* [stable-2.7] Wrap CLI passwords as AnsibleUnsafeText (#63352)
* isa string should rewrap as unsafe in get_validated_value
* _is_unsafe shouldn't be concerned with underlying types
* Start with passwords as text, instead of bytes
* Remove unused imports
* Add changelog fragment
* Update changelog with CVE.
(cherry picked from commit baeff7462d)
Co-authored-by: Matt Martz <matt@sivel.net>
* Update tests
This new script does not depend on ansible-test and provides much more robust job matrix testing.
It is also run on every job in the matrix now, to detect issues with jobs being re-run after matrix changes are made.
(cherry picked from commit d3da8e4a5b)
This avoids displaying the credentials in CI when retrying tests at maximum verbosity.
(cherry picked from commit b73e772)
Co-authored-by: Matt Clay <matt@mystile.com>
* prevent templating of passwords from prompt (#59246)
* prevent templating of passwords from prompt
fixes CVE-2019-10206
(cherry picked from commit e9a37f8e31)
* Improve performane of UnsafeProxy __new__
This adds an early return to the __new__ method of the UnsafeProxy object
which avoids creating the unsafe object if the incoming object is already
unsafe.
(cherry picked from commit c1e23c22a9)
(cherry picked from commit 490f17c7f9)
The docs now have multi-level breadcrumbs so including "Sanity Tests »" in the title on a sanity test page is redundant.
(cherry picked from commit b4494fa547)
(cherry picked from commit dd42aac878)
The nightly rpm builds were using a timestamp from the last git commit
in their Release field. Unfortunately, that was using author timestamp
which is nonsequential. Change to using commit timestamp which is
sequential.
note that this still has a cornercase if the branch's history is ever
rewritten.
(cherry picked from commit 97edfcc)
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
- use include_vars to set appropriate packages and pip packages per distribution and version
- install an older version of Docker CE on RHEL 8 since a dependency is unavailable
- disable warnings on tasks that are ok
- skip tests for CentOS/RHEL 6.
(cherry picked from commit d50c8c2b83)
Co-authored-by: Sam Doran <sdoran@redhat.com>
- use single include_vars task rather than multiple set_fact tasks
- use multi-line YAML to break up long conditionals
- use version() test rather than direct comparisions
- use different appstream package on RHEL since '@swig:3.0/default' is not working in the GA.
(cherry picked from commit 16d6fcf514)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Skip gitlab tests if dependencies aren't met
* Skip certain unittests if passlib is not installed
* Fix tests with deps on paramiko to skip if paramiko is not installed
* Use pytest to skip for cloudstack
If either on Python-2.6 or the cs library is not installed we cannot run
this test so skip it.
(cherry picked from commit 8acf71f78f)
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
- don't background the nuage-vsd-sim
- increase the asncy timeout
- use uri to actually query the simulator API to make sure it is ready for connections
(cherry picked from commit 911a2ec6d3)
* docsite: remove lexers which have been fixed in Pygments 2.4.0 (#57508)
* Remove lexers which have been fixed in Pygments 2.4.0.
* Add Pygments >= 2.4.0 to test runner.
* Fix pages that triggered lexer errors.
Co-Authored-By: Sviatoslav Sydorenko <wk.cvs.github@sydorenko.org.ua>
(cherry picked from commit 505c99265c)
* fixes 'could not lex literal_block' errors
- Replace private key that expired an 2019-06-20 with a key that does not expire
- Document how to generate a new GPG key using an input file
(cherry picked from commit b9d77b997e)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Use different package for DNF tests
Ninja caused errors in Fedora 30. This works in both Fedora 29 and 30.
* Fix git integration tests
Git >= 2.21.0 has either a bug or change in behavior where it errors when fetching a
repository containing submodules that are behind the upstream submodule commits.
It's weird and I don't fully understand it.
Get around this my checking out specific commits from a repository rather than
switch the origin URL.
* Fix PostgreSQL tests
The error message is slightly different.
(cherry picked from commit 18feeb51a8)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* [stable-2.7] win_get_url: ignore defender false positive in tests (#56812)
(cherry picked from commit 124400f319)
Co-authored-by: Jordan Borean <jborean93@gmail.com>
* Adapt tests to work without remote_tmp_dir.
As described in #53385 (and #31759), the docker connection driver did
not support privilege escalation. This commit is a shameless
cut-and-paste of the privilege escalation support from the `local`
connection plugin into the `docker` plugin.
This is a backport to stable-2.7 of #55816.
* sysctl will now return an error if the value is invalid
sysctl can fail to set a value even if it returns an exit status 0. More
details: https://bugzilla.redhat.com/show_bug.cgi?id=1264080. Because of
this in case of an invalid value or a read-only file system, sysctl
module would return OK, even though it didn't set anything. To be sure
that sysctl correctly applied the changes we also need to check the
output of stderr.
(cherry picked from commit 0432b7f252)
* Run sysctl with LANG=C
Because we are parsing sysctl stderr we need to make sure that errors
are persistent across different system language settings.
(cherry picked from commit a16128f778)
* Add changelog fragment for sysctl
(cherry picked from commit 3ad9d4d83c)
This has been broken for some time, but only noticed recently. Because
vyos_command isn't supported on ansible_connection=local, update our
testing to account for that.
Signed-off-by: Paul Belanger <pabelanger@redhat.com>
(cherry picked from commit 59d20e004e)
The documentation for the docker_container publish_ports options
erroneously stated that container ports must be "exposed" in order to
be "published".
(cherry picked from commit 5e74ecb4fd)
Implement a new method for shadow file parsing so it can be subclassed..
(cherry picked from commit f27eccabbd)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* [stable-2.7] Move missing library abort to use rather than import for netconf (#55384).
(cherry picked from commit b442706b54)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add changelog
* missing_required_lib not in 2.7
* psrp - Fix raw and script tests for connection plugin
* Fix error propagation with raw in psrp
* uncomment test
(cherry picked from commit fdf9df89f5)
* nxos_interface:DI: delay only when operation state check is requested (#54862)
* nxos_interface:DI: should only use delay when operation state check is requested
There is a 10 second delay that is added for every interface that is changed.
This delay should only occur when a task sets one of the `want` vars.
* /return/continue/
(cherry picked from commit 0fe6bf911a)
* changelog
Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>
* Warn when log_options values are not strings.
* Add changelog.
* Improve message.
* Improve formatting and formulation of other messages.
* Add test for warning.
* Trying double escaping.
(cherry picked from commit d64b17731d)
* The Univention modules have a issue with an unassigned variable.
The variable diff is only assigned if state is 'present', else the
variable is unused. But the module will return the diff variable as a
return value. If the state isn't 'present' the module will fail with an
python UnboundLocalError exception.
(cherry picked from commit 26fa97922a)
* Add a changelog fragment for PR 55083.
(cherry picked from commit b4ae654890)
* Added recently added return fields for query
* Defined type of string for older fields too
* Fix incorrect type for org_id
(cherry picked from commit 9f7584e311)
* Allow all of yum version compare operators
* * yum: name="foo >= VERSION" integration test
* changelog fragment
(cherry picked from commit 1532e31ec0)
* Correct behavior so that direction isn't required for default.
* Add more tests.
* 'disabled' values cannot be changed.
* Include 'not specified' in messages.
(cherry picked from commit 7d27348356)
* Performance fixes for net and org lookups
- Both methods had duplicate lookups
- This should significantly improve performance
- Currently untested
* Add ChangeLog file
* Change from bugfix to bugfixes and change indent
(cherry picked from commit c254b93796)
* correct openssl rsa to genrsa in acme doc fragment
* acme_certificate.py - updated route53 example to include wait: yes
(cherry picked from commit c11af3dbef)
The controller's fixup_perms2 uses filesystem acls to make the temporary
file for copy readable by an unprivileged become user. On Python3, the
acls are then copied to the destination filename so we have to remove
them from there.
We can't remove them prior to the copy because we may not have
permission to read the file if the acls are not present. We can't
remove them in atomic_move() because the move function shouldn't know
anything about controller features. We may want to generalize this into
a helper function, though.
Fixes#44412
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
(cherry picked from commit d15812fabf)
* nxos_igmp_snooping: group-timeout fails when igmp snooping disabled
group-timeout config will be rejected by the device if `ip igmp snooping` is disabled.
* raise a failure for this condition
* reorder the command list so that group-timeout is always last
* SA fixes
* SA fixes
* only call gt_dependency if gt
(cherry picked from commit 8c33ba3ecd)
* `nxos_facts` crashes with certain nxos images; e.g. `7.0(3)I7(3)` as a result of this call:
```
data = self.run('show lldp neighbors', output='json')
```
...which returns `ERROR: No neighbour information` when the device has no neighbors.
* This response causes httpapi's `handle_reponse()` to raise a ConnectionError, which is caught by `utils/jsonrpc.py` which is expecting `code` in the exception data:
```
except ConnectionError as exc:
display.vvv(traceback.format_exc())
error = self.error(code=exc.code, message=to_text(exc))
```
* Found by: `nxos_facts/tests/common/not_hardware.yaml:7`
(cherry picked from commit 874fd70d10)
* network.py:ActionModule:run: does not honor _handle_src_option failures
PR #50301 moved template error handling out of run() and into its
own method in `_handle_src_option`; however, after the change run()
ignores the return value so any errors are ignored.
Reproduceable with `nxos_config/tests/common/src_invalid.yaml`
Verified fix with `nxos_config/tests/common/src_*` tests.
Ref:
71113ee291 (diff-7477bf046013758366cc85b06f90709aR43)
* nxos_config/tests/common/src_basic: Updated to test with src
This test was not actually testing with `src:` as it should have.
* Revert 412d7e change to plugins/action/network.py
PR #52912 fixed this already.
* nxos_config: fix src_invalid test
(cherry picked from commit d69239c440)
* nxos_interfaces_ospf: fix passive-interface states & check_mode
This fix addresses issues #41704 and #45343.
The crux of the problem is that `passive-interface` should have been treated as a tri-state value instead of a boolean.
The `no` form of the command disables the passive state on an interface (allows it to form adjacencies and send routing updates). It's essentially an override for `passive-interface default` which enables passive state on all OSPF interfaces.\*
This `no` config will be present in `running-config`.
\**See `router ospf` configuration.*
Since both enable and disable states are explicit configs, the proper way to remove either of these is with the `default` syntax.
Passive-interface config syntax:
```
ip ospf passive-interface # enable (nvgens)
no ip ospf passive-interface # disable (nvgens)
default ip ospf passive-interface # default (removes config, does not nvgen)
```
Code changes:
* `passive_interface` param changed from boolean to string, restricted to `true`,`false`,`default`.
* Several passive-interface specific checks were added because the existing module logic tends to test for true or false and doesn't handle the None case.
* Fixed `check_mode`.
Sanity verified on: N9K,N7K,N3K,N6K
* Fix doc header
* Unit tests for passive-interface
* doc fix#2
* Fix indent for SA
* Remove 'default' keyword, restore bool behavior
* remove changes to sanity
(cherry picked from commit 20fb77c49b)
* nxos_linkagg: `group` type mismatch causes idempotency failure
* `group` values need to be cast; e.g.
```
want = {'group': '20'}
have = {'group': 20}
```
* Found with N7K `sanity` test
* nxos_linkagg: change group param type to str
(cherry picked from commit 66fe6bfa0b)
* The test was setting `lsa max` value to 2222 but the default `lsa hold` value is 5000.
* `hold` must be less than `max` or else the device raises a clierror, so I just added a lower non-default `hold` value to satisfy the cli.
(cherry picked from commit c1e9f594d2)
The N7K is another platform that raises an error when trying to remove
an RP w/prefix-list specified. These tests are now skipped for N7K.
(cherry picked from commit c5de2233d0)
* Fixed another problem where `group-timeout` was processed before `ip igmp snooping` was enabled
* `sanity` playbook:
* N6K: `show ip igmp snooping | json` succeeds on the device but doesn't return any data in body; added a skip to the sanity playbook to keep it out of CI
* Added a setup task to do initial cleanup on the device
(cherry picked from commit 07774b4ccf)
Basic passwords are rejected by the nxos device unless `no password strength-check`
is configured. This change just makes the password meet the minimum strength checks.
(cherry picked from commit 591e0ffb69)
Test yaml fixes for n3048:
* 3048 does not support bidir option
* 3048 cannot remove rp-address if prefix-list/route-map is present
* yes: no ip pim rp-address x.x.x.x
* no: no ip pim rp-address x.x.x.x prefix-list foo
* no: no ip pim rp-address x.x.x.x route-map bar
This test now passes on N9k/N7k/N6k/N3k.
(cherry picked from commit ea0ef3b2e1)
* nxos_hsrp: fix 'sh_preempt': <unknown enum:>
Some older nxos images fail to set this attr value. This fix checks for
unknown enum and issues a second (unstructured) call to the device to get
the data.
* add whitespace for pep8
(cherry picked from commit 5dc65d0dfc)
* Fix 'defaults' option in the nxos_config module
Nxos get_config is allways called with the 'all' option.
* Fix flag's calculation
* Add tests
* nxos_config: the 'backup' option take into account the value of 'defaults' option
If 'defaults' option is true, the running-config backup is done with the all
keyword.
(cherry picked from commit 87a01df6ad)
Searching for digits somewhere in the output line will also match VLAN name (lines) starting with digits.
Fixes issue #50998
(cherry picked from commit b1c295386f)
Fixes#53236
* If dispatch() rpc response has data element
return the xml string from `<data>` element
else return the complete xml string from
`<rpc-reply>`.
(cherry picked from commit aac5ef5e13)
When using before and after in combination, the opposite behavior was induced. This PR makes the the replacement happen between the specified patterns as intended.
* Added integration tests
* Add changelog, porting guide entry, and minor doc fixes.
(cherry picked from commit cf69ec5db0)
Co-authored-by: Evan Kaufman <evan.kaufman@gmail.com>
* Catch all request timeouts for winrm connection
The current implementation only catches 'ConnectTimeout' exceptions.
Instead we should catch 'Timout' which also catches ReadTimeout
exceptions.
Improves on: #51744
Co-Authored-By: westphahl <westphahl@gmail.com>
* Changelog for winrm error handling improvement
* Fix Foreman returning host parameters
Foreman (1.20) returns the `all_parameters` key as a list of dicts, not a dict of key-value pairs.
* Fix for type error
The empty type here should be a dict, not a list as is has a `get` done
on it next.
(cherry picked from commit e94e80c79e)
* Return dict directly to avoid failing key lookup
(cherry picked from commit 545b98645d)
* Add changelog fragment for #54333
* Add write helper.
* Adjust modules (except openssl_certificate).
* Adding tests for mode (with openssl_privatekey).
* Add openssl_certificate support.
* Never, ever remove the output file before actually trying to generate new content for it.
Removal is only allowed when state=absent, or when the object has been regenerated and the result needs to be written to that place.
* Add changelog.
* Extend test.
(cherry picked from commit d7a273273a)
* grafana_datasource: use the Ansible helpers to get basic auth header
Module was not using the helpers, so an error occured in python3.
Fixes: #49147
* Update grafana_datasource_fix_basic_auth_python3_issue.yaml
* Add documentation for tags and network access
* Documentation changes from dag and sam
* Change examples to include proper YAML and not dict
* Update lib/ansible/modules/network/meraki/meraki_admin.py
Co-Authored-By: kbreit <kevin.breit@kevinbreit.net>
(cherry picked from commit bcbcd209f4)
* flatpak_remote: Handle empty output in remote_exists (#52010)
`flatpak remote-list -d` can return an empty output on Fedora 29 (version 1.2.0).
(cherry picked from commit fcb6f136cd)
* Adds changelog fragment for 52010 backport
The tests need to be updated to support newer ansible-runner releases.
(cherry picked from commit 777b726e4f)
Co-authored-by: Matt Clay <matt@mystile.com>
This is a backport of #48833 for stable-2.7.
The compose, groups, and keyed_groups functionality of the openstack
inventory plugin was broken:
- the plugin was not passing the correct variables to the
Constructable methods for compose and groups
- the plugin was simply never calling the appropriate method for
implementing keyed_groups
This commit fixes both issues.
(cherry picked from commit 5a9c767662)
This reverts commit 05772233ad.
I mistakenly merged this before it hit devel. The devel change was
modified to change this in a different place. Reverting so that we can
make that fix properly.
* [stable-2.7] Correctly count processors on ARM systems. (#52884)
- Add unit tests for Linux CPU info
- Add cpuinfo output from several systems for unit tests
Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 55306906cf)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Add changelog
* Revert "allow caller to deal with timeout (#49449)"
This reverts commit 63279823a7.
Flawed on many levels
* Adds poor API to a public function
* Papers over the fact that the public function is doing something bad
by catching exceptions it cannot handle in the first place
* Papers over the real cause of the issue which is a bug in the timeout
decorator
* Doesn't reraise properly
* Catches the wrong exception
Fixes#49824Fixes#49817
* Make the timeout decorator properly raise an exception outside of the function's scope
signal handlers which raise exceptions will never work well because the
exception can be raised anywhere in the called code. This leads to
exception race conditions where the exceptions could end up being
hanlded by unintended pieces of the called code.
The timeout decorator was using just that idiom. It was especially bad
because the decorator syntactically occurs outside of the called code
but because of the signal handler, the exception was being raised inside
of the called code.
This change uses a thread instead of a signal to manage the timeout in
parallel to the execution of the decorated function. Since raising of
the exception happens inside of the decorator, now, instead of inside of
a signal handler, the timeout exception is raised from outside of the
called code as expected which makes reasoning about where exceptions are
to be expected intuitive again.
Fixes#43884
* Add a common case test.
Adding an integration test driven from our unittests. Most of the time
we'll timeout in run_command which is running things in a subprocess.
Create a test for that specific case in case anything funky comes up
between threading and execve.
* Don't use OSError-based TimeoutError as a base class
Unlike most standard exceptions, OSError has a specific parameter list
with specific meanings. Instead follow the example of other stdlib
functions, concurrent.futures and multiprocessing and define a separate
TimeoutException.
* Add comment and docstring to point out that this is not hte Python3 TimeoutError
(cherry picked from commit bd072fe83a)
* win_reboot - Fix rc validation when using psrp and add extra docs (#53711)
* win_reboot - Fix rc validation when using psrp and add extra docs
* Revert boot time command and fix docs
(cherry picked from commit 3d23e47c53)
* win_reboot - fix broken tests after recent commit (#53722)
(cherry picked from commit d9795bad98)
* Don't raise AnsibleConnectionFailure if the ssh_process has already died. Fixes#53487
* Better support for file not found messages
* Add changelog fragment
(cherry picked from commit e9f9bca)
Co-authored-by: Matt Martz <matt@sivel.net>
* Add missing dict entry for changelog generation.
* Enforce str and list types on sections.
* Check type of section list items.
* Support non-ascii characters in changelogs..
(cherry picked from commit 90a38670be)
Co-authored-by: Matt Clay <matt@mystile.com>
In pyyaml versions before 5.1 the default_flow_style for yaml.dump
was None. Starting with 5.1 it is now False. This change explicitly
sets the value to None to maintain the original to_yaml behavior.
The change to pyyaml was made in the following commit:
507a464ce6
(cherry picked from commit 7f0e09aa31)
Co-authored-by: Matt Clay <matt@mystile.com>
* Backporting the logical changes from #51953 to restore functionality on the newer 1Password CLIs v0.5.5+.
* Adding changelog fragment for this backport PR.
* [stable-2.7] Ensure Clear Linux parsing is actually parsing a Clear Linux host and all others fall back to NA (#53298)
Fixes a bug where parse_distribution_file_ClearLinux() was called on CoreOS (and probably many other distros) and it returned True since it successfully parses the distribution file. Since this file exists on many Linux distributions and they are a very similar format, add an additional check to make sure it is Clear Linux.
