Ansible 10 is based on Ansible-core 2.17.
We suggest you read this page along with the Ansible 10 Changelog to understand what updates you may need to make.
Conditionals - due to mitigation of security issue CVE-2023-5764 in ansible-core 2.16.1, conditional expressions with embedded template blocks can fail with the message “Conditional is marked as unsafe, and cannot be evaluated.” when an embedded template consults data from untrusted sources like module results or vars marked !unsafe. Conditionals with embedded templates can be a source of malicious template injection when referencing untrusted data, and can nearly always be rewritten without embedded templates. Playbook task conditional keywords such as when and until have long displayed warnings discouraging use of embedded templates in conditionals; this warning has been expanded to non-task conditionals as well, such as the assert action.
- name: task with a module result (always untrusted by Ansible)
shell: echo "hi mom"
register: untrusted_result
# don't do it this way...
# - name: insecure conditional with embedded template consulting untrusted data
# assert:
# that: '"hi mom" is in {{ untrusted_result.stdout }}'
- name: securely access untrusted values directly as Jinja variables instead
assert:
that: '"hi mom" is in untrusted_result.stdout'
any_errors_fatal - when a task in a block with a rescue section fails on a host, the rescue section is executed on all hosts. This occurs because any_errors_fatal automatically fails all hosts.No notable changes
No notable changes
The following modules no longer exist:
No notable changes
No notable changes
No notable changes
No notable changes
No notable changes
ibm.spectrum_virtualize was renamed to ibm.storage_virtualize. For now both collections are included in Ansible. The collection will be completely removed from Ansible 12. Please update your FQCNs from ibm.spectrum_virtualize to ibm.storage_virtualize.grafana_alloy_ namespace so they are unique by @Aethylred in https://github.com/grafana/grafana-ansible-collection/pull/209
community.network collection has been deprecated. It will be removed from Ansible 12 if no one starts maintaining it again before Ansible 12. See Collections Removal Process for unmaintained collections for more details (https://forum.ansible.com/t/8030).ngine_io.exoscale collection has been deprecated. It will be removed from Ansible 11 if no one starts maintaining it again before Ansible 11. See Collections Removal Process for unmaintained collections for more details (https://forum.ansible.com/t/2572).t_systems_mms.icinga_director was renamed to telekom_mms.icinga_director. For now both collections are included in Ansible. The content in t_systems_mms.icinga_director has been replaced by deprecated redirects in Ansible 9.0.0. The collection will be completely removed from Ansible 11. Please update your FQCNs from t_systems_mms.icinga_director to telekom_mms.icinga_director.create_instance_profile and delete_instance_profile options has been deprecated and will be removed in a release after 2026-05-01. To manage IAM instance profiles the amazon.aws.iam_instance_profile module can be used instead (https://github.com/ansible-collections/amazon.aws/pull/2221).on_success and on_failure (https://github.com/ansible-collections/community.general/pull/8791).pipx older than 1.7.0 is deprecated and will be removed in community.general 11.0.0 (https://github.com/ansible-collections/community.general/pull/8793).pipx older than 1.7.0 is deprecated and will be removed in community.general 11.0.0 (https://github.com/ansible-collections/community.general/pull/8793).users_info filter returned variable plugin_auth_string contains the hashed password and it’s misleading, it will be removed from community.mysql 4.0.0. Use the plugin_hash_string return value instead (https://github.com/ansible-collections/community.mysql/pull/629).user alias of the name argument has been deprecated and will be removed in collection version 5.0.0. Use the name argument instead.frr.frr collection has been deprecated. It will be removed from Ansible 11 if no one starts maintaining it again before Ansible 11. See Collections Removal Process for unmaintained collections for more details (https://forum.ansible.com/t/6243).openvswitch.openvswitch collection has been deprecated. It will be removed from Ansible 11 if no one starts maintaining it again before Ansible 11. See Collections Removal Process for unmaintained collections for more details (https://forum.ansible.com/t/6245).crypt standard library module (https://github.com/ansible-collections/community.general/issues/4691, https://github.com/ansible-collections/community.general/pull/8497).crypt standard library module (https://github.com/ansible-collections/community.general/issues/4690, https://github.com/ansible-collections/community.general/pull/8497).ignore_none parameter within a CmdRunner context is deprecated and that feature should be removed in community.general 12.0.0 (https://github.com/ansible-collections/community.general/pull/8479).list_all option has been deprecated and will be removed in community.general 11.0.0. Use the community.general.git_config_info module instead (https://github.com/ansible-collections/community.general/pull/8453).state=present without providing value is deprecated and will be disallowed in community.general 11.0.0. Use the community.general.git_config_info module instead to read a value (https://github.com/ansible-collections/community.general/pull/8453).Please note that the fix for requests 2.32.0 included in community.docker 3.10.1 only fixes problems with the vendored Docker SDK for Python code. Modules and plugins that use Docker SDK for Python can still fail due to the SDK currently being incompatible with requests 2.32.0.
