs!
There are debian packages for python runtimes other than the OS one that are hosted at https://people.debian.org/~paravoid/python-all/ by our own paravoid. We have not actually tried seeing what installing those would do on a bastion or exec node. That's something else we could experiment with for when buster's 3.7 is inevitably EoL as well.
Closing this with https://lists.wikimedia.org/hyperkitty/list/cloud-announce@lists.wikimedia.org/thread/EPJFISC52T7OOEFH5YYMZNL57O4VGSPR/, the Buster bastions have Python 3.7 and Kubernetes has 3.9 available.