Change the order in which distribution files are processed so NA is last. This prevents a match on CoreOS hosts since they also have /etc/os-release and the called matching function for NA is very general and will match CoreOS.
* Add changelog
* Add unit tests
Only add tests for Clear Linux parsing since that was the cause of this issue.
(cherry picked from commit 1d91e03119)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Use different import for 2.7
* Output warnings from docker daemon on container create and update.
* Accept warning for blkio_weight instead of idempotency.
* Value quoting.
* Avoid loop variable conflict.
* Add changelog.
* Make one test case faster.
* Add 'Docker warning: ' prefix.
* Add a generalized warning reporting function.
(cherry picked from commit 3117900b1e)
* changelog
* combine provided variables and host vars inside of constructing groups to take into account composed variables
let composed variables "win"
* fix whitespace
* Allow user to control hash behavior
(cherry picked from commit 4172d68dc3)
* Removing a swarm node does not work with docker-py < 2.4.0, since it calls client.inspect_node(). (#53565)
For the same reason, docker_node requires docker >= 2.4.0.
(cherry picked from commit c75da35595)
* Reconstructing a change from devel which is required to make usage detection work this way.
* [docker_image] fix the changed state for tagging and pushing
Signed-off-by: Jakob Ackermann <das7pad@outlook.com>
* [docker_image] add tests for (force) tagging and force pushing
Signed-off-by: Jakob Ackermann <das7pad@outlook.com>
* [docker_image] add a news fragment for the fixed force tag/push behavior
Signed-off-by: Jakob Ackermann <das7pad@outlook.com>
(cherry picked from commit 13ab9a61a8)
* Fix for "AttributeError: 'module' object has no attribute 'cursors'" (#49191) (#1)
* Fix for "AttributeError: 'module' object has no attribute 'cursors'" (#49191)
* Adding changelog fragment for issue #49191 and the following PR.
* Update lib/ansible/module_utils/mysql.py
Co-Authored-By: timorunge <timorunge@users.noreply.github.com>
(cherry picked from commit b45b599433)
* Fixing unexpected keyword argument 'cursorclass' error after migration from MySQLdb to PyMySQL
* Adoptions for mysql.py as suggested by felixfontein.
* Adding changelog fragment.
(cherry picked from commit 47190088b4)
* Fixed crash with hidden files
added "-force" parameter on "Get-Item" cmdlet. this is needed to get file info if the file is "hidden"
without this option modules like win_file, win_template, win_copy crashes on hidden files. this is because with "test-path" it sees that the file exists, but "get-item" can't get the file info.
for more information on "-force option": https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-item
* Add changelog and integration tests
* fix tests for older Windows versions
(cherry picked from commit 3bc474bf99)
* win_domain: fix issue when running without credential delegation
* Add check for reboot is required to complete role e install
* Fix changelog sanity issue
* removed meta file accidentally committed
(cherry picked from commit 008db85d44)
* Improve subject field validation.
* Add country name idempotency test.
* Add failed country name test.
* Add changelog.
(cherry picked from commit b2e992cecd)
* Warn user to send a password if the privatekey is password protected on openssl_cert and openssl_csr docs
Co-Authored-By: johnwesley <johnwesley@users.noreply.github.com>
* docker_swarm_service: rename return variable to swarm_service (#53229)
* Rename return variable to swarm_service.
* Add changelog.
* Add that old name will stay in Ansible 2.7.x.
(cherry picked from commit 61abbfc269)
* Keep old variable for backwards compatibility.
* Decreasing docker_swarm requirements.
* Fixing docker-py / docker API version requirements, and some comments.
* Add changelog.
* Only send parameters specified by user to docker daemon.
* Extend labels test: not specifying == keep labels.
* Bump minimally required docker-py version for docker_node and docker_node_facts to 2.4.0.
* Prevent crashing when publish or healthcheck is not provided.
* Similarly to docker_swarm tests, only execute docker_node tests on real VMs and restart docker daemon when tests are done.
(cherry picked from commit 8e26c2dfbe)
* Type error in openssl_certificate (#47508)
* Fixed#47505: Type error in openssl_certificate
* Use to_bytes instead of str.encode in SelfSignedCertificate. Updates #47508
* Use to_bytes instead of str.encode in OwnCACertificate
* Added integration tests for openssl_certificate: selfsigned_not_before/after and ownca_not_before/after
(cherry picked from commit 5b1c68579d)
* openssl_certificate, fixed has_expired to check the cert expiration date (#53168)
(cherry picked from commit d5d92e4a70)
* Use fixed timestamp in past instead of relative time (relative times are a feature of devel).
* Add changelog for #47508.
The openssl_csr docs use “should” where (at least following IETF nomenclature) “must” would be more accurate.
See #53141
+label: docsite_pr
(cherry picked from commit 14d4a4fc3b)
* Fixed lvol ValueError with float size.
(cherry picked from commit 85bd54dfa7)
* Fixed lvol ValueError with float size.
(cherry picked from commit ecdd835b6c)
* Initialized locale using system default.
Changed size validation from float() to locale.atof().
(cherry picked from commit d187b95929)
* Added changelog fragment.
(cherry picked from commit d1f6b1220c)
* Used C locale instead of relying on system locale.
(cherry picked from commit 90b3d96869)
* Revert "use list instead of tuple and remove md5 on ValueError (#51357)" c459f040da.
* Modify the correct variable when determining available hashing algorithms.
(cherry picked from commit 23a6b88dd2)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Add support for macro contexts that have colons (#51853)
Currently when used with macro contexts that have a colon inside,
macro_name gets truncated. A common case is contexts that represent a
Windows drive. Examples:
- 'C_DRIVE_THRESHOLD: "C:"'
- 'C_DRIVE_THRESHOLD: "D:"'
This happens because line 189 assumes there are only one colon in
macro_name, and thus two substrings to join.
To solve this, it is necessary considering that macro_name could have
more that one colon. After the split, the first element is the proper
Zabbix macro name. Then, the solution is joining all the remaining
substrings after that.
This is backwards compatible in the case macro_name have only one colon.
(cherry picked from commit d1d4f4bd27)
* Add support for macro contexts that have colons
Currently when used with macro contexts that have a colon inside,
macro_name gets truncated. A common case is contexts that represent a
Windows drive. Examples:
- 'C_DRIVE_THRESHOLD: "C:"'
- 'C_DRIVE_THRESHOLD: "D:"'
This happens because line 189 assumes there are only one colon in
macro_name, and thus two substrings to join.
To solve this, it is necessary considering that macro_name could have
more that one colon. After the split, the first element is the proper
Zabbix macro name. Then, the solution is joining all the remaining
substrings after that.
This is backwards compatible in the case macro_name have only one colon.
* Add more tests.
* Added tests for CA options.
* Don't run in docker-in-docker situations where docker daemon becoming instable is really dangerous. Also, restart docker daemon after tests.
* Only run CA tests when openssl_certificate can be run (which is not the case for RHEL7, see #34054).
* Add comment on why docker-based CI runs are skipped.
(cherry picked from commit 04bfec9dfe)
* Improve idempotency checking: only consider parameters which are part of the generated spec.
* Properly handle rotate_worker_token and rotate_manager_token.
(cherry picked from commit 42ae6cdb95)
* Ensure play order is obeyed
it was being ignored depending on other options
also added tests for each order (except shuffle) both serial and not
fixes#49846
(cherry picked from commit cfba6dfe91)
* OpenSUSE - Add OpenSUSE 15 test containers ci_complete
* Reset matrix back to normal
* Set container version instead of latest
* Remove old Docker completion file
(cherry picked from commit 3635c59b23)
Katello: Added product to the dict choices (#49776)
* Added product to the dict choices.
Following issue 48594 where product is not a recognised choice: https://github.com/ansible/ansible/issues/48594
* fixed doc
added - product to the doc
* split line 549
to correct ci test splitting line 549
* Create 49776-product_fix_katello_foreman_module.yaml
changelog fragment creation
(cherry picked from commit d3fcdae4ad)
When no repos are defined, the `repo` variable is undefined. Therefore
append it only to the result if a repo was found. Otherwise Ansible will
fail with an UnboundLocalError.
(cherry picked from commit 0469134f16)
* Filter DNSimple request by record name.
The request was not filtered and DNSimple returns only the first 100
records so if the number of records is larger the check could fail.
This patch fixes the issue and also makes the check to perform better.
* Add changelog fragment.
(cherry picked from commit e0274adafe)
* test - add setup target that creates the nobody user
* do not set explicit gid/uid for nobody user
* Do no create group and only touch basic attributes
(cherry picked from commit 17bfc60423)
* Fixing state=present for jenkins_plugin module (#52051)
(cherry picked from commit 5f4840aaa8)
* Adding changelog fragment for PR #52051 (#52687)
(cherry picked from commit ee14b123f3)
* Updating update_url for jenkins_plugin (#52086)
(cherry picked from commit f49469f7bf)
* Adding changelog fragment for PR #52086 (#52689)
(cherry picked from commit 280e8911ce)
* mysql_user: Match quotes, double quotes and backticks when checking current privileges
(cherry picked from commit 1ae0e21383)
* Add changelog fragment for PR #40092
(cherry picked from commit 8974ce3c78)
* mysql_user: fix malformed regex used to check current privileges
* Properly handle unauthenticated yum proxy config (#51915)
Fixes#51548
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 2721ed260e)
* Fix: Yum module does not use proxy when username is not set #51548 (#51994)
* add test of yum with proxy
* Properly handle unauthenticated yum proxy config
Fixes#51548
* shell executable is bash
(cherry picked from commit c2a409a9e0)
* Raise AnsibleConnectionError on winrm con errors
Currently all uncaught exceptions of the requests library that is used
in winrm will lead to an "Unexpected failure during module execution".
Instead of letting all exceptions bubble up we catch the connection
related errors (inkl. timeouts) and re-raise them as
AnsibleConnectionError so Ansible will mark the host as unreachable and
exit with the correct return code.
This is especially important for Zuul (https://zuul-ci.org) to
distinguish between failures and connection/host related errors.
* Update lib/ansible/plugins/connection/winrm.py
Co-Authored-By: westphahl <westphahl@gmail.com>
* Add changelog fragment
* Disallow use of remote home directories containing .. in their path
* Add CVE to changelog
(cherry picked from commit b34d141)
Co-authored-by: Matt Martz <matt@sivel.net>
* Update GetBiosBootOrder to use standard spec resources (#51764)
* update GetBiosBootOrder to use standard spec resources
* handle case where BootOrder is present but BootOptions is missing
(cherry picked from commit e0538610bf)
* add changelog fragment and fix merge issue
* Test out Server 2019 - ci_complete
* run tests and continue on error - ci_complete
* Add the full matrix back in
(cherry picked from commit 0334c20630)
This is an implementation of 8bffcf8e50
that was done in the PR https://github.com/ansible/ansible/pull/48082 to devel.
The changes have been manually brought across to the the stable-2.7 branch as it
cannot be cleanly cherry picked due to the substantial differences in become
between these versions.
Currently we impersonate the `SYSTEM` token in order to elevate our become
process with the highest privileges it has available but there are some edge
cases where the first `SYSTEM` token we come across doesn't have the
`SeTcbPrivilege` which is required for the above. This PR adds a further check
in the search for a `SYSTEM` token to make sure it has the `SeTcbPrivilege`
before continuing.
Fixes: #51534
* set valid_until equal to current time + spot_wait_timeout
* add setting ValidUntil to value
* add changelog fragment
* fix shebang issue
(cherry picked from commit d40f0313e2)
* [stable-2.7] ios retry config if section filter fails (#49485)
* Attempt to work around devices that don't understand | section
* Fix case of no flags
(cherry picked from commit 6caed0c)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add changelog
* aws_ec2 Implement the missing 'region discovery' (#51333)
* aws_ec2 Implement the missing 'region discovery'
fixes#45288
tries to use api as documented (which seems to fail in latest boto3 versions)
and fallback to boto3 'hardcoded' list of regions
* fixes and cleanup, add error for worst case scenario
* fix tests, remove more unused code
* add load_name
* acually load the plugin
* set plugin as required
* reverted test changes, removed options tests
* fixes as per feedback and cleanup
* Allow default regions list to use flexible credential types
* recent changes to args for hosted template file broke the test; changed test to use a specific known-working commit instead of `master`.
* long-term may want to consider hosting the template in httptester or just embedding a local copy
(cherry picked from commit 46bf387)
Co-authored-by: Matt Davis <mrd@redhat.com>
* remove default from delegate_facts to inherit (#45492)
* remove default from delegate_facts to inherit
fixes#45456
* test delegate_facts
* added note about inheritance and defaults
* yamllint
(cherry picked from commit 8743e6ae2e)
* added changelog
* Add coherency between check and normal mode see issue #24633
* Add changelog fragment for the PR
* Make change following PR comment
* Remove trailing whitespace
(cherry picked from commit 240d1a6afb)
* Always check envvars when auth parameter is not provided
This will make it so that all code using the get_api_client
method will make use of the environment variables, instead of
silently ignoring them if default values haven't been set. This
affects at least the k8s lookup plugin.
* Add changelog
(cherry picked from commit 0be66113d4)
* description updated to mention valid value
The only valid value for userns_mode on docker run command is "host". This should be mentioned in description because it is hard to find in docker documentation as well: https://github.com/docker/docker.github.io/issues/7071
(cherry picked from commit d9135f3960)
* Update lib/ansible/modules/cloud/docker/docker_container.py
Co-Authored-By: TimoKramer <4785848+TimoKramer@users.noreply.github.com>
(cherry picked from commit 27dc399885)
* If network cliconf support `supports_generate_diff` in
that case diff between running and cnadidate config
is generated within Ansible and if check_mode is enabled
in that case return only diff without actually invoking
edit_config()
(cherry picked from commit 8f5cd049d6)
* Docs: Show parameter types (in purple)
* Changes based on feedback
* Remove leftover statement after review
* Simplify TOC and support section
* Add missing 'v' to version_added
* Remove the v for version
* Update docs/templates/plugin.rst.j2
Co-Authored-By: dagwieers <dag@wieers.com>
* Update docs/templates/plugin.rst.j2
Co-Authored-By: dagwieers <dag@wieers.com>
* Move Author into Support section
* Avoid more "isn't included in any toctree" errors
* Add Red Hat support section, list module status
(cherry picked from commit 76450fd1c2)
* Docs: Add a separate "seealso" section to the module docs
to list related modules and/or related references. This clears up the notes
section for things that are actual notes.
So you can add a section in your module documentation and four types of
references are possible.
seealso:
# Reference by module name
- module: aci_tenant
# Reference by module name, including description
- module: aci_tenant
description: ACI module to create tenants on a Cisco ACI fabric.
# Reference by rST documentation anchor
- ref: aci_guide
description: Detailed information on how to manage your ACI infrastructure using Ansible.
# Reference by Internet resource
- name: APIC Management Information Model reference
description: Complete reference of the APIC object model.
link: https://developer.cisco.com/docs/apic-mim-ref/
This PR also includes:
- Implements ansible-doc support
- Implements schema support for the seealso options
- Updates to the development documentation
- Rename filter convert_symbols_to_format to rst_ify, cfr the existing html_ify and tty_ify filters
- This makes the existing template a lot easier to read and fixes the confusion I had myself rereading the template (again).
- We fixed the possible suboption types (which was limited to 'bool' only)
* Use latest stable instead of devel docs
(cherry picked from commit baf0ad2309)
* ansible-test: Add Ubuntu 18.04 to Shippable CI nodes
* re-add ubuntu1604/3 to matrix
* forgot to add environment for git kill gpg-agent
(cherry picked from commit 828df4b336)
* Catch SSH authentication errors and don't retry multiple times to prevent account lock out
Signed-off-by: Sam Doran <sdoran@redhat.com>
* Subclass AnsibleAuthenticationFailure from AnsibleConnectionFailure
Use comparison rather than range() because it's much more efficient.
Signed-off-by: Sam Doran <sdoran@redhat.com>
* Add tests
Signed-off-by: Sam Doran <sdoran@redhat.com>
* Make paramiko_ssh connection plugin behave the same way
Signed-off-by: Sam Doran <sdoran@redhat.com>
* Add changelog
Signed-off-by: Sam Doran <sdoran@redhat.com>.
(cherry picked from commit 9d4c0dc111)
Co-authored-by: Sam Doran <sdoran@redhat.com>
Signed-off-by: Sam Doran <sdoran@redhat.com>
* file - allow touch on files not owned by user
* use Sentinal value and preserved existing args
* Do no instantiate the Sentinel object
(cherry picked from commit 419727a6da)
* check for result['status'] in systemd module
* instead of checking for result['state'], actually check for chroot and warn
* allow systemctl status to work if in a chroot, update warn text
* simply change warning message
(cherry picked from commit 37960ccc87)
* Fix subversion integration test on Fedora 29.
This upgrades the sqlite-libs and subversion packages to make sure
that the version of sqlite expected by subversion is installed.
* Fix compatibility with RHEL and CentOS.
(cherry picked from commit d4dbc7f2e0)
Co-authored-by: Matt Clay <matt@mystile.com>
* Corner case in which import_role would add another instance of a role with the same signature into roles: when it already existed there.
roles:
- name: a
tasks:
- import_role: name=a
would execute role 'a' 3 times instead of the intended 2 (x2 in roles: phase +1 in tasks:)
* added tests
(cherry picked from commit eca7c3c8c7)
* [docker_container] Failing on non-string env values (#49843)
* [docker_container] Failing on non-string env values
Fixes#49802
* Clarify failure message
Co-Authored-By: DBendit <David@ibendit.com>
* Fixup from review
(cherry picked from commit d62d7176b0)
* Turn fail into warning for 2.7 backport.
* Fix test for backport
The behaviour in the backport is to warn rather than error
* Describe labels and container_labels correctly
* Clarify reserve_memory and limit_memory docs
* Remove default from container_labels doc
* Remove trailing whitespace
* Document min api version for configs and secrets
* Add changelog fragment
* Specify type on labels and container_labels
* Consolidate required API version descriptions
* Update reserve and limit memory docs
* Use correct power-of-two units
* Remove description about limit_memory minimum 4mb
(cherry picked from commit 644057e9ec)
* fixes issue 50296
* fixes the indentation of the return statement
* Adds a conditional test into `_find_systems_resource()` to check the existence
of the Members of System resource
* updates the error message
* harden the conditional test
* Add a changelog
(cherry picked from commit 94a1d86d70)
* docker_swarm_service: use exact name match when finding services
The Docker API's filtering support allows filtering for substring
matches which means that when we filter the list of running services we
may accidentally match a service called "foobar" when looking for a
service named "foo".
Fix this by filtering the list of services returned from the Docker API
so that name matches are exact. It is still worth passing the filter
parameter to the Docker API because it reduces the number of results
passed back which may be important for remote Docker connections.
Closes 50654.
* add changelog fragment for #50654
(cherry picked from commit fd32760d7a)
* Added documentation around using vmware dynamic inventory plugin
* Fixed bug for populating host_ip in hostvars for given inventory host
* VMware: Add properties in vmware_vm_inventory
Fixes: #50249
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit af914695e6)
* Move var_blending test inventory into test.
* Remove Amazon specific inventory entry for tests.
* Remove Azure specific inventory entry for tests.
* Move var_precedence test inventory into test.
* Move unicode test inventory into test.
* Remove unused inventory entry.
* Move gathering_facts test inventory into test.
* Move delegate_to test inventory into test.
* Clean up inventory for binary_modules test.
* Clean up integration test inventory..
(cherry picked from commit e5094e8071)
Co-authored-by: Matt Clay <matt@mystile.com>
Download package from S3 since the previous location no longer exists.
(cherry picked from commit fd56788a14)
Co-authored-by: Matt Clay <matt@mystile.com>
* Expand user and variables in ca_certificates paths.