If you still experience problems with requests 2.32.0, such as error messages like Not supported URL scheme http+docker, please restrict requests to <2.32.0.
ome_network_attributes, then this module does not provide a correct error message.power_cap is not within the supported range of 0 to 32767, Unable to complete the request because PowerCap does not exist or is not applicable for the resource URI.
iam_role.assume_role_policy_document is no longer converted from CamelCase to snake_case (https://github.com/ansible-collections/amazon.aws/pull/2040).iam_role.assume_role_policy_document is no longer converted from CamelCase to snake_case (https://github.com/ansible-collections/amazon.aws/pull/2040).policies return value has been renamed to key_policies the contents has not been changed (https://github.com/ansible-collections/amazon.aws/pull/2040).policies return value has been renamed to key_policies the contents has not been changed (https://github.com/ansible-collections/amazon.aws/pull/2040).batch_size no longer defaults to 100. According to the boto3 API (https://boto3.amazonaws.com/v1/documentation/api/1.26.78/reference/services/lambda.html#Lambda.Client.create_event_source_mapping), batch_size defaults to 10 for sqs sources and to 100 for stream sources (https://github.com/ansible-collections/amazon.aws/pull/2025).botocore<1.29.0 and boto3<1.26.0. Most modules will continue to work with older versions of the AWS SDK, however compatability with older versions of the SDK is not guaranteed and will not be tested. When using older versions of the SDK a warning will be emitted by Ansible (https://github.com/ansible-collections/amazon.aws/pull/1763).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.aws_region_info.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.aws_s3_bucket_info.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_access_key.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_access_key_info.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_group (https://github.com/ansible-collections/community.aws/pull/1945).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_managed_policy (https://github.com/ansible-collections/community.aws/pull/1954).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_mfa_device_info (https://github.com/ansible-collections/community.aws/pull/1953).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_password_policy.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_role (https://github.com/ansible-collections/community.aws/pull/1948).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.iam_role_info (https://github.com/ansible-collections/community.aws/pull/1948).community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.s3_bucket_info.community.aws collection. Playbooks using the Fully Qualified Collection Name for this module should be updated to use amazon.aws.sts_assume_role.txt_character_encoding options in various modules and plugins changed from octal to decimal (https://github.com/ansible-collections/community.dns/pull/196).filters is now no longer an alias of simple_filters, but a new, different option (https://github.com/ansible-collections/community.dns/pull/196).plugin option is now required (https://github.com/ansible-collections/community.dns/pull/196).search changed from false (implicit default for community.dns 2.x.y) to true (https://github.com/ansible-collections/community.dns/issues/200, https://github.com/ansible-collections/community.dns/pull/201).mode option changed from compatibility to new (https://github.com/ansible-collections/community.general/pull/8198).virtualenv is specified but no virtual environment exists at that location (https://github.com/ansible-collections/community.general/pull/8198).timeout from 10 to 60 (https://github.com/ansible-collections/community.general/pull/8198).filters is now no longer an alias of simple_filters, but a new, different option (https://github.com/ansible-collections/community.hrobot/pull/101).not_valid_before and not_valid_after values are now returned as ISO-8601 formatted strings.not_valid_before and not_valid_after values are now returned as ISO-8601 formatted strings.api_token_env option, you may use the ansible.builtin.env lookup as alternative.deprecated value is now returned as ISO-8601 formatted strings.content_view_filter_rule should be used for thathttp://localhost:3000 as the Foreman URL, providing a URL is now mandatoryrequires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.netaddr to >=0.10.1, means that starting from this release, the minimum netaddr version this collection requires is >=0.10.1.