This is a fix specific for stable-2.7. In devel (and stable-2.8),
this problem is fixed by #48473. That PR adds argument spec
validation for list elements.
* Add changelog.
* Add ability for reboot module to work for AIX
* changelog for AIX reboot support.
(cherry picked from commit 1dac10e5c3)
Co-authored-by: trogdor_the_burninator <gforster@users.noreply.github.com>
Signed-off-by: Sam Doran <sdoran@redhat.com>
* Minor cleanup of code-smell tests.
* Add exception handling for YAML load..
(cherry picked from commit e7426e3795)
Co-authored-by: Matt Clay <matt@mystile.com>
* resolved conflicst
* adding fragment
* generalize using rest api
* make vmss smaller
* even smaller
* size can't be smaller
* removed some unnecessary things
* removed too much
* additional fix needed
Add auth_timeout parameter when supported
Paramiko 2.2 introduces the auth_timeout parameter. This will set the
parameter to the same value of the timeout parameter to prevent
"Authentication timeout" errors.
(cherry picked from commit e7f21dd1af)
Conditionally add auth_timeout to ssh.connect
Renamed sock_kwarg to ssh_connect_kwargs and conditionally added the
auth_timeout parameter based on the installed paramiko version.
(cherry picked from commit 6c41e97eee)
Add changelog fragment
(cherry picked from commit 7679a92db7)
* Ensure that the src file contents is converted to unicode in diff info. Fixes#45717
* Fix up and cleanup
* The diff functionality in the callback plugins should have the
to_text() calls removed since we're now doing it in ActionBase
* catching of UnicodeError and warnings in the callback diff
functionality from 61d01f549f haven't been
needed since we switched to to_text so remove them.
* Add a note to ActionBase's diff function giving an example of when the
diff function will be inaccurate and how to fix it
* Fix callback get_diff() tests
I believe the unittests of callback's get_diff() were wrong. They were
sending in a list where strings were expected. Because previous code
was transforming the lists into strings via their repr, the previous
tests did not fail but they would have formatted the test cases output
in an odd way if we had looked at it.
(cherry picked from commit 95e77ac)
Co-authored-by: Matt Martz <matt@sivel.net>
* set ansible_os_family from name variable in os-release for clearlinux OS (#49639)
* set ansible_os_family from name variable in os-release for clearlinux system
Signed-off-by: Josue David Hernandez Gutierrez <josue.d.hernandez.gutierrez@intel.com>
* Add os_family for clear linux and clear linux mixes
Signed-off-by: Josue David Hernandez Gutierrez <josue.d.hernandez.gutierrez@intel.com>
(cherry picked from commit 9202ef60b0)
* Adding Changelog fragment
Signed-off-by: Josue David Hernandez Gutierrez <josue.d.hernandez.gutierrez@intel.com>
The API docs state that both `branch` and `branchName` are valid,
but only `branchName` appears to work.
(cherry picked from commit 31c1bdd6a8)
Co-authored-by: Matt Clay <matt@mystile.com>
* [stable-2.7] Fix reverse_inventory order to work on python3 (#49895)
(cherry picked from commit a0d71e7)
Co-authored-by: Matt Martz <matt@sivel.net>
* Clarify the change made to reverse_inventory
* Fix firewalld module failing on missing protocol. (#50242)
Under Python 3.7 at least, the split of the port field fails
ungracefully if there is no slash. The fix also addresses the
case of an empty protocol after the slash.
(cherry picked from commit 69deb73803)
* add changelog for #50242 (#50480)
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit b81a74f551)
* Add module for Pure Storage FlashBlade to manage directory services
* Fix facts not correctly passing into ansible_facts dict
(cherry picked from commit 507f89e693)
* Do not filter out exception, warnings, deprecations on failure when using debug. Fixes#47576
* Add changelog fragment
(cherry picked from commit 40e5d2c)
Co-authored-by: Matt Martz <matt@sivel.net>
When the security group the rule belongs to does not exist and
the state is absent, the module is not properly exited, leading
to a playbook execution failure.
Fixes issue #50057
(cherry picked from commit 4951e5a5b7)
verify_file was improperly always returning true if pyvimomi and requests libs were correct
moved library checking to parse, avoid unneded errors unless the file is actually meant for
this plugin
(cherry picked from commit 49993a55e5)
* Fix mandatory statement error for junos modules
Fixes#40267
* Add error regex in junos terminal plugin to error out
in case of commit fails
* If commit fails add logic to discard changes before existing
else next task will result in error
* Add integration test
* Minor update
(cherry picked from commit cc8e90395a)
* Change test suite to fit expected behaviour
This reverts some changes from ansible/ansible@723daf3
If a line is found in the file, exactly or via regexp matching, it must
not be added again.
insertafter/insertbefore options are used only when a line is to be
inserted, to specify where it must be added.
(cherry picked from commit 31c11de2af)
* Implement the change in behaviour mentioned in the previous commit
(cherry picked from commit a4141cfa2e)
* Fix comment to reflect what the code does
(cherry picked from commit 150f5cb232)
* Set the correct return message.
In these cases, the lines are added, not replaced.
(cherry picked from commit 3216c31401)
* Add a changelog
(cherry picked from commit c39cf6b332)
* [2.7] Don't fail if a remote_addr with a '/' hits ansible_connection (#49781)
* Fail if a remote_addr with a '/' hist ansible_connection
This is _probably_ a CIDR block, but anything with a slash will fail,
so no need to try to parse to make sure
* Locks are now per-socket_path.
Locks use the same value as socket_path. Locks are also cleaned up in
shutdown like sockets.
(cherry picked from commit 61a649c)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add changelog
* [docker] Consolidating Python Boolean conversion for Docker API (#49563)
* [docker] Consolidating docker option min version checks (#49564)
* [docker] Moving option min version checks out of docker_swarm (#49564)
Also renaming Boolean cleanup function and fixing docker_container minimum
version check for network interfaces.
* Cleanup from PR feedback
* Fix python 3 compatibility in flatpak_remote module
* Fix flatpak module for recent versions of flatpak
* Add reminder for contributors to run integration tests manually
There has been several Python version compatibility regressions
introduced into the module which could have been avoided by the
integration tests.
(cherry picked from commit 27fd8e4dc6)
* Fix various bugs related in reboot
- Use format strings for consistency and improve debug log messages
- Use local variables instead of class attributes in order to be thread safe
- Run setup module to get distribution and version
- Run find module to get full path of shutdown command
- Use ansible_os_family and ansible_distribution to find commands and args
- Use same command for all Solaris/SunOS distributions
- Move delay calculations to properties
- Reliably check for module run failure
- Fix bug in run_test_command() that accidentally made the method work properly
- Use better exceptions rather than Exception
- Use dict literals rather than constructors
- Correct _check_delay() so it always returns a value, not None
- Don't store and return result in run_test_command() because it's not used anywhere
- add test for post reboot command that fails
- test negative values for delay parameters.
(cherry picked from commit c1589c33c4)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Add `env` command to ansible-test and run in CI.
* Avoid unnecessary docker pull.
(cherry picked from commit 01833b6fb1)
Co-authored-by: Matt Clay <matt@mystile.com>
Hopefully this will work around the intermittent CI failures due
to NullReferenceException, which then succeed on a retry.
(cherry picked from commit 4bd60c313b)
Co-authored-by: Matt Clay <matt@mystile.com>
* Warn of standard behavior of 'default' key store
The default key store typically results in the key being stored as user. In instances where we're trying to install a cert to enable SSL binding in IIS, this will result in an unbind-able cert, as the IIS APPPOOL identity will not be able to read the private key, and presents a very cryptic error of 'A specified logon session does not exist'.
* specify what's required for successful iis import
- store_location's default value is currently 'LocalMachine' but if this changes it could result in the documentation being inaccurate
- key_exportable is not required for a successful IIS import
Co-Authored-By: tdietrich513 <tom.dietrich@gmail.com>
(cherry picked from commit 2b48c0187c)
* [stable-2.7] openstack: fix parameter handling when cloud provided as dict (#42899)
* openstack: fix parameter handling when cloud provided as dict
If a cloud is provided as dictionary:
* Do not assert that 'interface' parameter is None. Instead,
assert that it is 'public'.
* Assert that 'auth_type' parameter is not set.
Fixes#42858
* os_user: Include domain parameter in user lookup
If a "domain" parameter is provided, use it in looking up
whether the user already exists.
Fixes#42901
* os_user: Include domain parameter in user deletion
If a "domain" parameter is provided, use it in deleting
the user also.
Fixes#42901
(cherry picked from commit e25dac9)
Co-authored-by: Carsten Koester <carsten@ckoester.net>
* Add changelog for openstack fixes
* docker_swarm: fix minimal API version (#49691)
* Reduce minimally required docker API version to 1.25, with selective features requiring 1.30.
* Adjust test requirements.
* Forgot some imports.
(cherry picked from commit 495a426039)
* Add changelog for docker swarm minimum api fix
* ensure idempotency for user set to None
* Update `user` documentation and add changelog fragment
* clarify changelog fragments and parameters documentation
* use restructuredtext syntax in changelog fragment
(cherry picked from commit b183eb4464)
* Fix for #49363
* Replaced str() with to_text() as more python version safe
* Changed to comply to errors stragegy
(cherry picked from commit 64636d9de0)
* fix: ensure than all item of a list of excluded files aren't checked (#45122)
* fix: ensure than list of excluded files aren't checked
* test: exclude a list of files
(cherry picked from commit 4f9f1754b4)
* added changelog
When the user specified caching plugin doesn't initialize correctly, we
were falling back to a dict. however, dicts do not have the same
update() method as the FactCache. We use the update method when we
update a cache with a subsequent value. So when that combination of
things happened, the code would traceback.
In devel, we made this change to fix things: https://github.com/ansible/ansible/pull/49516
but that involves several deprecations. So we're doing this smaller
hack in 2.7 to fix the traceback without introducing those deprecations
in a stable release.
* Add passlib to RHEL test instance
This looks like the only tests instance that is missing this libary. It is needed for vars_prompt tests.
* Create setup roles for pexect and passlib
Switch to using aliases rather than installing directly in the test scripts
(cherry picked from commit 96c2375692)
* create local subversion server for tests
* fix sanity issues
* don't touch system config when bringing up site
* removed original setup files
* fix opensuse config
(cherry picked from commit 0420d606de)
* Support version 3 of the redis python library. Fixes#49341
* Document 2.4.5 minimum redis-py version
(cherry picked from commit 77de219)
Co-authored-by: Matt Martz <matt@sivel.net>
* Fix for changes in clearlinux
clearlinux is now providing /etc/os-release file and ansible is identifying as NA
then this change allow ansible to find it
Signed-off-by: Josue David Hernandez Gutierrez <josue.d.hernandez.gutierrez@intel.com>
* Add changelog fragment for clearlinux changes
Signed-off-by: Josue David Hernandez Gutierrez <josue.d.hernandez.gutierrez@intel.com>
(cherry picked from commit 6d42c5020a)
There are several services e.g. vmware-fdm, which does not have package name and
package description which will raise a error if queried for.
(cherry picked from commit b3b65d16b8)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* Fix win_nssm credentials quoting
Fix credential quoting for win_nssm after changes to the way nssm command is invoked in Ansible 2.7.1.
* Updating nssm command to update credentials to use Argv-ToString to properly escape password variable.
* Adding changelog fragment for fix of #48728.
(cherry picked from commit 15c5dbcc20)
This change address a problem where the dict_merge function would fail
due to the value being a nested dict. This will now recursively pass
the value back through the dict_merge function.
Merge to devel https://github.com/ansible/ansible/pull/41107
(cherry picked from commit 2a4be2748f)
Update changelog
Fix review comments
Different connection plugins return different data when throwing exceptions. The Paramiko connection plugin does not return a text sting, which caused an exception.
The ssh connection plugin returns multi-line errors, which makes the debug logs harder to read. Only return the last line in that case in order to make the logs more readable.
When experiencing a connection failure, reset the connection.
Add reset() to paramiko_ssh
Indicate thet conection state is False when running close(). This is needed by the ensure_connected() decorator to work properly.
Co-authored-by: Matt Martz <matt@sivel.net>
(cherry picked from commit 5eb7f5781e)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* VMware: Fix module usages in module_utils
* Skip test for Python 2.6 as SSL context is not available in Python 2.6
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 1b04571ea0)
-Add: Mention bitbucket dropping TLSv1 and TLSv1.1 support as per 01 Dec 2018, potentially causing issues with older clients.
(cherry picked from commit a6db7f7abd)
Co-authored-by: Xaroth <xaroth+github@xaroth.nl>
* Revert back to getting the AWS role name from the URI with a small change (#49113)
- The role name and instance profile name _can_ be different
- Change the delimiter to `:` for keys that are discovered through the JSON parsing (which is not a valid delimiter for AWS IAM role names), this delimiter is still converted to underscore
- Now checks for the existence of that delimiter to remove the cases where the JSON keys are appended to the role name to find the role name
(cherry picked from commit ff9b86f560)
* Changelog update
* templar: ensure that exceptions are handled
* Fix AttributeError: object has no attribute 'message'
'message' attribute is deprecated since Python 2.6 and not available
with Python 3.
Simple reproducer:
- hosts: localhost
vars:
not_json: "{{ 'test str' | from_json }}"
tasks:
- command: "echo {{ not_json }}"
(cherry picked from commit 62c05033d6)
* Improve error handling: when parse_json_result is False, still return the error message.
* Remove content body from info dict.
* Add changelog.
(cherry picked from commit b842b1b97e)
* [stable-2.7] Improve log message (#49004)
This is the only connection plugin that doesn't state explicitly what it is in the log.
(cherry picked from commit 8f9ced4005)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* Add changelog
* Fix iosxr netconf plugin response namespace
* iosxr netconf plugin removes namespace by default
for all the responses as parsing of xml is easier
without namepsace in iosxr module. However to validate
the response received from device against yang model requires
namespace to be present in resposne.
* Add a parameter in iosxr netconf plugin to control if namespace
should be removed from response or not.
* Fix CI issues
* Fix review comment
(cherry picked from commit 829fc0feda)
* nxos_facts: Remove dead code
The commit e51964e made this redundant as the structured case is handled
elsewhere.
* nxos_facts: Do not gather neighbors redundantly
LLDP reports the neighbor using the abbreviated interface name, whereas
CDP reports the neighbor using the full interface name. Normalize the
local interface name in the LLDP case, so there is no redundant
information. Due to the order of the gathering, CDP neighbors are saved
in case both LLDP and CDP data is available on a certain interface.
(cherry picked from commit 2019f0e430)
* Use expect module to copy files
* Remove old and redundant upgrade files
* Return error message instead of code
* Cleanup copy command code
* Fix force issue in nxos_install_os
* new nxos_install_os integration tests
* Uncomment transport tests
* Revert negative test change
* Remove combined option that is no longer required
* Make shippable happy
* Add n5k test files
(cherry picked from commit a721572206)
* nxos_interface vlan and port-channel idempotence fix for mtu
* Fix MTU reconfiguration at each execution
* nxos_interface port-channel idempotence fix for mode (#44248)
* Fix trunk mode idempotence for port-channel
* Gather ethernet and port-channel code for mode management
* nxos_linkagg port-channel idempotence fix for channel-group's mode
The regex to retrieve channel-group's mode is not enough accurate.
Therefore, the swhitchport mode was matched instead of the
channel-group's mode.
* This fix add accuracy to match the right configuration command
* Add support for switchport mode dot1q-tunnel in nxos_interface
* Fix layer reconfiguration at each execution
(cherry picked from commit c51407c806)
* require git when trying to use it in ansible-galaxy cli
Previously we weren't setting `required=True` when calling
`get_bin_path` and the path would return `None`, this would cause
a traceback when attempting to ' '.join() to create a string
representation of the failed command for error output
Fixes#49200
Signed-off-by: Adam Miller <admiller@redhat.com>
* add changelog
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 81540bd754)
* Fix lookup_passwordstore test skipping.
Skip all of RHEL instead of specific versions.
Skip all of CentOS < 7 instead of specific versions.
This makes the test more robust when testing newer versions.
Tests could be executed on RHEL if EPEL was installed during the test.
(cherry picked from commit 704dae2cda)
It is currently supported only with the `--remote` option.
This makes it easier to troubleshoot new instances which are not
yet supported by the setup scripts used by ansible-test.
(cherry picked from commit 0826a00803)
* Support skip of platforms by version in tests.
Previously a remote platform could be skipped completely using the alias:
`skip/{platform}` such as `skip/rhel`
Now a specific platform version can be skipped using the alias:
`skip/{platform}{version}` such as `skip/rhel7.6`
This feature is available for platforms specified with the `--remote` option.
* Add skip by version to the docs.
(cherry picked from commit 8066acc90c)
Network platforms that don't have cliconf plugin will fail when
sending rpc calls for the reset_history and disable_response_logging
functions because those are defined in cliconf exclusively at this
time.
This patch adds checks for those attributes before making the call
(cherry picked from commit 0b5b5e69d8)
* For the pip module, umask should be specified as an octal *string*, not an octal (or decimal) *integer*.
(cherry picked from commit 0521e1c6dc)
(cherry picked from commit 237f127d21)
* Do not document buggy behavior.
(cherry picked from commit 1b77d72370)
* [stable-2.7] pip: Fix the mistake replacement from 'distribute' to 'setuptools' (#47403)
* Fix the mistake replace from distribute to setuptools
* Add a testcase for this bug
(cherry picked from commit 93c5781)
Co-authored-by: Zhikang Zhang <zzhang63@ncsu.edu>
* Add a change note
* Don't check options for idempotency which are not supported.
This check should be superfluous if every option would adhere to
the convention that options not specified should have value None.
Unfortunately, some options (such as init) which correspond to
container properties have an explicit default set.
(cherry picked from commit 9caaf7b109)
I'm not 100% certain this change is relevant for the filename, but it would make sense, so I'll let you confirm.
+label: docsite_pr
(cherry picked from commit ad1180b22f)
* Added changelog fragment
* Fix comparison of determining which rules to purge by ignoring descriptions (#48443)
AWS uses rule type, protocol, port range, and source as an idempotent identifier.
There can only be one rule with that unique combination. Rules that differ only by description are allowed but overwritten by AWS.
Add a test
Co-authored-by: Will Thames <will@thames.id.au>
(cherry picked from commit 54a2f21f93)
* add state parameter, update value in acme_certificate route53 example, fixes#49032
(cherry picked from commit de1c9c53c3)
(cherry picked from commit b30d2ce9e5)
Document that Path and Port are mutually exclusive parameters in the wait_for module.
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 70f992c618)
* Updating argument_spec for docker_* modules.
* Adjust docker_network to work with new recursive argument_spec.
* Adjust device IO limits to recursive argument_spec.
* Improve test (test Ansible's cast from str to int).
* Adjust healthcheck options construction.
* Remove superfluous check.
* Make flake8 happy.
* Simplify comparison.
(cherry picked from commit 0206a46e1d)
* Update win_scheduled_task.py to document that the duration of a task trigger can be null, which will cause it to run indefinitely - docs update makes use of suboptions
* Add a fix for the validate-modules schema
(cherry picked from commit 0bc5b79)
Co-authored-by: Justin England <justengland@gmail.com>
* Check minimal API and docker-py versions for all docker_* tests.
* Improve docker_swarm creation/destruction for tests.
* Fail when conditions aren't met.
* Don't hardcode address for advertise_addr.
(cherry picked from commit 3bb41ccb8e)
The 'gpg' command supports the '--no-tty' option, which disables any use
of a TTY during its execution. This parameter is sometimes required for
non-interactive operation to avoid any questions for the user.
The 'apt-key adv' command can pass additional parameters to the
underlying 'gpg' command. This patch adds the '--no-tty' option to avoid
issues with APT key imports when Ansible pipelining active, which
disables the use of a dedicated TTY.
(cherry picked from commit c7e2226035)
* Make puppet module useable on puppet 6 (#46044)
The unused ignorecache setting has been removed and so you
can't run puppet through this module anymore.
See PUP-8533 / https://tickets.puppetlabs.com/browse/PUP-8533
(cherry picked from commit 475d69da69)
* changelog
* make yum update_only option actually work
Fixes#40615
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix changlog fragment for sanity check
Signed-off-by: Adam Miller <admiller@redhat.com>
* only attempt an update when there are packages to update
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix logic to properly handle the precedent of operations
Signed-off-by: Adam Miller <admiller@redhat.com>
* remove q debug statements
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 34fc66185e)
We don't need to test with `upgrade: dist`, since we're not trying
to test the `apt` module. We just need to make sure the hold set
by the `dpkg_selections` module is working.
This change will avoid updating all the packages on the system,
which is slow, unnecessary, and can cause the installed python
to be changed.
(cherry picked from commit 136a2cca2f)
Track the interpreter for each copy of the injector by the interpreter
path instead of the interpreter version. This avoids the possibility
of mixing different interpreters with the same version.
(cherry picked from commit fa53b4805b)
Inject a symlink to the correct python into the copied injector
directory instead of altering the shebang of the injector. This
has the side-effect of also intercepting `python` for integration
tests which simplifies cases where it needs to be directly invoked
without collecting code coverage.
(cherry picked from commit d6bf45cd9d)
* Fix tests: use same command if not testing command option.
* Fix idempotency of init option.
* Fix shm_size idempotency (it is included in inspect results from docker API version 1.22 on).
* Add changelog.
(cherry picked from commit b1acabcd03)
* docker_container: make condition less specific (#48590)
* Code seems to have changed from 409 to 400, so let's not check the code.
* Unpause container before removing it.
* Improve code.
* Same for stop_container.
(cherry picked from commit f3a3f42490)
* Add changelog.
* clarify port.mode paramter requiremets, fail if unmet
* changelog fragment
* shorten too long line
* remove unnecessary indentation
* test version on docker_version for better maintainability
* normalize imports
* changelog fragment: minor_changes -> bugfixes
* rollback e96a7e57dfefd566fa47cf465a759637affd4795
* typo
Co-Authored-By: dariko <dariko@users.noreply.github.com>
(cherry picked from commit 89bcd3ff1e)
* ec2_instance: ebs_optimized is not sub-option of 'network' (#48341)
* ebs_optimized is not suboption of 'network'
* Add Shaps as ec2_instance maintainer
* Added workaround-backward compatible check for ebs_optimized
* Added ebs_optimized test
* CI fixes, dynamic select of ENA-enabled AMI
(cherry picked from commit b7d9feb7dc)
* Added changlog fragment for PR #48341
* fixed yaml errors in changelog
* Move check for 'dashboard' key to before the create/update if statement.
* Add changelog fragment for PR #47459
(cherry picked from commit 880762e07e)
* pamd: fixes for multiple issues (#47695)
* Providing fix for #47083 in pamd.py
* Providing fix for #47197
* Fixing pep8 errors
* update regex to account for leading dash and VALID_TYPES with dashes as well
* use a results dictionary and clean up unnecessary items
* remove unnessecary return value. action is already reported in invocation output
* make naming consistent across action returns
* fix comparison so it checks equality instead of identity and indentation in update_rule()
* make sure file always has EOF newline
* updated regex to skip spacing between path and args and add rule arg regex to capture complex args
* new module argument parsing code in function and DRY changes
* remove unused has_rule method on PamdService class
* fix error in parse_module_arguments()
* updated args_present action to make it handle key value args and fail on complex bracketed arguments
* pep8 and other fixes so units still work
* suggested change - make version removed 2.8
Co-Authored-By: shepdelacreme <shepdelacreme@users.noreply.github.com>
* add more error proof test to if statement
(cherry picked from commit ef690e928f)
* add changelog fragment for backport
* add action return value back for backport
PIP package names must be case insensitive, and must consider hyphens
and underscores to be equivalent
(https://www.python.org/dev/peps/pep-0426/#name), because of this the
module didn't work correctly in check mode. For example if the passed
package name had a different case or an underscore instead of a hyphen
(or the other way around) compared to the installed package, check mode
reported as changed, even though packages were installed. Now the module
ignores case and hyphens/underscores in package names, so check mode
works correctly.
(cherry picked from commit b89b688)
Co-authored-by: Strahinja Kustudic <kustodian@gmail.com>
* Simplify logic and add FreeBSD & NetBSD
* Remove incorrect flag for lock and unlock on FreeBSD
* Add tests and changelog
Co-authored-by: Chris Gadd <gaddman@email.com>
(cherry picked from commit f75a84e382)
Co-authored-by: Christopher Gadd <gaddman@email.com>
* Always use /proc/sys/kernel/random/boot_id to confirm reboot on Linux
/proc/sys/kernel/random/boot_id is available since kernel 2.3.16 and
should be safe to rely on.
The previously used method by checking the system boot time using who -b
turned out to be unreliable: Some systems lacking an RTC report the Unix
epoch as boot time, but the code trying to detect that did't always
work.
Closes#46562
* Change DEFAULT_BOOT_TIME_COMMAND
- change to usinsg /proc by default
- add BOOT_TIME_COMMANDS for BSD, Solaris, and macOS
(cherry picked from commit ae7b9ea8cd)
Co-authored-by: Stefan Siegel <ssiegel@sdas.net>
* Complie regular expressions for better performance
* Skip on empty lines
This fixes a bug where the previous repo would be inserted in the result twice since an empty line did not match any of the conditions that would exit the loop iteration.
(cherry picked from commit 1e3b704ff1)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* user: fix removing the expiry time when it's 0
* Improve tests and add changelog
Co-authored-by: Martin Krizek <martin.krizek@gmail.com>
(cherry picked from commit 41dfc5162f)
Co-authored-by: Martin Krizek <martin.krizek@gmail.com>
This will avoid spontaneous test failure for new releases of openshift on PyPI.
(cherry picked from commit 150cdd7931)
Co-authored-by: Matt Clay <matt@mystile.com>
* Correct yum and dnf autoremove behavior
Sanity check args passed to autoremove
Fixes#47184
Signed-off-by: Adam Miller <admiller@redhat.com>
* fix docs
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 1c777976c5)
* Allow bang and exclamation without warning
Allow the password field to be ! or * without warning when using this feature to create accounts that are locked.
Add documentation and tests to cover this.
* Use set() rather than braces for Python 2.6
(cherry picked from commit 066af3b6ca)
Co-authored-by: Sam Doran <sdoran@redhat.com>
* NetApp bugfix for na_ontap_snapmirror (#47621)
* Bug fixes for Snapmirror
* Bug fixes for Snapmirror
(cherry picked from commit 8f3e297d7d)
* add fragment
* Fix argument_spec for modules that are using the old version (#47693)
* Use correct argument spec
(cherry picked from commit 0cf88809ef)
* Add fragment
To ensure that the lvg module is tested for idempotency,
we add a basic integration test.
Support for MacOS and FreeBSD are skipped because the
module does not currently support those platforms.
(cherry picked from commit 204b40f706)
In [1] changes were made to ensure that the physical
devices were appropriately filtered, but the dev_list
which is used to prepare the filter is modified from
the original arguments to resolve any symlinks. This
results in the existing devices given in the module
args to be left out of the filter, resulting
in the module trying to add the same device again
every time the task is executed.
In this PR we change dev_list to be a copy of the
module arguments so that we're able to add the given
pv list from the module arguments into the filter
as well, ensuring that there is idempotence when
running the task again.
[1] https://github.com/ansible/ansible/pull/38446
(cherry picked from commit 1bae00b5d2)
* cleanup is already tested.
* Add test for paused.
* Add recreate and restart tests.
* timeout is a common docker option
* Implement paused and fix paused test.
* Add changelog.
* Improve paused test.
(cherry picked from commit 65768b996d)
* More generic comparison code from docker_container to docker_common.
* More flexibility if a is None and method is allow_to_present.
Note that this odes not affect docker_container, as there a is never None.
* Update docker_secret and docker_config: simplify labels comparison.
* Added unit tests.
* Use proper subsequence test for allow_more_present for lists.
Note that this does not affect existing code in docker_container, since lists
don't use allow_more_present. Using allow_more_present will only be possible
in Ansible 2.8.
* pep8
(cherry picked from commit 73533d3fc2)
* Store parsed docker-py / docker API versions in client.
* Began refactoring 'minimal required version' for docker_container options.
* Removing some fake defaults.
* Added changelog.
* Improve tests (check older docker versions).
* Fix comparison. The breaking point is not docker-py 2.0.0, but 1.10.0.
(Verified by testing with these versions.)
* Move docker-py/API version detection to setup_docker.
* Add YAML document starter.
* docker_network requirement for docker-py was bumped to 1.10.0 in #47492.
(cherry picked from commit 3cca4185be)
* Use expect module to copy files
* Add force option for disruptive upgrades
* Revert changes to copy_kick_system_images.yaml
(cherry picked from commit c53e3ca8e9)
* Add support for POST-as-GET if GET fails with 405.
* Bumping ACME test container version to 1.4. This includes letsencrypt/pebble#162 and letsencrypt/pebble#168.
* Also use POST-as-GET for account data retrival.
This is not yet supported by any ACME server (see letsencrypt/pebble#171),
so we fall back to a regular empty update if a 'malformedRequest' error is
returned.
* Using newest ACME test container image.
Includes letsencrypt/pebble#171 and letsencrypt/pebble#172, which make Pebble behave closer to the current specs.
* Remove workaround for old Pebble version.
* Add changelog entry.
* First try POST-as-GET, then fall back to unauthenticated GET.
(cherry picked from commit 92d9569bc9)
Handle exception when there is no snapshot available in virtual machine or template while cloning using vmware_guest.
Fixes: #47920
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 487f2f25ce)
* Check if `enabled_snat` is set in modules arguments (#46754)
If `enabled_snat` is not set at all in module arguments but Neutron
policy sets it by default in Openstack, then `os_router` will attempt to
recreate otherwise perfectly good router.
Follow up for https://github.com/ansible/ansible/issues/44432#issuecomment-428531031
(cherry picked from commit c2b7174d31)
* Add changelog entry
* Fix idempotency issues in set_bios_attributes
- Added check to see if attribute even exists, if not, it exits.
- Then checks if attribute is already set to value we want to update
it to. If yes, then it exits and changed=False
- Otherwise updates the attribute and changed=True
(cherry picked from commit 1c37471274)
* add changelog fragment
* Parsing plugin filter may raise TypeError, gracefully handle this exception
and let user know about the syntax error in plugin filter file.
* Test for plugin_filtering
Fixes: #46658
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit b32b4111b2)
Due to refactoring of task_error and wait_for_task method,
SSL thumbprint was lost in error message. This fixes the
retry mechanism of AddHost task.
Fixes: #47563
(cherry picked from commit e7c83d6aa9)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
* Don't die when get_container is called for container which is terminating during get_container call.
If it terminates between client.containers() and client.inspect_container(),
the module will fail with an error such as
Error inspecting container: 404 Client Error: Not Found ("No such container: xxx")
* Add changelog.
(cherry picked from commit b9706e2ff5)
* Addresses comments in #38971 (#44324)
* Controlled params within no section
* Added tests to control params within no section
* Cleaning output_file before creating no-section params and check the content
* addresses comment in PR "s/hate/beverage/g"
(cherry picked from commit d3fe6c01f2)
* 44324-ini_file
* Add docker_image_facts tests.
* Add basic integration test for docker_volume.
* Add basic docker_image tests.
* Only start test registry when tests are actually run (i.e. not on CentOS 6).
(cherry picked from commit f19ab56eb4)
* Add missing self._supports_async to uri action plugin. Fixes#47660
* Additional changes needed to support async
* Missed a call to execute_module
(cherry picked from commit 3633e21)
Co-authored-by: Matt Martz <matt@sivel.net>
This PR is fixing following issues:
1) Don't try to check password.
2) Check options.
3) Order wasn't adding at the end, as doc says.
Signed-off-by: Ondra Machacek <omachace@redhat.com>
* Avoid misleading PyVmomi error if requests import fails
Requests is imported by the VMware module_utils as an external
dependency; however, because it is in a try/catch block containing the
imports for PyVmomi, if requests fails to import properly, Ansible will
instead complain about PyVmomi not being installed.
By moving the import outside of the try/catch block, if requests fails
to import, an error like the following will be returned:
ImportError: No module named requests
This should result in less confusion.
* catch requests ImportError
Signed-off-by: Jim Gu <jim@jimgu.com>
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit 99ee30768a)
This adds scenario guide for using VMware HTTP API using uri module.
(cherry picked from commit e5318c5c4f)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Description for the name and description was vague. I didn't get the first time reading that it was talking about a character limit.
(cherry picked from commit 7e9141e26e)
* Document all Working Group, email lists and IRC channels (#47615)
(cherry picked from commit 749af9fd22)
* Docs: No need to follow up on backport PRs (#47616)
(cherry picked from commit 166e84b9c4)
* Tidy up Contributors Docs (#47619)
(cherry picked from commit 72359a10e6)
* Correct AWX community link (#47742)
(cherry picked from commit d189e58f63)
* ansible-lint and molecule part of Red Hat (#47826)
(cherry picked from commit 4572d9ccd7)
* Default to sending text of exception, not the whole exception
(cherry picked from commit 6a866a5)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Major slow down due to using the wrong loader for plugin_types
* traceback due to adding httpapi and cliconf plugins to the plugins we
allow ansible-doc to process
(cherry picked from commit e5a245d)
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
The mysql-server package on Ubuntu16.04 was recently updated to disallow
unauthenticated root user login over tcp/ip. This, coupled with pymysql
using tcp/ip whenever host and port is specified causes us to fail to
connect to the database when testing Python3 on Ubuntu16.04.
The fix is to use the unix socket instead.
(cherry picked from commit 748ea39ecd)
* Use kubeconfig if either context or kubeconfig is set (#47373)
kubeconfig should be loaded if *either* or both of context
or kubeconfig is set (this allows picking a context and default
kubeconfig or picking a kubeconfig with default context)
Fixes#47149
(cherry picked from commit 00ccad9764)
* Add changelog for k8s auth config fix
* WinRM/PSRP: Ensure shell returns UTF-8 output
This PR makes UTF-8 output work in PSRP shells.
* Add win_command and win_shell integration tests
* Fix tests
* more test fixes
(cherry picked from commit 691ff4b9e6)
* dnf properly gpg check local packages based on param
Fixes#43624
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 079705f8da)
* Ensure we don't overwrite roles from include/import_role when loading the play. Fixes#47454
* Add changelog fragment
(cherry picked from commit d5e4f37)
Co-authored-by: Matt Martz <matt@sivel.net>
* [2.7] escape default prompt detection in telnet action plugin (#46573)
This change fixes an issue with the default prompt handling. The value
needs to be escaped otherwise it does not work when converted to bytes.
(cherry picked from commit 9180d2c)
Co-authored-by: Peter Sprygada <privateip@users.noreply.github.com>
* Add changelog
This PR fixes the update check method so it now check also the next_run
configuration of the virtual machine if it exists.
So if previously the VM was updated with new parameters, and then reset
back, the module didn't set the parameters to be set back in next_run.
This PR fixes it so the next run configuration is set back with proper
parameters.
Signed-off-by: Ondra Machacek <omachace@redhat.com>
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=1639894
Signed-off-by: Ondra Machacek <omachace@redhat.com>
* [2.7] fix error checking if netns exists (#47397)
This patch fixes an error that occurs when attempting to see if the
netns already exists on the remote device. This change will now execute
`ip netns list` and check if the desired namespace is in the output.
Signed-off-by: Peter Sprygada <psprygada@ansible.com>
(cherry picked from commit 299a5e4)
Co-authored-by: Peter Sprygada <privateip@users.noreply.github.com>
* Add changelog entry
* Behave better if auto_remove and output_logs are combined. Warn if output cannot be retrieved because of auto_remove.
* Add tests.
* Added changelog.
(cherry picked from commit 3afdb28209)
* Only add parameters which are actually used.
* Fail if ipvX_address is used when not supported.
* Added changelog.
(cherry picked from commit 4ffe3b14d4)
Currently the module will disable the SSO if we didn't pass any
value for SSO option. The PR fixes the same.
Signed-off-by: Ondra Machacek <omachace@redhat.com>
* Fix prompt mismatch issue for ios
Fixes#40884#44463#46082
* If the command prompt is matched check if data is
still pending to be read from buffer.
* This fix adds a new timer `buffer_read_timeout`
which will be trigerred after command prompt
is matched and data is attempted to be read from channel.
If not data is present of channel the timer will expire
and response we be returned to calling function.
* Update doc
* Fix review comments
* Update changelog
* Fix unit test CI failure
(cherry picked from commit 335a979f1d)
Fixes: https://github.com/ansible/ansible/issues/45900
This PR fixes the case when the cloud_init_persist was used, but we
still sent use_cloud_init=False, which is in oVirt API evaluated as not
to use cloud_init in first VM execution. This patch is changing it to
send just None, instead of False.
Signed-off-by: Ondra Machacek <omachace@redhat.com>
Currently there is no way to reset the custom_compatibility_version to
NULL. If we provide a empty string('') to custom_compatibility_version,
it will fail with error "IndexError: list index out of range" at _get_minor
function.
To reset the custom_compatibility_version, we have to pass None value to
types.Version. The PR fixes the same.
Signed-off-by: Ondra Machacek <omachace@redhat.com>
This reverts commit 0e933f76ba.
The tests for this were broken on centos6 because jinja2 does not have
a map filter on that platform. Tests need to be rewritten.
(cherry picked from commit ccabc2bff5)
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
* Fix auto scale create with fix date without recurrence (#47186)
* Fix auto scale create with fix date without recurrence
* fix indent
(cherry picked from commit 9258ffa478)
* Create azure_rm_autoscale-fixed_date.yml changelog
* Ensure that k8s_facts always returns resources key (#46733)
Fix bug returning `items` key if NotFound exception is hit
(cherry picked from commit b772485d97)
* Add changelog for k8s_facts fix
* add delete=False to NamedTemporaryFile and remove print statement from module
* add changelog fragment
* use module.tmpdir from (#47133) and add changelog fragment for it as well
(cherry picked from commit c67ab296bb)
* user: do not pass ssh_key_passphrase on cmdline
CVE-2018-16837
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
(cherry picked from commit a0aa53d1a1)
* Ignore user module use of subprocess.
(cherry picked from commit 8d00afc013)
* Fix python3 problem in user module cve fix
(cherry picked from commit 9088671c4e)
* Fix changelog entry for user module CVE fix
(cherry picked from commit 210a43ebeb)
* Handle dnf immutable mutable datatypes
In DNF < 3.0 are lists, and modifying them works
In DNF >= 3.0 < 3.6 are lists, but modifying them doesn't work
In DNF >= 3.6 have been turned into tuples, to communicate that
modifying them doesn't work
Further explanation of this is available via Adam Williamson from
the Fedora QA Team.
https://www.happyassassin.net/2018/06/27/adams-debugging-adventures-the-immutable-mutable-object/
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit 70025e7b56)
* add backport changelog
Signed-off-by: Adam Miller <admiller@redhat.com>
* mail: Fix regression when sending mail without SSL (v2.7)
When this module was refactored in #37098 the non-SSL use-case was broken.
The main cause is that we have no way to do integration tests for testing SMTP.
This is a back-port to v2.7 of #46403
* Add changelog fragment
Set _notified_handlers for the task's _uuid that is run as a handler
Fix#47287
(cherry picked from commit 6497049)
Co-authored-by: Pablo <pablorf.dev@outlook.com>
* Fix prompt mismatch issue for ios
Fixes#40884#44463
* If the command prompt is matched check if data is
still pending to be read from buffer.