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.netaddr library.netaddr 1.0.0, the IPAddress.is_private() method has been removed and instead, the IPAddress.is_global() method has been extended to support the same functionality. This change has been reflected in the ipaddr filter plugin.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.community.dns collection now depends on the community.library_inventory_filtering_v1 collection. This utility collection provides host filtering functionality for inventory plugins. If you use the Ansible community package, both collections are included and you do not have to do anything special. If you install the collection with ansible-galaxy collection install, it will be installed automatically. If you install the collection by copying the files of the collection to a place where ansible-core can find it, for example by cloning the git repository, you need to make sure that you also have to install the dependency if you are using the inventory plugins (https://github.com/ansible-collections/community.dns/pull/196).community.docker collection now depends on the community.library_inventory_filtering_v1 collection. This utility collection provides host filtering functionality for inventory plugins. If you use the Ansible community package, both collections are included and you do not have to do anything special. If you install the collection with ansible-galaxy collection install, it will be installed automatically. If you install the collection by copying the files of the collection to a place where ansible-core can find it, for example by cloning the git repository, you need to make sure that you also have to install the dependency if you are using the inventory plugins (https://github.com/ansible-collections/community.docker/pull/698).requests package which is required by hvac now has a more restrictive range for this collection in certain use cases due to breaking security changes in ansible-core that were backported (https://github.com/ansible-collections/community.hashi_vault/pull/416).community.hrobot collection now depends on the community.library_inventory_filtering_v1 collection. This utility collection provides host filtering functionality for inventory plugins. If you use the Ansible community package, both collections are included and you do not have to do anything special. If you install the collection with ansible-galaxy collection install, it will be installed automatically. If you install the collection by copying the files of the collection to a place where ansible-core can find it, for example by cloning the git repository, you need to make sure that you also have to install the dependency if you are using the inventory plugin (https://github.com/ansible-collections/community.hrobot/pull/101).OME_USERNAME and OME_PASSWORD as fallback for credentials.IDRAC_USERNAME and IDRAC_PASSWORD as fallback for credentials.CUSTOMCERTIFICATE.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.requires_ansible to >=2.14.0, since previous ansible-core versions are EoL now.community.azure collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/263). Users can still install this collection with ansible-galaxy collection install community.azure.gluster.gluster collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/225). Users can still install this collection with ansible-galaxy collection install gluster.gluster.hpe.nimble collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/254). Users can still install this collection with ansible-galaxy collection install hpe.nimble.netapp.aws collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/223). Users can still install this collection with ansible-galaxy collection install netapp.aws.netapp.azure collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/234). Users can still install this collection with ansible-galaxy collection install netapp.azure.netapp.elementsw collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/235). Users can still install this collection with ansible-galaxy collection install netapp.elementsw.netapp.um_info collection was considered unmaintained and has been removed from Ansible 10 (https://github.com/ansible-community/community-topics/issues/244). Users can still install this collection with ansible-galaxy collection install netapp.um_info.community.sap has been completely removed from Ansible. It has been renamed to community.sap_libs. The collection will be completely removed from Ansible eventually. Please update your FQCNs from community.sap to community.sap_libs.purestorage.fusion collection has been removed (https://forum.ansible.com/t/3712).scp_if_ssh from ssh connection plugin (https://github.com/ansible/ansible/issues/81715).dnf.iam_role.assume_role_policy_document_raw return value has been deprecated. iam_role.assume_role_policy_document