* This fix adds a new timer `buffer_read_timeout`
which will be trigerred after command prompt
is matched and data is attempted to be read from channel.
If not data is present of channel the timer will expire
and response we be returned to calling function.
* Fix unit test failure
* Update to make buffer timeout float
* Update doc and fix review comment
* Fix CI issues
* Update doc
* Fix review comments
* Update changelog
(cherry picked from commit 335a979f1d)
* yum/dnf: fail when space separated string of names (#47109)
* yum/dnf: fail when space separated string of names
* Groups allow spaces in names
(cherry picked from commit e8b6864e21)
* Add changelog
* Fix AWS EC2 inventory plugin caching of groups
* Added changelog fragment for aws_ec2 caching fix
* Store the AWS query results
The underlying inventory object contains inventory from other sources,
so caching it as ours would be wrong.
It seems easiest and safest to just cache the boto query results
instead.
* Remove unused functions
(cherry picked from commit 7ba09adee1)
* Documentation for docker_container: fix documentation for memory_swappiness. Default value will not equal 0, it will be inherited from the host machine (#47296)
(cherry picked from commit 4c2efa4b67)
* Add changelog.
* [2.7] Update some cliconf plugins (#47141)
* Add `check_all` to many community cliconf plugins
(cherry picked from commit 7844a40)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add changelog entry
* Fixes the example for headers in documentation
* remove whitespace
* missed a whitespace
(cherry picked from commit 3b5471a)
Co-authored-by: Nate Borener <33846287+borener@users.noreply.github.com>
* Adoc fixes (#47137)
* removed hardcoded loader/plugins list
* updated a few errors to keep orig object
* fix httpapi/cliconf listing
* ansible-doc fixes
* show undocumented as UNDOCUMENTEd
* added missing undoc
(cherry picked from commit fce9673ac1)
* An earlier optimization of ansible-doc -l caused failures. (#47012)
The optimization quickly searches the plugin code for short_description
fields and then uses that in the -l output. The searching was a bit too
naive and ended up pulling out malformed yaml. This caused those
plugins to be omitted from the list of plugins of that type with
a warning that their documentation strings were wrong.
This change makes the documentation parser aware that the documentation
string could have a relative indent for all of its fields which makes it
robust in the face of this particular problem.
* Don't search for space after short_description:
Any whitespace would be valid. In particular newline
(cherry picked from commit 61ae6424a3)
Python sets the SIGPIPE handler to SIG_IGN. On execv() signal handlers are
reset to their defaults, EXCEPT those that are SIG_IGN which are left ignored.
In Python 3 subprocess.popen explicitly resets the SIGPIPE handler to SIG_DFL,
but unfortunately in Python 2.7 it does not. This leads to subprocesses being
executed with SIGPIPE ignored. This is often a problem with bash scripts which
rely on SIGPIPE to terminate commands in a pipe, but can easily be a problem
with other applications.
This implements the Python 3 behaviour for Python 2.7 by using a preexec_fn.
(cherry picked from commit f2dccb9)
Co-authored-by: Jonathan Oddy <jonathan.oddy@transferwise.com>
* Fix in confirmed_commit capability in netconf_config modules
Fixes#46804
* If confirm value is greater than zero or confirm_commit option is set and confirmed-commit
capability is not supported but Netconf server only in that case fail the module
* Update confirm-commit flag
* Update changelog
(cherry picked from commit 5394638047)
* ansible-test: add skip/windows/... alias to skip tests on specific Windows versions
* show what tests were skipped
* changes to logic to only skip if all Windows targets are set to skip
* codestyle improvements
* change warning message based on review
* check args type before running the Windows path
(cherry picked from commit 0f5331645f)
* Locate prtdiag even when absent from /usr/bin
On Solaris 8 hosts, this prevents fact collection from aborting with:
Argument 'args' to run_command must be list or string
* Lint fix.
* Style: pass /usr/platform/.../sbin as optional path to get_bin_path().
(cherry picked from commit 40fb992a6f)
* Refactoring related to network device
* Assign unique random temporary key while creating SCSI or/and IDE controller devices
* Add testcase for this change
Fixes: #38679
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit fd985db72d)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
If enable_snat is False, this should be used to build the
request, because the default value in the OpenStack Networking
API is True.
Fixes the issue #45915.
(cherry picked from commit 452a4ab781)
* yum module properly check for None config_file (#46641)
* yum module properly check for None config_file
* add conf_file test cases to yum integration tests
Signed-off-by: Adam Miller <admiller@redhat.com>
(cherry picked from commit fb6e91bf98)
* add changelog for 2.7 backport
Signed-off-by: Adam Miller <admiller@redhat.com>
* [aws_ssm_parameter_store] use describe_parameters paginator (#45632)
Fix the service reaching an internal limit while processing the results and returning unexpected data
(cherry picked from commit 7aaa5da41d)
* changelog
* nmcli: fix vlan connection modification Fixes#42322 (#42415)
* ensure optional items are set to empty strings rather than not presented
fix syntax of vlan modification command
* extended tests for nmcli
(cherry picked from commit fb72a5424c)
* Changelog fragment for nmcli fix
* win_reboot: Fix for ignore post_reboot_delay (#46360)
* win_reboot: Fix for ignore post_reboot_delay
This fixes an issue where win_reboot would be ignoring the provided
post_reboot_delay (and on Windows timing/waiting is everything!)
This must be backported to the v2.7 branch.
* Merge post-reboot handling into run()
(cherry picked from commit 8c64b4af7c)
* Add a changelog for the win_reboot fix
* Return correct version on installed VyOS (#39115)
* Return correct version on installed VyOS
Previously existing regexp will shows only "VyOS" without numeric output of router version.
For example: from "Version: VyOS 1.1.6" only VyOS will be written in ansible_net_version variable
For more informative output numeric value should be returned as well
* Fixed unittests
(cherry picked from commit 235b11f681)
* Added changelog
* Add symlinks sanity test.
* Replace legacy test symlinks with actual content.
* Remove dir symlink from template_jinja2_latest.
* Update import test to use generated library dir.
* Fix copy test symlink setup.
(cherry picked from commit e2b6047514)
* Add unified diff output to environment validation.
This makes it easier to see where the environment changed.
* Compare Python interpreters by version to pip shebangs.
This helps expose cases where pip executables use a different
Python interpreter than is expected.
* Query `pip.__version__` instead of using `pip --version`.
This is a much faster way to query the pip version. It also more
closely matches how we invoke pip within ansible-test.
* Remove redundant environment scan between tests.
This reuses the environment scan from the end of the previous test
as the basis for comparison during the next test.
(cherry picked from commit 0dc7f38787)
* Fix ansible-test smoke tests across groups.
* Fix ansible-test list arg defaults.
* Fix ansible-test require and exclude delegation.
* Fix detection of Windows specific changes.
* Add minimal Windows testing for Python 3.7.
(cherry picked from commit e53390b3b1)
This removes the old name based version detection behavior and
uses versions defined in the docker completion file instead, as
the new containers do not follow the old naming scheme.
(cherry picked from commit 54937ba784)
This prevents tests from loading modules outside the source tree,
which could result in testing the wrong module if a system-wide
install is present, or custom modules exist.
(cherry picked from commit d603cd41fe)
This can be used to run Python scripts from the repository with the
correct interpreter and allow collection of code coverage.
Useful for testing contrib inventory scripts.
(cherry picked from commit 45b5685037)
* Fix CNOS unit test log usage.
* Use temp dir for Galaxy unit tests.
* Write to temp files in interfaces_file unit test.
* Fix log placement in netapp_e_ldap unit test.
(cherry picked from commit 0686450cae)
* module/systemd: fix logic determining if a service needs to be enabled (#46245)
* modules/systemd: fix logic: allow scope to default to 'system'
Fix logic introduced in 7ea909418e: if 'scope' param is not specified,
it defaults to system, but the value of module.params['scope'] is None,
not 'system' - so allow for that.
* modules/systemd: fix logic: disabled means disabled
Fix logic determining whether a service with both systemd and initd files is enabled or disabled.
In situations where systemd thinks service is disabled, but rc.d symlinks mark it as enabled,
this module wrongly assumes the service is enabled.
Fix this logic: disabled means disabled
Only when the output from does NOT include disabled, consider the status of rc.d symlinks.
This essentially replicates the fixes done to the systemd handling in the "service" module in 3c89a21e0cFixes#22303Fixes#44409
(cherry picked from commit ef131c7556)
* backport/2.7/46245: add changelog fragment
* [aws] route53 module: fix idempotency for CAA records (#46049)
* Fixing record order for CAA records to properly handle idempotency.
* Add integration tests that reproduce CAA failure
(cherry picked from commit a727a1ee67)
* Added changelog.
* Sorting args.
* Doing comparisons of options with container parameters in a more context-sensitive way.
This prevents unnecessary restarts, or missing restarts (f.ex. if parameters are removed from ``cmd``).
* Make blkio_weight work.
* Fix cap_drop idempotency problem.
* Making groups idempotent if it contains integers.
* Make cpuset_mems work.
* Make dns_opts work.
* Fixing log_opts: docker expects string values, returns error for integer.
* Adding tests from felixfontein/ansible-docker_container-test#2.
* Make uts work.
* Adding changelog entry.
* Forgot option security_opts.
* Fixing typo.
* Explain strict set(dict) comparison a bit more.
* Improving idempotency tests.
* Making dns_servers a list, since the ordering is relevant.
* Making dns_search_domains a list, since the ordering is relevant.
* Improving dns_search_domains/dns_servers.
* Fixing entrypoint test.
* Making sure options are only supported for correct docker-py versions.
* [2.7] Clean up after ansible-connection if failure occurred in start() (#45929)
(cherry picked from commit 0d143ed)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add changelog fragment
* rewrite get_resource_pool method for correct resource_pool selection
* only keep name if path is given for cluster, esxi_hostname or resource_pool
* Revert "only keep name if path is given for cluster, esxi_hostname or resource_pool"
* This reverts commit 50293ec763c024b0eaceac5d775ccc0ad3ff8bd7.
* if the name argument contains a path, only use the last part for matching
* remove path from cluster argument in tests
* remove find_objs in favour of reusing find_obj with an extra folder argument
* fix find_obj ignoring first if name is not given
(cherry picked from commit 1a810f8f11)
* Don't simply ignore container in present() if image is not specified.
* Use image from existing container for recreation if not specified.
* Added changelog.
* Improve comment.
(cherry picked from commit 895019c59b)
* [rabbitmq_binding] Fix the quoting of vhost and other names, which was broken in PR #35651
* Merge missing urllib_parse.quote from PR #42422
* Missed one line, where also needs to be escaped, i.e., the destination
(cherry picked from commit d5f8738bf2)
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
Fixes#35120 : the redis cache plugin keeps key/value
entries in an in-memory cache to avoid hitting the
redis database each time.
The problem is that a cache entry is only set when
a value is get or set but it is always deleted when
trying to delete a value.
When the --flush-cache ansible-playbook option is used,
the redis cache plugin is first asked to remove every
entry corresponding to every hostname present in the inventory.
As no value as been set/get so far, it then tries to delete
an unexisting value from the cache and hence crashes with
a KeyError exception.
(cherry picked from commit ee3dfef016)
Fixes#46257
* As per netconf rfc default-operation value is optional,
hence removing the default value for default_operation
option.
(cherry picked from commit 5e6eb921ae)
* Update changelog
* Add ssl support to consul_kv lookup (#42456)
* implemented lookup_consul_kv
* added missing version_added for consul_url ini section
* added default value for ANSIBLE_CONSUL_CLIENT_CERT and added some more documentation
* removed trailing whitespaces
* fixed indention
* Fixes in Documentation
* removed trailing whitespace
* removed trailing whitespace
(cherry picked from commit bacbd4e9fc)
* * added changelog fragment
Add missing space between arguments when app_parameters contains several keys.
Use Argv-ToString and Escape-Argument to improve arguments handling (parameters with quotes, backslashes or spaces).
(cherry picked from commit 933a4092bf)
These tests highlight several issues with this module:
* Service not started when state=started
* Errors with app_parameters (see #25265)
* Exception when passing several dependencies separated by comma as specified in doc
(cherry picked from commit e50234bdb3)
This prevents a stack trace in Python 3 when the result is an empty file since
the file is open in binary mode and a native string in Python 3 is str,
not bytes.
(cherry picked from commit 8b1ae30e2e)
* Ensure that the value of PLUGIN_FILTERS_CFG is treated as type=path, and that we use the standard section of 'defaults' instead of 'default'
* deprecate the default section
* Don't add version_added for the corrected section
(cherry picked from commit 172137c)
Co-authored-by: Matt Martz <matt@sivel.net>
* Support nested JSON decoding in AnsibleJSONDecoder
* Add tests for vault portion of AnsibleJSONDecoder
(cherry picked from commit c0915e2)
Co-authored-by: Matt Martz <matt@sivel.net>
* fixes#45941
* corrects regression introduced by #26104; when the resource group doesn't exist, the module exits prematurely with an error instead of creating it.
(cherry picked from commit 3b52d968e6)
* ec2_group - fix VPC precedence for security group targets (#45787)
Update the dictionary with the preferred values last to get the right order of VPC precedence
Fixes#45782
(cherry picked from commit 8d2df9be52)
* Fix ec2_group for EC2-Classic accounts (#46242)
* Fix ec2_group for EC2-Classic accounts
* changelog
(cherry picked from commit 9efc3dc761)
* Merge changelogs
The stdout and stderr values returned from self._low_level_execute() are text, not bytes. This results in an error in Python 3 since str and bytes cannot be concatenated.
Changing to unicode type allows this to work without error on Python 2 and Python 3.
(cherry picked from commit 77f73f6d2a)
* reboot: Fix typo and support bare Linux systems
This fixes a problem for bare Linux systems that do not support 'who -b' or 'uptime -s'.
* Accumulate stdout and stderr information
(cherry picked from commit a7a99c5fd4)
- use context manager for dealing with the checksum file
- use loop that can tolerate zero, one, or more items return rather than the previous expression which would break if anything other than exactly one item was returned
(cherry picked from commit 03dbb1d9c4)
squash
- Fix spelling of 'separate' and 'algorithm'
- Fix indentation of nested list in payload format
- Fix mysterious refernce to 'b_pkey1'.
- Fix reference to newline as '\n': the backslash is lost when rendered
to the docs website. Specify the hex value for newline instead of the
backslash escape.
(cherry picked from commit ab96bbdef9)
* Update the minimum python versions to install
This will prevent modern pip from installing ansible-2.7.x in
python-2.6. Users will get the Ansible-2.6.x maintenance releases
instead.
(cherry picked from commit ccf41bb)
Co-authored-by: Toshio Kuratomi <a.badger@gmail.com>
* Update synchronize.py
If you want a different rsync binary on the local side, you need to set task variable ansible_rsync_path.
See examples.
Variable ansible_rsync_path looks to not be documented anywhere. If documented, needs to be said that is does not belong to synchronise options, instead belongs to tasks. (Sorry, I have no better wording)
(cherry picked from commit c44de1069c)
* Added documentation for collectstatic --clear.
Added a description of the --clear argument used with the Django management
command, collectstatic. (When #1810 added this feature the documentation
was not updated).
(cherry picked from commit f964277628)
* Update influxdb_database.py (#39984)
(cherry picked from commit 049a462058)
* Link to the Galaxy platforms list from the meta file template (#34046)
(cherry picked from commit fa18d45eb3)
* fix gce_backend_service examples for healthchecks (#31134)
(cherry picked from commit e26d758d6f)
* Clarify the creates and removes options (#45485)
(cherry picked from commit bf90a44468)
* lineinfile note belongs in changelog for 2.6, not 2.7 (#45517)
(cherry picked from commit 228fee4f3a)
* Update keycloak_client.py (#43547)
(cherry picked from commit cb460dee74)
* The keyword 'cloud' has been deprecated in favor of the 'profile' keyword by os-client-config. (#31389)
(cherry picked from commit 17ca0a9bd9)
* Clarified documentation for the unsafe_writes option (#27471)
(cherry picked from commit dd5d191d7a)
* Explain disk size in mount and add example
- Explain mount with 8GB
- Add new example to start container with mount
* Removed trailing whitespace
(cherry picked from commit f85065dabf)
* Fix targets that may be a list containing strings and lists which worked prior to 2.6.
* Add ec2_group integration tests for lists of nested targets
* changelog
* Add diff mode support for lists of targets containing strings and lists.
(cherry picked from commit d7ca3f2bd3)
* fix nxos_facts indefinite hang for text based output (#45845)
Signed-off-by: Trishna Guha <trishnaguha17@gmail.com>
(cherry picked from commit 1b0c4fde86)
It has lots of FieldAttributes that won't serialize.
Also the connection doesn't care.
(cherry picked from commit 3d0f19d)
Co-authored-by: Nathaniel Case <this.is@nathanielca.se>
* Add docs on how to write changelog fragments
* Add link to new style changelog
Remove redundant mention of old style changelog
(cherry picked from commit 5d6f844eba)
* Fix remote checksums when paths have leading dots (#45287)
* Fix remote checksums with paths have leading dots
* Fix result recorded from the wrong file
* Add changelog fragment
(cherry picked from commit 600c7ac108)
* [stable-2.7] Fix logic to not re-download existing files when force=no (#45495)
* Fix logic to not re-download existing files when force=no. Fixes#45491
* Reduce logic complexity.
(cherry picked from commit 5785de582f)
Co-authored-by: Matt Martz <matt@sivel.net>
* Backport of get_url fix cannot use result
result was only added in 2.8+
* update porting guides
With PR #40532 `shade` library was retired and replaced with direct use
of `openstacksdk`. Porting guides and doc about dynamic inventory were
not updated.
(cherry picked from commit 8ae14bebda)
* [AWS] cloudfront_distribution - fix method name from 'validate_distribution_id_from_caller_reference' to 'validate_distribution_from_caller_reference' and set distribution_id to the distribution's key 'Id' (#45498)
(cherry picked from commit e5269c047c)
* changelog
* Don't pass file_name to DataLoader.load in script inventory plugin. Fixes#34164
* Add changelog fragment
(cherry picked from commit 263b9fa)
Co-authored-by: Matt Martz <matt@sivel.net>
* Set defaults from params after loading files, allowing params to override (#44142)
* Set defaults from params after loading files, allowing params to override
* cleanup, add some comments
(cherry picked from commit aa01d9d243)
* Add client_from_kubeconfig function back for 2.7.0 since it's late in the 2.7 cycle to remove module_util code.
* Fix integration test as wrong module was called
* Create block section for failures on integration test for mr_l3_firewall integration test
(cherry picked from commit 6c67674eab)
* Fix enabling my.meraki.com
- A parameter of "no" wouldn't be picked up
- Check for False in addition to whether it exists
* Clean up disable_my_meraki parameter check
(cherry picked from commit afbf72cfeb)
* Use a sensible default for k8s merge_type
The sensible default for merge_type is `['strategic-merge', 'merge'].
However, we can't make this the default default, as we need to support
users who are using openshift 0.6.0, where the merge_type parameter is
unsupported.
* Refactor k8s test suite for merge_type tests
Allow tests with pre-merge-type openshift and post-merge-type
openshift.
(cherry picked from commit 1463c2e4a8)
* check role arn for ecs task definition
If the task role in a ECS task definition changes ansible should create a new revsion of the task definition.
(cherry picked from commit 71c4355d58)
* plugins/callbacks : fix some key documentation (#45267)
These are supposed to be a dictionary with section/key entries;
correct a few typos.
(cherry picked from commit c34e0f5e11)
* backport of #45267
* Fix health check configurations being ignored - #43244
* Ensure health_check_protocol is not None before check
* Simplify long indented if statement
(cherry picked from commit 7e426b0381)
- If a field in the URL has a space it would result in a 400 without making it URL safe
- Fixes#42371 and #43378
(cherry picked from commit 4ce09ea62d)
* Add tests to replicate bug #44788
* Handle when userId is same account due to in-account peering
* Module defaults for main.yml
* Turn off VPC peering tests in CI
* Fix diff_ignore_lines option issue for candidate configuration
* diff_ignore_lines option is to handle the running config fetch from
remote host and ignore the lines that are auto updated eg: commit time and date
* This option should not be used while processing candidate (input) configuration
* Fix review comment
(cherry picked from commit a3c137c1ab)
* Fix spurious `changed=True` when int is passed as tag
* Fix for all AWS module using compare_aws_tags
* Handle improperly stringified protocols and allow inconsistency between None/-1 on non-tcp protocols
* Add integration test that reproduces the same bug
* Return false if the comparsison is not equal
(cherry picked from commit 20f21779d3)
ec2 inventory script was throwing errors when using Python 3.7:
TypeError: option values must be strings
This changes the None ConfigParser options to empty strings instead.
(cherry picked from commit 505ce6ccf6)
* ec2_vpc_route_table - allow routes to be created if the CIDR already exists but its 'Origin' is 'EnableVgwRoutePropagation' (which cannot be replaced). (#43417)
Fixes#43415
(cherry picked from commit a6c97f2243)
The documentation formatting was a bit incorrect and the dependencies
mentioned were out of date. This fixes that.
(cherry picked from commit 4154cab278)
* Fix netconf netconf issues
* Identifier is optional for get_schema api
* Fix dispatch api mandatory argument check
* Add save option handling to copy config from target datastore
to startup datastore if supported
* Validate config in check-mode or if validate option set to true
* Copy config if check-mode is not enabled
(cherry picked from commit 455dfbe732)
- Limit virtualenv version on Python 2.6.
- Limit pyopenssl version on Python 2.6.
- Pin pyfmg version to keep unit tests passing.
(cherry picked from commit b3a3e8ba7b)
If you have questions about anything related to Ansible, get in touch with us!
See [Communicating with the Ansible community](https://docs.ansible.com/ansible/devel/community/communication.html) to find out how.
Please see the [Community Guide](https://docs.ansible.com/ansible/latest/community/index.html) for information on how to ask questions on the [mailing lists](https://docs.ansible.com/ansible/latest/community/communication.html#mailing-list-information) and IRC.
The [Community Guide](https://docs.ansible.com/ansible/devel/community/index.html) also explains how to contribute
and interact with the project, including how to submit bug reports and code to Ansible.
Please note that the GitHub issue tracker is not the best place to ask questions for several reasons.
You'll get more helpful, and quicker, responses in the forum.
The GitHub issue tracker is not the best place for questions for various reasons, but both IRC and the mailing list are very helpful places for those things, as the community page explains best.
## CONTRIBUTING ?
By contributing to this project you agree to the [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco).
By contributing you agree that these contributions are your own (or approved by your employer) and you grant a full, complete, irrevocable copyright license to all users and developers of the project, present and future, pursuant to the license of the project. You can also read the same [CLA](https://docs.ansible.com/ansible/latest/community/contributor_license_agreement.html) on the Ansible docsite.
The Ansible project is licensed under the [GPL-3.0](COPYING) or later. Some portions of the code fall under other licenses as noted in individual files.
The Ansible project accepts contributions through GitHub pull requests.
Please review the [Community Guide](https://docs.ansible.com/ansible/devel/community/index.html) for more information on contributing to Ansible.
Please review the [Community Guide](https://docs.ansible.com/ansible/latest/community/index.html) for more information on contributing to Ansible.
## BUG TO REPORT ?
First and foremost, also check the [Community Guide](https://docs.ansible.com/ansible/devel/community/index.html).
First and foremost, also check the [Community Guide](https://docs.ansible.com/ansible/latest/community/index.html).
You can report bugs or make enhancement requests at
the [Ansible GitHub issue page](http://github.com/ansible/ansible/issues/new/choose) by filling out the issue template that will be presented.
You can report bugs or make enhancement requests at the [Ansible GitHub issue page](http://github.com/ansible/ansible/issues/new/choose) by filling out the issue template that will be presented.
Also please make sure you are testing on the latest released version of Ansible or the development branch.
See the [Installation Guide](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) for details.
Also please make sure you are testing on the latest released version of Ansible or the development branch; see the [Installation Guide](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) for details.
Thanks!
## DEVELOPER CERTIFICATE OF ORIGIN (DCO)
This document was created by the Linux Kernel community and is a simple statement that you, as a contributor, have the legal right to make the contribution.
```text
Developer Certificate of Origin
Version 1.1
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
1 Letterman Drive
Suite D4700
San Francisco, CA, 94129
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.
Developer's Certificate of Origin 1.1
By making a contribution to this project, I certify that:
(a) The contribution was created in whole or in part by me and I
have the right to submit it under the open source license
indicated in the file; or
(b) The contribution is based upon previous work that, to the best
of my knowledge, is covered under an appropriate open source
license and I have the right under that license to submit that
work with modifications, whether created in whole or in part
by me, under the same open source license (unless I am
permitted to submit under a different license), as indicated
in the file; or
(c) The contribution was provided directly to me by some other
person who certified (a), (b) or (c) and I have not modified
it.
(d) I understand and agree that this project and the contribution
are public and that a record of the contribution (including all
personal information I submit with it, including my sign-off) is
maintained indefinitely and may be redistributed consistent with
this project or the open source license(s) involved.
Provide all relevant information below, e.g. target OS versions,
network device firmware, etc.
placeholder:RHEL 8, CentOS Stream etc.
validations:
required:true
- type:textarea
attributes:
label:Steps to Reproduce
description:|
Describe exactly how to reproduce the problem, using a minimal test-case. It would *really* help us understand your problem if you could also provide any playbooks, configs and commands you used.
**HINT:** You can paste https://gist.github.com links for larger files.
value:|
<!--- Paste example playbooks or commands between quotes below -->
```yaml (paste below)
```
placeholder:|
1. Implement the following playbook:
```yaml
---
# ping.yml
- hosts: all
gather_facts: false
tasks:
- ping:
...
```
2. Then run `ANSIBLE_DEBUG=1 ansible-playbook ping.yml -vvvvv`
3. An error occurs.
validations:
required:true
- type:textarea
attributes:
label:Expected Results
description:>-
Describe what you expected to happen when running the steps above.
placeholder:>-
I expected X to happen because I assumed Y and was shocked
that it did not.
validations:
required:true
- type:textarea
attributes:
label:Actual Results
description:|
Describe what actually happened. If possible run with extra verbosity (`-vvvv`).
Paste verbatim command output and don't wrap it with triple backticks — your
whole input will be turned into a code snippet automatically.
Hi! Thanks for your interest in contributing to Ansible. We document our Coding Guidelines in the [Developer Guide](https://docs.ansible.com/ansible/devel/dev_guide/). We particularly suggest you review:
* [Contributing your module to Ansible](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_checklist.html)
* [Development conventions, tips and pitfalls](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_best_practices.html)
Our [Community Guide](https://docs.ansible.com/ansible/devel/community/) may also help you connect with the community of Ansible developers.
The Ansible Module Maintainer Guidelines can now be found in the [official Ansible community guide](https://docs.ansible.com/ansible/latest/community/maintainers.html).
See also the [Developers Guide](https://docs.ansible.com/ansible/latest/dev_guide/)
tar -C deb-build/$${DIST} -xvf dist/$(NAME)-$(VERSION).tar.gz ;\
cp -a packaging/debian deb-build/$${DIST}/$(NAME)-$(VERSION)/ ;\
sed -ie "s|%VERSION%|$(DEB_VERSION)|g;s|%RELEASE%|$(DEB_RELEASE)|;s|%DIST%|$${DIST}|g;s|%DATE%|$(DEB_DATE)|g" deb-build/$${DIST}/$(NAME)-$(VERSION)/debian/changelog ;\
[](https://docs.ansible.com/ansible/devel/community/code_of_conduct.html)
[](https://bestpractices.coreinfrastructure.org/projects/2372)
# Ansible
Ansible is a radically simple IT automation system. It handles
ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex
changes like zero-downtime rolling updates with load balancers easy. More information on the Ansible [website](https://ansible.com/).
## Design Principles
* Have an extremely simple setup process with a minimal learning curve.
* Manage machines quickly and in parallel.
* Avoid custom-agents and additional open ports, be agentless by
leveraging the existing SSH daemon.
* Describe infrastructure in a language that is both machine and human
friendly.
* Focus on security and easy auditability/review/rewriting of content.
* Manage new remote machines instantly, without bootstrapping any
software.
* Allow module development in any dynamic language, not just Python.
* Be usable as non-root.
* Be the easiest IT automation system to use, ever.
## Use Ansible
You can install a released version of Ansible with `pip` or a package manager. See our
[installation guide](https://docs.ansible.com/ansible/latest/installation_guide/intro_installation.html) for details on installing Ansible
on a variety of platforms.
Power users and developers can run the `devel` branch, which has the latest
features and fixes, directly. Although it is reasonably stable, you are more likely to encounter
breaking changes when running the `devel` branch. We recommend getting involved
in the Ansible community if you want to run the `devel` branch.
## Communication
Join the Ansible forum to ask questions, get help, and interact with the
community.
* [Get Help](https://forum.ansible.com/c/help/6): Find help or share your Ansible knowledge to help others.
Use tags to filter and subscribe to posts, such as the following:
* Posts tagged with [ansible](https://forum.ansible.com/tag/ansible)
* Posts tagged with [ansible-core](https://forum.ansible.com/tag/ansible-core)
* Posts tagged with [playbook](https://forum.ansible.com/tag/playbook)
* [Social Spaces](https://forum.ansible.com/c/chat/4): Meet and interact with fellow enthusiasts.
* [News & Announcements](https://forum.ansible.com/c/news/5): Track project-wide announcements including social events.
* [Bullhorn newsletter](https://docs.ansible.com/ansible/devel/community/communication.html#the-bullhorn): Get release announcements and important changes.
For more ways to get in touch, see [Communicating with the Ansible community](https://docs.ansible.com/ansible/devel/community/communication.html).
## Contribute to Ansible
* Check out the [Contributor's Guide](./.github/CONTRIBUTING.md).
* Read [Community Information](https://docs.ansible.com/ansible/devel/community) for all
kinds of ways to contribute to and interact with the project,
including how to submit bug reports and code to Ansible.
* Submit a proposed code update through a pull request to the `devel` branch.
* Talk to us before making larger changes
to avoid duplicate efforts. This not only helps everyone
know what is going on, but it also helps save time and effort if we decide
some changes are needed.
## Coding Guidelines
We document our Coding Guidelines in the [Developer Guide](https://docs.ansible.com/ansible/devel/dev_guide/). We particularly suggest you review:
* [Contributing your module to Ansible](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_checklist.html)
* [Conventions, tips, and pitfalls](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_best_practices.html)
## Branch Info
* The `devel` branch corresponds to the release actively under development.
* The `stable-2.X` branches correspond to stable releases.
* Create a branch based on `devel` and set up a [dev environment](https://docs.ansible.com/ansible/devel/dev_guide/developing_modules_general.html#common-environment-setup) if you want to open a PR.
* See the [Ansible release and maintenance](https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html) page for information about active branches.
## Roadmap
Based on team and community feedback, an initial roadmap will be published for a major or minor version (ex: 2.7, 2.8).
The [Ansible Roadmap page](https://docs.ansible.com/ansible/devel/roadmap/) details what is planned and how to influence the roadmap.
## Authors
Ansible was created by [Michael DeHaan](https://github.com/mpdehaan)
and has contributions from over 5000 users (and growing). Thanks everyone!
[Ansible](https://www.ansible.com) is sponsored by [Red Hat, Inc.](https://www.redhat.com)
from __future__ import (absolute_import, division, print_function)
__metaclass__ = type
__requires__ = ['ansible']
try:
import pkg_resources
except Exception:
# Use pkg_resources to find the correct versions of libraries and set
# sys.path appropriately when there are multiversion installs. But we
# have code that better expresses the errors in the places where the code
# is actually used (the deps are optional for many code paths) so we don't
# want to fail here.
pass
import os
import shutil
import sys
import traceback
from ansible.errors import AnsibleError, AnsibleOptionsError, AnsibleParserError
from ansible.module_utils._text import to_text
# Used for determining if the system is running a new enough python version
# and should only restrict on our documented minimum versions
_PY3_MIN = sys.version_info[:2] >= (3, 5)
_PY2_MIN = (2, 6) <= sys.version_info[:2] < (3,)
_PY_MIN = _PY3_MIN or _PY2_MIN
if not _PY_MIN:
raise SystemExit('ERROR: Ansible requires a minimum of Python2 version 2.6 or Python3 version 3.5. Current version: %s' % ''.join(sys.version.splitlines()))
class LastResort(object):
# OUTPUT OF LAST RESORT
def display(self, msg, log_only=None):
print(msg, file=sys.stderr)
def error(self, msg, wrap_text=None):
print(msg, file=sys.stderr)
if __name__ == '__main__':
display = LastResort()
try: # bad ANSIBLE_CONFIG or config options can force ugly stacktrace
import ansible.constants as C
from ansible.utils.display import Display
except AnsibleOptionsError as e:
display.error(to_text(e), wrap_text=False)
sys.exit(5)
cli = None
me = os.path.basename(sys.argv[0])
try:
display = Display()
display.debug("starting run")
sub = None
target = me.split('-')
if target[-1][0].isdigit():
# Remove any version or python version info as downstreams
- templating - Relaxed the Jinja sandbox to allow specific bitwise operations which have no filter equivalent. The allowed methods are ``__and__``, ``__lshift__``, ``__or__``, ``__rshift__``, ``__xor__``.
- templating - Switched from the Jinja immutable sandbox to the standard sandbox. This restores the ability to use mutation methods such as ``list.append`` and ``dict.update``.
Bugfixes
--------
- Update automatic role argument spec validation to not use deprecated syntax (https://github.com/ansible/ansible/issues/85399).
- ssh connection plugin - Allow only one password prompt attempt when utilizing ``SSH_ASKPASS`` (https://github.com/ansible/ansible/issues/85359)
- Added type annotations to the ``Role.__init__()`` method to enable type checking. (https://github.com/ansible/ansible/pull/85346)
- ansible-test - Added experimental support for remote debugging.
- ansible-test - Added support for setting static environment variables in integration tests using ``env/set/`` entries in the ``aliases`` file. For example, ``env/set/MY_KEY/MY_VALUE`` or ``env/set/MY_PATH//an/abs/path``.
- ansible-test - The ``shell`` command has been augmented to propagate remote debug configurations and other test-related settings when running on the controller. Use the ``--raw`` argument to bypass the additional environment configuration.
- display - The ``formatted`` arg to ``warning`` has no effect. Warning wrapping is left to the consumer (e.g. terminal, browser).
- display - The ``wrap_text`` and ``stderr`` arguments to ``error`` have no effect. Errors are always sent to stderr and wrapping is left to the consumer (e.g. terminal, browser).
- module_utils.basic.backup_local enforces check_mode now
- variables - Removed restriction on usage of most Python keywords as Ansible variable names.
- variables - Warnings about reserved variable names now show context where the variable was defined.
Deprecated Features
-------------------
- inventory plugins - Setting invalid Ansible variable names in inventory plugins is deprecated.
- playbook syntax - Specifying the task ``args`` keyword without a value is deprecated.
- playbook syntax - Using ``key=value`` args and the task ``args`` keyword on the same task is deprecated.
- playbook syntax - Using a mapping with the ``action`` keyword is deprecated. (https://github.com/ansible/ansible/issues/84101)
Bugfixes
--------
- ansible-test - Fix Python relative import resolution from ``__init__.py`` files when using change detection.
- callback plugins - A more descriptive error is now raised if the stdout callback plugin cannot be loaded.
- callback plugins - Callback plugins that do not extend ``ansible.plugins.callback.CallbackBase`` will fail to load with a warning. If the plugin is used as the stdout callback plugin, this will also be a fatal error.
- callback plugins - The stdout callback plugin is no longer called twice if it is also in the list of additional callback plugins.
- password lookup - fix acquiring the lock when human-readable FileExistsError error message is not English.
- plugin loader - A warning is now emitted for any plugin which fails to load due to a missing base class.
- variables - Added Jinja scalar singletons (``true``, ``false``, ``none``) to invalid Ansible variable name detection. Previously, variables with these names could be assigned without error, but could not be resolved.
- ansiballz - Added an experimental AnsiballZ extension for remote debugging.
- ansiballz - Added support for AnsiballZ extensions.
- ansiballz - Moved AnsiballZ code coverage support into an extension.
- ansiballz - Refactored AnsiballZ and module respawn.
- template action and lookup plugin - The value of the ``ansible_managed`` variable (if set) will not be masked by the ``template`` action and lookup. Previously, the value calculated by the ``DEFAULT_MANAGED_STR`` configuration option always masked the variable value during plugin execution, preventing runtime customization.
Bugfixes
--------
- Fix templating ``tags`` on plays and roles. (https://github.com/ansible/ansible/issues/69903)
- ansible-doc will no longer ignore docs for modules without an extension (https://github.com/ansible/ansible/issues/85279).
- display - Fix hang caused by early post-fork writers to stdout/stderr (e.g., pydevd) encountering an unreleased fork lock.
- get_url - add a check to recognize incomplete data transfers.
- include_tasks - fix templating options when used as a handler (https://github.com/ansible/ansible/pull/85015).
- templating - Fixed cases where template expression blocks halted prematurely when a Jinja macro invocation returned an undefined value.
- templating - Jinja macros returned from a template expression can now be called from another template expression.
- Improved SUSE distribution detection in distribution.py by parsing VARIANT_ID from /etc/os-release for identifying SLES_SAP and SL-Micro. Falls back to /etc/products.d/baseproduct symlink for older systems.
- Remove unnecessary shebang from the ``hostname`` module.
- Use ``importlib.metadata.version()`` to detect Jinja version as jinja2.__version__ is deprecated and will be removed in Jinja 3.3.
- ansible-doc - Return dynamic stub when reporting on Jinja filters and tests not explicitly documented in Ansible
- ansible-test - Add RHEL 10.0 as a remote platform for testing.
- apt_repository - remove Python 2 support
- csvfile lookup - remove Python 2 compat
- display - Add ``help_text`` and ``obj`` to ``Display.error_as_warning``.
- display - Replace Windows newlines (``\r\n``) in display output with Unix newlines (``\n``). This ensures proper display of strings sourced from Windows hosts in environments which treat ``\r`` as ``\n``, such as Azure Pipelines.
- facts - add "Linode" for Linux VM in virtual facts
- module_utils - Add optional ``help_text`` argument to ``AnsibleModule.warn``.
- ssh agent - Added ``SSH_AGENT_EXECUTABLE`` config to allow override of ssh-agent.
- ssh connection plugin - Added ``verbosity`` config to decouple SSH debug output verbosity from Ansible verbosity. Previously, the Ansible verbosity value was always applied to the SSH client command-line, leading to excessively verbose output. Set the ``ANSIBLE_SSH_VERBOSITY`` envvar or ``ansible_ssh_verbosity`` Ansible variable to a positive integer to increase SSH client verbosity.
- task timeout - Specifying a timeout greater than 100,000,000 now results in an error.
- windows - Added support for ``#AnsibleRequires -Wrapper`` to request a PowerShell module be run through the execution wrapper scripts without any module utils specified.
- windows - Added support for running signed modules and scripts with a Windows host protected by Windows App Control/WDAC. This is a tech preview and the interface may be subject to change.
- windows - Script modules will preserve UTF-8 encoding when executing the script.
Deprecated Features
-------------------
- The ``ShellModule.checksum`` method is now deprecated and will be removed in ansible-core 2.23. Use ``ActionBase._execute_remote_stat()`` instead.
- The ``ansible.module_utils.common.collections.count()`` function is deprecated and will be removed in ansible-core 2.23. Use ``collections.Counter()`` from the Python standard library instead.
-``ansible.compat.importlib_resources`` is deprecated and will be removed in ansible-core 2.23. Use ``importlib.resources`` from the Python standard library instead.
Bugfixes
--------
- Core Jinja test plugins - Builtin test plugins now always return ``bool`` to avoid spurious deprecation warnings for some malformed inputs.
- ansible-test - Disabled the ``bad-super-call`` pylint rule due to false positives.
- ansible-test - Fix incorrect handling of options with optional args (e.g. ``--color``), when followed by other options which are omitted during arg filtering (e.g. ``--docker``). Previously it was possible for non-option arguments to be incorrectly omitted in these cases. (https://github.com/ansible/ansible/issues/85173)
- ansible-test - Improve type inference for pylint deprecated checks to accommodate some type annotations.
- async_status module - The ``started`` and ``finished`` return values are now ``True`` or ``False`` instead of ``1`` or ``0``.
- constructed inventory - Use the ``default_value`` or ``trailing_separator`` in a ``keyed_groups`` entry if the expression result of ``key`` is ``None`` and not just an empty string.
- dnf5 - handle all libdnf5 specific exceptions (https://github.com/ansible/ansible/issues/84634)
- error handling - Error details and tracebacks from connection and built-in action exceptions are preserved. Previously, much of the detail was lost or mixed into the error message.
- from_yaml_all filter - `None` and empty string inputs now always return an empty list. Previously, `None` was returned in Jinja native mode and empty list in classic mode.
- local connection plugin - The command-line used to create subprocesses is now always ``str`` to avoid issues with debuggers and profilers.
- ssh agent - Fixed several potential startup hangs for badly-behaved or overloaded ssh agents.
- task timeout - Specifying a negative task timeout now results in an error.
- facts - add "CloudStack KVM Hypervisor" for Linux VM in virtual facts (https://github.com/ansible/ansible/issues/85089).
- modules - use ``AnsibleModule.warn`` instead of passing ``warnings`` to ``exit_json`` or ``fail_json`` which is deprecated.
Bugfixes
--------
- ansible-test - Updated the ``pylint`` sanity test to skip some deprecation validation checks when all arguments are dynamic.
- config - Preserve or apply Origin tag to values returned by config.
- config - Prevented fatal errors when ``MODULE_IGNORE_EXTS`` configuration was set.
- config - Templating failures on config defaults now issue a warning. Previously, failures silently returned an unrendered and untrusted template to the caller.
- config - ``ensure_type`` correctly propagates trust and other tags on returned values.
- config - ``ensure_type`` now converts mappings to ``dict`` when requested, instead of returning the mapping.
- config - ``ensure_type`` now converts sequences to ``list`` when requested, instead of returning the sequence.
- config - ``ensure_type`` now correctly errors when ``pathlist`` or ``pathspec`` types encounter non-string list items.
- config - ``ensure_type`` now reports an error when ``bytes`` are provided for any known ``value_type``. Previously, the behavior was undefined, but often resulted in an unhandled exception or incorrect return type.
- config - ``ensure_type`` with expected type ``int`` now properly converts ``True`` and ``False`` values to ``int``. Previously, these values were silently returned unmodified.
- convert_bool.boolean API conversion function - Unhashable values passed to ``boolean`` behave like other non-boolean convertible values, returning False or raising ``TypeError`` depending on the value of ``strict``. Previously, unhashable values always raised ``ValueError`` due to an invalid set membership check.
- dnf5 - when ``bugfix`` and/or ``security`` is specified, skip packages that do not have any such updates, even for new versions of libdnf5 where this functionality changed and it is considered failure
- plugin loader - Apply template trust to strings loaded from plugin configuration definitions and doc fragments.
- template action - Template files where the entire file's output renders as ``None`` are no longer emitted as the string "None", but instead render to an empty file as in previous releases.
- ansible-config will now show internal, but not test configuration entries. This allows for debugging but still denoting the configurations as internal use only (_ prefix).
- ansible-test - Improved ``pylint`` checks for Ansible-specific deprecation functions.
- ansible-test - Use the ``-t`` option to set the stop timeout when stopping a container. This avoids use of the ``--time`` option which was deprecated in Docker v28.0.
- collection metadata - The collection loader now parses scalar values from ``meta/runtime.yml`` as strings. This avoids issues caused by unquoted values such as versions or dates being parsed as types other than strings.
- deprecation warnings - Deprecation warning APIs automatically capture the identity of the deprecating plugin. The ``collection_name`` argument is only required to correctly attribute deprecations that occur in module_utils or other non-plugin code.
- deprecation warnings - Improved deprecation messages to more clearly indicate the affected content, including plugin name when available.
- deprecations - Collection name strings not of the form ``ns.coll`` passed to deprecation API functions will result in an error.
- deprecations - Removed support for specifying deprecation dates as a ``datetime.date``, which was included in an earlier 2.19 pre-release.
- deprecations - Some argument names to ``deprecate_value`` for consistency with existing APIs. An earlier 2.19 pre-release included a ``removal_`` prefix on the ``date`` and ``version`` arguments.
- modules - The ``AnsibleModule.deprecate`` function no longer sends deprecation messages to the target host's logging system.
Deprecated Features
-------------------
- Passing a ``warnings` or ``deprecations`` key to ``exit_json`` or ``fail_json`` is deprecated. Use ``AnsibleModule.warn`` or ``AnsibleModule.deprecate`` instead.
- plugins - Accessing plugins with ``_``-prefixed filenames without the ``_`` prefix is deprecated.
Bugfixes
--------
- Ansible will now ensure predictable permissions on remote artifacts, until now it only ensured executable and relied on system masks for the rest.
- dnf5 - avoid generating excessive transaction entries in the dnf5 history (https://github.com/ansible/ansible/issues/85046)
- Jinja plugins - Jinja builtin filter and test plugins are now accessible via their fully-qualified names ``ansible.builtin.{name}``.
- Task Execution / Forks - Forks no longer inherit stdio from the parent ``ansible-playbook`` process. ``stdout``, ``stderr``, and ``stdin`` within a worker are detached from the terminal, and non-functional. All needs to access stdio from a fork for controller side plugins requires use of ``Display``.
- ansible-test - Packages beneath ``module_utils`` can now contain ``__init__.py`` files.
- variables - The type system underlying Ansible's variable storage has been significantly overhauled and formalized. Attempts to store unsupported Python object types in variables now more consistently yields early warnings or errors.
- variables - To support new Ansible features, many variable objects are now represented by subclasses of their respective native Python types. In most cases, they behave indistinguishably from their original types, but some Python libraries do not handle builtin object subclasses properly. Custom plugins that interact with such libraries may require changes to convert and pass the native types.
Minor Changes
-------------
- Added a -vvvvv log message indicating when a host fails to produce output within the timeout period.
- AnsibleModule.uri - Add option ``multipart_encoding`` for ``form-multipart`` files in body to change default base64 encoding for files
- INVENTORY_IGNORE_EXTS config, removed ``ini`` from the default list, inventory scripts using a corresponding .ini configuration are rare now and inventory.ini files are more common. Those that need to ignore the ini files for inventory scripts can still add it to configuration.
- Jinja plugins - Plugins can declare support for undefined values.
- Jinja2 version 3.1.0 or later is now required on the controller.
- Move ``follow_redirects`` parameter to module_utils so external modules can reuse it.
- PlayIterator - do not return tasks from already executed roles so specific strategy plugins do not have to do the filtering of such tasks themselves
- SSH Escalation-related -vvv log messages now include the associated host information.
- Windows - Add support for Windows Server 2025 to Ansible and as an ``ansible-test`` remote target - https://github.com/ansible/ansible/issues/84229
- Windows - refactor the async implementation to better handle errors during bootstrapping and avoid WMI when possible.
-``ansible-galaxy collection install`` — the collection dependency resolver now prints out conflicts it hits during dependency resolution when it's taking too long and it ends up backtracking a lot. It also displays suggestions on how to help it compute the result more quickly.
- ansible-test - Automatically retry HTTP GET/PUT/DELETE requests on exceptions.
- ansible-test - Default to Python 3.13 in the ``base`` and ``default`` containers.
- ansible-test - Disable the ``deprecated-`` prefixed ``pylint`` rules as their results vary by Python version.
- ansible-test - Disable the ``pep8`` sanity test rules ``E701`` and ``E704`` to improve compatibility with ``black``.
- ansible-test - Improve container runtime probe error handling. When unexpected probe output is encountered, an error with more useful debugging information is provided.
- ansible-test - Replace container Alpine 3.20 with 3.21.
- ansible-test - Replace container Fedora 40 with 41.
- ansible-test - Replace remote Alpine 3.20 with 3.21.
- ansible-test - Replace remote Fedora 40 with 41.
- ansible-test - Replace remote FreeBSD 13.3 with 13.5.
- ansible-test - Replace remote FreeBSD 14.1 with 14.2.
- ansible-test - Replace remote RHEL 9.4 with 9.5.
- ansible-test - Show a more user-friendly error message when a ``runme.sh`` script is not executable.
- ansible-test - The ``yamllint`` sanity test now enforces string values for the ``!vault`` tag.
- ansible-test - Update ``nios-test-container`` to version 7.0.0.
- ansible-test - Update ``pylint`` sanity test to use version 3.3.1.
- ansible-test - Update sanity test requirements to latest available versions.
- ansible-test - Update the HTTP test container.
- ansible-test - Update the PyPI test container.
- ansible-test - Update the ``base`` and ``default`` containers.
- ansible-test - Update the utility container.
- ansible-test - Use Python's ``urllib`` instead of ``curl`` for HTTP requests.
- ansible-test - When detection of the current container network fails, a warning is now issued and execution continues. This simplifies usage in cases where the current container cannot be inspected, such as when running in GitHub Codespaces.
- ansible-test acme test container - bump `version to 2.3.0 <https://github.com/ansible/acme-test-container/releases/tag/2.3.0>`__ to include newer versions of Pebble, dependencies, and runtimes. This adds support for ACME profiles, ``dns-account-01`` support, and some smaller improvements (https://github.com/ansible/ansible/pull/84547).
- apt_key module - add notes to docs and errors to point at the CLI tool deprecation by Debian and alternatives
- apt_repository module - add notes to errors to point at the CLI tool deprecation by Debian and alternatives
- become plugins get new property 'pipelining' to show support or lack there of for the feature.
- callback plugins - add has_option() to CallbackBase to match other functions overloaded from AnsiblePlugin
- callback plugins - fix get_options() for CallbackBase
- copy - fix sanity test failures (https://github.com/ansible/ansible/pull/83643).
- copy - parameter ``local_follow`` was incorrectly documented as having default value ``True`` (https://github.com/ansible/ansible/pull/83643).
- cron - Provide additional error information while writing cron file (https://github.com/ansible/ansible/issues/83223).
- csvfile - let the config system do the typecasting (https://github.com/ansible/ansible/pull/82263).
- display - Deduplication of warning and error messages considers the full content of the message (including source and traceback contexts, if enabled). This may result in fewer messages being omitted.
- distribution - Added openSUSE MicroOS to Suse OS family (#84685).
- docs - add collection name in message from which the module is being deprecated (https://github.com/ansible/ansible/issues/84116).
- env lookup - The error message generated for a missing environment variable when ``default`` is an undefined value (e.g. ``undef('something')``) will contain the hint from that undefined value, except when the undefined value is the default of ``undef()`` with no arguments. Previously, any existing undefined hint would be ignored.
- file - enable file module to disable diff_mode (https://github.com/ansible/ansible/issues/80817).
- file - make code more readable and simple.
- filter - add support for URL-safe encoding and decoding in b64encode and b64decode (https://github.com/ansible/ansible/issues/84147).
- find - add a checksum_algorithm parameter to specify which type of checksum the module will return
- from_json filter - The filter accepts a ``profile`` argument, which defaults to ``tagless``.
- handlers - Templated handler names with syntax errors, or that resolve to ``omit`` are now skipped like handlers with undefined variables in their name.
- improved error message for yaml parsing errors in plugin documentation
- local connection plugin - A new ``become_strip_preamble`` config option (default True) was added; disable to preserve diagnostic ``become`` output in task results.
- local connection plugin - A new ``become_success_timeout`` operation-wide timeout config (default 10s) was added for ``become``.
- local connection plugin - When a ``become`` plugin's ``prompt`` value is a non-string after the ``check_password_prompt`` callback has completed, no prompt stripping will occur on stderr.
- lookup_template - add an option to trim blocks while templating (https://github.com/ansible/ansible/issues/75962).
- module - set ipv4 and ipv6 rules simultaneously in iptables module (https://github.com/ansible/ansible/issues/84404).
- module_utils - Add ``NoReturn`` type annotations to functions which never return.
- modules - PowerShell modules can now receive ``datetime.date``, ``datetime.time`` and ``datetime.datetime`` values as ISO 8601 strings.
- modules - PowerShell modules can now receive strings sourced from inline vault-encrypted strings.
- modules - Unhandled exceptions during Python module execution are now returned as structured data from the target. This allows the new traceback handling to be applied to exceptions raised on targets.
- pipelining logic has mostly moved to connection plugins so they can decide/override settings.
- plugin error handling - When raising exceptions in an exception handler, be sure to use ``raise ... from`` as appropriate. This supersedes the use of the ``AnsibleError`` arg ``orig_exc`` to represent the cause. Specifying ``orig_exc`` as the cause is still permitted. Failure to use ``raise ... from`` when ``orig_exc`` is set will result in a warning. Additionally, if the two cause exceptions do not match, a warning will be issued.
- removed hardcoding of su plugin as it now works with pipelining.
- runtime-metadata sanity test - improve validation of ``action_groups`` (https://github.com/ansible/ansible/pull/83965).
- service_facts module got freebsd support added.
- ssh connection plugin - Support ``SSH_ASKPASS`` mechanism to provide passwords, making it the default, but still offering an explicit choice to use ``sshpass`` (https://github.com/ansible/ansible/pull/83936)
- ssh connection plugin now overrides pipelining when a tty is requested.
- ssh-agent - ``ansible``, ``ansible-playbook`` and ``ansible-console`` are capable of spawning or reusing an ssh-agent, allowing plugins to interact with the ssh-agent. Additionally a pure python ssh-agent client has been added, enabling easy interaction with the agent. The ssh connection plugin contains new functionality via ``ansible_ssh_private_key`` and ``ansible_ssh_private_key_passphrase``, for loading an SSH private key into the agent from a variable.
- templating - Access to an undefined variable from inside a lookup, filter, or test (which raises MarkerError) no longer ends processing of the current template. The triggering undefined value is returned as the result of the offending plugin invocation, and the template continues to execute.
- templating - Embedding ``range()`` values in containers such as lists will result in an error on use. Previously the value would be converted to a string representing the range parameters, such as ``range(0, 3)``.
- templating - Handling of omitted values is now a first-class feature of the template engine, and is usable in all Ansible Jinja template contexts. Any template that resolves to ``omit`` is automatically removed from its parent container during templating.
- templating - Template evaluation is lazier than in previous versions. Template expressions which resolve only portions of a data structure no longer result in the entire structure being templated.
- templating - Templating errors now provide more information about both the location and context of the error, especially for deeply-nested and/or indirected templating scenarios.
- templating - Unified ``omit`` behavior now requires that plugins calling ``Templar.template()`` handle cases where the entire template result is omitted, by catching the ``AnsibleValueOmittedError`` that is raised. Previously, this condition caused a randomly-generated string marker to appear in the template result.
- templating - Variables of type ``set`` and ``tuple`` are now converted to ``list`` when exiting the final pass of templating.
- to_json / to_nice_json filters - The filters accept a ``profile`` argument, which defaults to ``tagless``.
- troubleshooting - Tracebacks can be collected and displayed for most errors, warnings, and deprecation warnings (including those generated by modules). Tracebacks are no longer enabled with ``-vvv``; the behavior is directly configurable via the ``DISPLAY_TRACEBACK`` config option. Module tracebacks passed to ``fail_json`` via the ``exception`` kwarg will not be included in the task result unless error tracebacks are configured.
- undef jinja function - The ``undef`` jinja function now raises an error if a non-string hint is given. Attempting to use an undefined hint also results in an error, ensuring incorrect use of the function can be distinguished from the function's normal behavior.
- validate-modules sanity test - make sure that ``module`` and ``plugin````seealso`` entries use FQCNs (https://github.com/ansible/ansible/pull/84325).
- vault - improved vault filter documentation by adding missing example content for dump_template_data.j2, refining examples for clarity, and ensuring variable consistency (https://github.com/ansible/ansible/issues/83583).
- warnings - All warnings (including deprecation warnings) issued during a task's execution are now accessible via the ``warnings`` and ``deprecations`` keys on the task result.
- when the ``dict`` lookup is given a non-dict argument, show the value of the argument and its type in the error message.
- windows - add hard minimum limit for PowerShell to 5.1. Ansible dropped support for older versions of PowerShell in the 2.16 release but this requirement is now enforced at runtime.
- windows - refactor windows exec runner to improve efficiency and add better error reporting on failures.
- winrm - Remove need for pexpect on macOS hosts when using ``kinit`` to retrieve the Kerberos TGT. By default the code will now only use the builtin ``subprocess`` library which should handle issues with select and a high fd count and also simplify the code.
Breaking Changes / Porting Guide
--------------------------------
- Support for the ``toml`` library has been removed from TOML inventory parsing and dumping. Use ``tomli`` for parsing on Python 3.10. Python 3.11 and later have built-in support for parsing. Use ``tomli-w`` to support outputting inventory in TOML format.
- assert - The ``quiet`` argument must be a commonly-accepted boolean value. Previously, unrecognized values were silently treated as False.
- conditionals - Conditional expressions that result in non-boolean values are now an error by default. Such results often indicate unintentional use of templates where they are not supported, resulting in a conditional that is always true. When this option is enabled, conditional expressions which are a literal ``None`` or empty string will evaluate as true, for backwards compatibility. The error can be temporarily changed to a deprecation warning by enabling the ``ALLOW_BROKEN_CONDITIONALS`` config option.
- first_found lookup - When specifying ``files`` or ``paths`` as a templated list containing undefined values, the undefined list elements will be discarded with a warning. Previously, the entire list would be discarded without any warning.
- internals - The ``AnsibleLoader`` and ``AnsibleDumper`` classes for working with YAML are now factory functions and cannot be extended.
- internals - The ``ansible.utils.native_jinja`` Python module has been removed.
- lookup plugins - Lookup plugins called as `with_(lookup)` will no longer have the `_subdir` attribute set.
- lookup plugins - ``terms`` will always be passed to ``run`` as the first positional arg, where previously it was sometimes passed as a keyword arg when using ``with_`` syntax.
- loops - Omit placeholders no longer leak between loop item templating and task templating. Previously, ``omit`` placeholders could remain embedded in loop items after templating and be used as an ``omit`` for task templating. Now, values resolving to ``omit`` are dropped immediately when loop items are templated. To turn missing values into an ``omit`` for task templating, use ``| default(omit)``. This solution is backward-compatible with previous versions of ansible-core.
- modules - Ansible modules using ``sys.excepthook`` must use a standard ``try/except`` instead.
- plugins - Any plugin that sources or creates templates must properly tag them as trusted.
- plugins - Custom Jinja plugins that accept undefined top-level arguments must opt in to receiving them.
- plugins - Custom Jinja plugins that use ``environment.getitem`` to retrieve undefined values will now trigger a ``MarkerError`` exception. This exception must be handled to allow the plugin to return a ``Marker``, or the plugin must opt-in to accepting ``Marker`` values.
- public API - The ``ansible.vars.fact_cache.FactCache`` wrapper has been removed.
- serialization of ``omit`` sentinel - Serialization of variables containing ``omit`` sentinels (e.g., by the ``to_json`` and ``to_yaml`` filters or ``ansible-inventory``) will fail if the variable has not completed templating. Previously, serialization succeeded with placeholder strings emitted in the serialized output.
- set_fact - The string values "yes", "no", "true" and "false" were previously converted (ignoring case) to boolean values when not using Jinja2 native mode. Since Jinja2 native mode is always used, this conversion no longer occurs. When boolean values are required, native boolean syntax should be used where variables are defined, such as in YAML. When native boolean syntax is not an option, the ``bool`` filter can be used to parse string values into booleans.
- template lookup - The ``convert_data`` option is deprecated and no longer has any effect. Use the ``from_json`` filter on the lookup result instead.
- templating - Access to ``_`` prefixed attributes and methods, and methods with known side effects, is no longer permitted. In cases where a matching mapping key is present, the associated value will be returned instead of an error. This increases template environment isolation and ensures more consistent behavior between the ``.`` and ``[]`` operators.
- templating - Conditionals and lookups which use embedded inline templates in Jinja string constants now display a warning. These templates should be converted to their expression equivalent.
- templating - Many Jinja plugins (filters, lookups, tests) and methods previously silently ignored undefined inputs, which often masked subtle errors. Passing an undefined argument to a Jinja plugin or method that does not declare undefined support now results in an undefined value.
- templating - Templates are always rendered in Jinja2 native mode. As a result, non-string values are no longer automatically converted to strings.
- templating - Templates resulting in ``None`` are no longer automatically converted to an empty string.
- templating - Templates with embedded inline templates that were not contained within a Jinja string constant now result in an error, as support for multi-pass templating was removed for security reasons. In most cases, such templates can be easily rewritten to avoid the use of embedded inline templates.
- templating - The ``allow_unsafe_lookups`` option no longer has any effect. Lookup plugins are responsible for tagging strings containing templates to allow evaluation as a template.
- templating - The result of the ``range()`` global function cannot be returned from a template- it should always be passed to a filter (e.g., ``random``). Previously, range objects returned from an intermediate template were always converted to a list, which is inconsistent with inline consumption of range objects.
- templating - ``#jinja2:`` overrides in templates with invalid override names or types are now templating errors.
Deprecated Features
-------------------
- CLI - The ``--inventory-file`` option alias is deprecated. Use the ``-i`` or ``--inventory`` option instead.
- Strategy Plugins - Use of strategy plugins not provided in ``ansible.builtin`` are deprecated and do not carry any backwards compatibility guarantees going forward. A future release will remove the ability to use external strategy plugins. No alternative for third party strategy plugins is currently planned.
-``ansible.module_utils.compat.datetime`` - The datetime compatibility shims are now deprecated. They are scheduled to be removed in ``ansible-core`` v2.21. This includes ``UTC``, ``utcfromtimestamp()`` and ``utcnow`` importable from said module (https://github.com/ansible/ansible/pull/81874).
- bool filter - Support for coercing unrecognized input values (including None) has been deprecated. Consult the filter documentation for acceptable values, or consider use of the ``truthy`` and ``falsy`` tests.
- cache plugins - The `ansible.plugins.cache.base` Python module is deprecated. Use `ansible.plugins.cache` instead.
- callback plugins - The `v2_on_any` callback method is deprecated. Use specific callback methods instead.
- callback plugins - The v1 callback API (callback methods not prefixed with `v2_`) is deprecated. Use `v2_` prefixed methods instead.
- conditionals - Conditionals using Jinja templating delimiters (e.g., ``{{``, ``{%``) should be rewritten as expressions without delimiters, unless the entire conditional value is a single template that resolves to a trusted string expression. This is useful for dynamic indirection of conditional expressions, but is limited to trusted literal string expressions.
- config - The ``ACTION_WARNINGS`` config has no effect. It previously disabled command warnings, which have since been removed.
- config - The ``DEFAULT_JINJA2_NATIVE`` option has no effect. Jinja2 native mode is now the default and only option.
- config - The ``DEFAULT_NULL_REPRESENTATION`` option has no effect. Null values are no longer automatically converted to another value during templating of single variable references.
- display - The ``Display.get_deprecation_message`` method has been deprecated. Call ``Display.deprecated`` to display a deprecation message, or call it with ``removed=True`` to raise an ``AnsibleError``.
- file loading - Loading text files with ``DataLoader`` containing data that cannot be decoded under the expected encoding is deprecated. In most cases the encoding must be UTF-8, although some plugins allow choosing a different encoding. Previously, invalid data was silently wrapped in Unicode surrogate escape sequences, often resulting in later errors or other data corruption.
- first_found lookup - Splitting of file paths on ``,;:`` is deprecated. Pass a list of paths instead. The ``split`` method on strings can be used to split variables into a list as needed.
- interpreter discovery - The ``auto_legacy`` and ``auto_legacy_silent`` options for ``INTERPRETER_PYTHON`` are deprecated. Use ``auto`` or ``auto_silent`` options instead, as they have the same effect.
- oneline callback - The ``oneline`` callback and its associated ad-hoc CLI args (``-o``, ``--one-line``) are deprecated.
- paramiko - The paramiko connection plugin has been deprecated with planned removal in 2.21.
- playbook variables - The ``play_hosts`` variable has been deprecated, use ``ansible_play_batch`` instead.
- plugin error handling - The ``AnsibleError`` constructor arg ``suppress_extended_error`` is deprecated. Using ``suppress_extended_error=True`` has the same effect as ``show_content=False``.
- template lookup - The jinja2_native option is no longer used in the Ansible Core code base. Jinja2 native mode is now the default and only option.
- templating - Support for enabling Jinja2 extensions (not plugins) has been deprecated.
- templating - The ``disable_lookups`` option has no effect, since plugins must be updated to apply trust before any templating can be performed.
- tree callback - The ``tree`` callback and its associated ad-hoc CLI args (``-t``, ``--tree``) are deprecated.
Removed Features (previously deprecated)
----------------------------------------
- Remove deprecated plural form of collection path (https://github.com/ansible/ansible/pull/84156).
- encrypt - passing unsupported passlib hashtype now raises AnsibleFilterError.
- manager - remove deprecated include_delegate_to parameter from get_vars API.
- modules - Modules returning non-UTF8 strings now result in an error. The ``MODULE_STRICT_UTF8_RESPONSE`` setting can be used to disable this check.
- removed deprecated pycompat24 and compat.importlib.
- selector - remove deprecated compat.selector related files (https://github.com/ansible/ansible/pull/84155).
- windows - removed common module functions ``ConvertFrom-AnsibleJson``, ``Format-AnsibleException`` from Windows modules as they are not used and add unneeded complexity to the code.
Security Fixes
--------------
- include_vars action - Ensure that result masking is correctly requested when vault-encrypted files are read. (CVE-2024-8775)
- task result processing - Ensure that action-sourced result masking (``_ansible_no_log=True``) is preserved. (CVE-2024-8775)
- templating - Ansible's template engine no longer processes Jinja templates in strings unless they are marked as coming from a trusted source. Untrusted strings containing Jinja template markers are ignored with a warning. Examples of trusted sources include playbooks, vars files, and many inventory sources. Examples of untrusted sources include module results and facts. Plugins which have not been updated to preserve trust while manipulating strings may inadvertently cause them to lose their trusted status.
- templating - Changes to conditional expression handling removed numerous instances of insecure multi-pass templating (which could result in execution of untrusted template expressions).
- user action won't allow ssh-keygen, chown and chmod to run on existing ssh public key file, avoiding traversal on existing symlinks (CVE-2024-9902).
Bugfixes
--------
- Ansible will now also warn when reserved keywords are set via a module (set_fact, include_vars, etc).
- Ansible.Basic - Fix ``required_if`` check when the option value to check is unset or set to null.
- Correctly return ``False`` when using the ``filter`` and ``test`` Jinja tests on plugin names which are not filters or tests, respectively. (resolves issue https://github.com/ansible/ansible/issues/82084)
- Do not run implicit ``flush_handlers`` meta tasks when the whole play is excluded from the run due to tags specified.
- Errors now preserve stacked error messages even when YAML is involved.
- Fix a display.debug statement with the wrong param in _get_diff_data() method
- Fix disabling SSL verification when installing collections and roles from git repositories. If ``--ignore-certs`` isn't provided, the value for the ``GALAXY_IGNORE_CERTS`` configuration option will be used (https://github.com/ansible/ansible/issues/83326).
- Fix ipv6 pattern bug in lib/ansible/parsing/utils/addresses.py (https://github.com/ansible/ansible/issues/84237)
- Fix returning 'unreachable' for the overall task result. This prevents false positives when a looped task has unignored unreachable items (https://github.com/ansible/ansible/issues/84019).
- Implicit ``meta: flush_handlers`` tasks now have a parent block to prevent potential tracebacks when calling methods like ``get_play()`` on them internally.
- Improve performance on large inventories by reducing the number of implicit meta tasks.
- Jinja plugins - Errors raised will always be derived from ``AnsibleTemplatePluginError``.
- Optimize the way tasks from within ``include_tasks``/``include_role`` are inserted into the play.
- Time out waiting on become is an unreachable error (https://github.com/ansible/ansible/issues/84468)
- Use consistent multiprocessing context for action write locks
- Use the requested error message in the ansible.module_utils.facts.timeout timeout function instead of hardcoding one.
- Windows - add support for running on system where WDAC is in audit mode with ``Dynamic Code Security`` enabled.
- YAML parsing - The `!unsafe` tag no longer coerces non-string scalars to strings.
-``ansible-galaxy`` — the collection dependency resolver now treats version specifiers starting with ``!=`` as unpinned.
-``package``/``dnf`` action plugins - provide the reason behind the failure to gather the ``ansible_pkg_mgr`` fact to identify the package backend
- action plugins - Action plugins that raise unhandled exceptions no longer terminate playbook loops. Previously, exceptions raised by an action plugin caused abnormal loop termination and loss of loop iteration results.
- ansible-config - format galaxy server configs while dumping in JSON format (https://github.com/ansible/ansible/issues/84840).
- ansible-doc - If none of the files in files exists, path will be undefined and a direct reference will throw an UnboundLocalError (https://github.com/ansible/ansible/pull/84464).
- ansible-galaxy - Small adjustments to URL building for ``download_url`` and relative redirects.
- ansible-pull change detection will now work independently of callback or result format settings.
- ansible-test - Enable the ``sys.unraisablehook`` work-around for the ``pylint`` sanity test on Python 3.11. Previously the work-around was only enabled for Python 3.12 and later. However, the same issue has been discovered on Python 3.11.
- ansible-test - Ensure CA certificates are installed on managed FreeBSD instances.
- ansible-test - Fix support for PowerShell module_util imports with the ``-Optional`` flag.
- ansible-test - Fix support for detecting PowerShell modules importing module utils with the newer ``#AnsibleRequires`` format.
- ansible-test - Fix traceback that occurs after an interactive command fails.
- ansible-test - Fix up coverage reporting to properly translate the temporary path of integration test modules to the expected static test module path.
- ansible-test - Fixed traceback when handling certain YAML errors in the ``yamllint`` sanity test.
- ansible-test - Managed macOS instances now use the ``sudo_chdir`` option for the ``sudo`` become plugin to avoid permission errors when dropping privileges.
- ansible-vault will now correctly handle `--prompt`, previously it would issue an error about stdin if no 2nd argument was passed
- ansible_uptime_second - added ansible_uptime_seconds fact support for AIX (https://github.com/ansible/ansible/pull/84321).
- apt_key module - prevent tests from running when apt-key was removed
- build - Pin ``wheel`` in ``pyproject.toml`` to ensure compatibility with supported ``setuptools`` versions.
- config - various fixes to config lookup plugin (https://github.com/ansible/ansible/pull/84398).
- copy - refactor copy module for simplicity.
- copy action now prevents user from setting internal options.
- debconf - set empty password values (https://github.com/ansible/ansible/issues/83214).
- debug - hide loop vars in debug var display (https://github.com/ansible/ansible/issues/65856).
- default callback - Error context is now shown for failing tasks that use the ``debug`` action.
- display - The ``Display.deprecated`` method once again properly handles the ``removed=True`` argument (https://github.com/ansible/ansible/issues/82358).
- distro - add support for Linux Mint Debian Edition (LMDE) (https://github.com/ansible/ansible/issues/84934).
- distro - detect Debian as os_family for LMDE 6 (https://github.com/ansible/ansible/issues/84934).
- dnf5 - Handle forwarded exceptions from dnf5-5.2.13 where a generic ``RuntimeError`` was previously raised
- dnf5 - fix ``is_installed`` check for packages that are not installed but listed as provided by an installed package (https://github.com/ansible/ansible/issues/84578)
- dnf5 - fix installing a package using ``state=latest`` when a binary of the same name as the package is already installed (https://github.com/ansible/ansible/issues/84259)
- dnf5 - fix traceback when ``enable_plugins``/``disable_plugins`` is used on ``python3-libdnf5`` versions that do not support this functionality
- dnf5 - libdnf5 - use ``conf.pkg_gpgcheck`` instead of deprecated ``conf.gpgcheck`` which is used only as a fallback
- dnf5 - matching on a binary can be achieved only by specifying a full path (https://github.com/ansible/ansible/issues/84334)
- facts - gather pagesize and calculate respective values depending upon architecture (https://github.com/ansible/ansible/issues/84773).
- facts - skip if distribution file path is directory, instead of raising error (https://github.com/ansible/ansible/issues/84006).
- find - skip ENOENT error code while recursively enumerating files. find module will now be tolerant to race conditions that remove files or directories from the target it is currently inspecting. (https://github.com/ansible/ansible/issues/84873).
- first_found lookup - Corrected return value documentation to reflect None (not empty string) for no files found.
- gather_facts action now defaults to `ansible.legacy.setup` if `smart` was set, no network OS was found and no other alias for `setup` was present.
- gather_facts action will now issues errors and warnings as appropriate if a network OS is detected but no facts modules are defined for it.
- gather_facts action, will now add setup when 'smart' appears with other modules in the FACTS_MODULES setting (#84750).
- get_url - add support for BSD-style checksum digest file (https://github.com/ansible/ansible/issues/84476).
- get_url - fix honoring ``filename`` from the ``content-disposition`` header even when the type is ``inline`` (https://github.com/ansible/ansible/issues/83690)
- host_group_vars - fixed defining the 'key' variable if the get_vars method is called with cache=False (https://github.com/ansible/ansible/issues/84384)
- include_vars - fix including previously undefined hash variables with hash_behaviour merge (https://github.com/ansible/ansible/issues/84295).
- iptables - Allows the wait parameter to be used with iptables chain creation (https://github.com/ansible/ansible/issues/84490)
- linear strategy - fix executing ``end_role`` meta tasks for each host, instead of handling these as implicit run_once tasks (https://github.com/ansible/ansible/issues/84660).
- local connection plugin - Become timeout errors now include all received data. Previously, the most recently-received data was discarded.
- local connection plugin - Ensure ``become`` success validation always occurs, even when an active plugin does not set ``prompt``.
- local connection plugin - Fixed cases where the internal ``BECOME-SUCCESS`` message appeared in task output.
- local connection plugin - Fixed hang or spurious failure when data arrived concurrently on stdout and stderr during a successful ``become`` operation validation.
- local connection plugin - Fixed hang when a become plugin expects a prompt but a password was not provided.
- local connection plugin - Fixed hang when an active become plugin incorrectly signals lack of prompt.
- local connection plugin - Fixed hang when an internal become read timeout expired before the password prompt was written.
- local connection plugin - Fixed hang when only one of stdout or stderr was closed by the ``become_exe`` subprocess.
- local connection plugin - Fixed long timeout/hang for ``become`` plugins that repeat their prompt on failure (e.g., ``sudo``, some ``su`` implementations).
- local connection plugin - Fixed silent ignore of ``become`` failures and loss of task output when data arrived concurrently on stdout and stderr during ``become`` operation validation.
- local connection plugin - Fixed task output header truncation when post-become data arrived before ``become`` operation validation had completed.
- lookup plugins - The ``terms`` arg to the ``run`` method is now always a list. Previously, there were cases where a non-list could be received.
- module arg templating - When using a templated raw task arg and a templated ``args`` keyword, args are now merged. Previously use of templated raw task args silently ignored all values from the templated ``args`` keyword.
- module defaults - Module defaults are no longer templated unless they are used by a task that does not override them. Previously, all module defaults for all modules were templated for every task.
- module respawn - limit to supported Python versions
- package_facts module when using 'auto' will return the first package manager found that provides an output, instead of just the first one, as this can be foreign and not have any packages.
- psrp - Improve stderr parsing when running raw commands that emit error records or stderr lines.
- regex_search filter - Corrected return value documentation to reflect None (not empty string) for no match.
- respawn - use copy of env variables to update existing PYTHONPATH value (https://github.com/ansible/ansible/issues/84954).
- runas become - Fix up become logic to still get the SYSTEM token with the most privileges when running as SYSTEM.
- sequence lookup - sequence query/lookups without positional arguments now return a valid list if their kwargs comprise a valid sequence expression (https://github.com/ansible/ansible/issues/82921).
- service_facts - skip lines which does not contain service names in openrc output (https://github.com/ansible/ansible/issues/84512).
- ssh - Improve the logic for parsing CLIXML data in stderr when working with Windows host. This fixes issues when the raw stderr contains invalid UTF-8 byte sequences and improves embedded CLIXML sequences.
- ssh - connection options were incorrectly templated during ``reset_connection`` tasks (https://github.com/ansible/ansible/pull/84238).
- stability - Fixed silent process failure on unhandled IOError/OSError under ``linear`` strategy.
- su become plugin - Ensure generated regex from ``prompt_l10n`` config values is properly escaped.
- su become plugin - Ensure that password prompts are correctly detected in the presence of leading output. Previously, this case resulted in a timeout or hang.
- su become plugin - Ensure that trailing colon is expected on all ``prompt_l10n`` config values.
- sudo become plugin - The `sudo_chdir` config option allows the current directory to be set to the specified value before executing sudo to avoid permission errors when dropping privileges.
- sunos - remove hard coding of virtinfo command in facts gathering code (https://github.com/ansible/ansible/pull/84357).
- to_yaml/to_nice_yaml filters - Eliminated possibility of keyword arg collisions with internally-set defaults.
- unarchive - Clamp timestamps from beyond y2038 to representible values when unpacking zip files on platforms that use 32-bit time_t (e.g. Debian i386).
- uri - Form location correctly when the server returns a relative redirect (https://github.com/ansible/ansible/issues/84540)
- uri - Handle HTTP exceptions raised while reading the content (https://github.com/ansible/ansible/issues/83794).
- uri - mark ``url`` as required (https://github.com/ansible/ansible/pull/83642).
- user - Create Buildroot subclass as alias to Busybox (https://github.com/ansible/ansible/issues/83665).
- user - Set timeout for passphrase interaction.
- user - Update prompt for SSH key passphrase (https://github.com/ansible/ansible/issues/84484).
- user - Use higher precedence HOME_MODE as UMASK for path provided (https://github.com/ansible/ansible/pull/84482).
- user action will now require O(force) to overwrite the public part of an ssh key when generating ssh keys, as was already the case for the private part.
- user module now avoids changing ownership of files symlinked in provided home dir skeleton
- vars lookup - The ``default`` substitution only applies when trying to look up a variable which is not defined. If the variable is defined, but templates to an undefined value, the ``default`` substitution will not apply. Use the ``default`` filter to coerce those values instead.
- wait_for_connection - a warning was displayed if any hosts used a local connection (https://github.com/ansible/ansible/issues/84419)
- distribution - add check to remove incorrect matches of Clear Linux when processing distribution files (https://github.com/ansible/ansible/issues/50009)
- Only delete host key from redis in-memory cache if present.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.