now returns the same format as iam_role.assume_role_policy_document_raw (https://github.com/ansible-collections/amazon.aws/pull/2040).iam_role.assume_role_policy_document_raw return value has been deprecated. iam_role.assume_role_policy_document now returns the same format as iam_role.assume_role_policy_document_raw (https://github.com/ansible-collections/amazon.aws/pull/2040).sort_json_policy_dict() function has been removed, consider using compare_policies() instead (https://github.com/ansible-collections/amazon.aws/pull/2052).name of the prefix option was removed (https://github.com/ansible-collections/community.dns/pull/196).hosttech_dns_record_sets module has been removed (https://github.com/ansible-collections/community.dns/pull/196).community.general.packaging.os.apt_rpm that redirect to the short FQCN community.general.apt_rpm. They were originally needed to implement flatmapping; as various tooling started to recommend users to use the long names flatmapping was removed from the collection and redirects were added for users who already followed these incorrect recommendations (https://github.com/ansible-collections/community.general/pull/7835).ack_ansible29 and ack_min_ansiblecore211 options have been removed. They no longer had any effect (https://github.com/ansible-collections/community.general/pull/8198).command values cleanup, syncdb, and validate were removed. Use clearsessions, migrate, and check instead, respectively (https://github.com/ansible-collections/community.general/pull/8198).DependencyMixin has been removed. Use the deps module utils instead (https://github.com/ansible-collections/community.general/pull/8198).proxmox_default_behavior option has been removed (https://github.com/ansible-collections/community.general/pull/8198).pyrax and were thus removed (https://github.com/ansible-collections/community.general/pull/8198).Rhsm, RhsmPool, and RhsmPools have been removed (https://github.com/ansible-collections/community.general/pull/8198).autosubscribe of the auto_attach option was removed (https://github.com/ansible-collections/community.general/pull/8198).message argument in grafana_dashboard
inspur.sm collection is considered unmaintained and will be removed from Ansible 11 if no one starts maintaining it again before Ansible 11. See Collections Removal Process for unmaintained collections for more details, including for how this can be cancelled (https://forum.ansible.com/t/2854).netapp.storagegrid collection is considered unmaintained and will be removed from Ansible 11 if no one starts maintaining it again before Ansible 11. See Collections Removal Process for unmaintained collections for more details, including for how this can be cancelled (https://forum.ansible.com/t/2811).get_host_vars or get_group_vars are deprecated. The plugin should be updated to inherit from BaseVarsPlugin and define a get_vars method as the entrypoint.module_utils - importing the following convenience helpers from ansible.module_utils.basic has been deprecated: get_exception, literal_eval, _literal_eval, datetime, signal, types, chain, repeat, PY2, PY3, b, binary_type, integer_types, iteritems, string_types, test_type, map and shlex_quote.include_extra_api_calls option has been assigned to release 9.0.0 (https://github.com/ansible-collections/amazon.aws/pull/2040).template parameter has been deprecated and will be removed in a release after 2026-05-01. The template_body parameter can be used in conjungtion with the lookup plugin (https://github.com/ansible-collections/amazon.aws/pull/2048).policies return key has been assigned to release 9.0.0. Use the policy_names return key instead (https://github.com/ansible-collections/amazon.aws/pull/2040)./ (https://github.com/ansible-collections/amazon.aws/pull/1998).boto3 parameter for get_aws_connection_info() will be removed in a release after 2025-05-01. The boto3 parameter has been ignored since release 4.0.0 (https://github.com/ansible-collections/amazon.aws/pull/2047).boto3 parameter for get_aws_region() will be removed in a release after 2025-05-01. The boto3 parameter has been ignored since release 4.0.0 (https://github.com/ansible-collections/amazon.aws/pull/2047).boto3 parameter for get_ec2_security_group_ids_from_names() will be removed in a release after 2025-05-01. The boto3 parameter has been ignored since release 4.0.0 (https://github.com/ansible-collections/amazon.aws/pull/2047).rds_param_group module has been renamed to rds_instance_param_group. The usage of the module has not changed. The rds_param_group alias will be removed in version 10.0.0 (https://github.com/ansible-collections/amazon.aws/pull/2058).connection_parameters return key from after 2024-06-01 to release version 9.0.0, it is being replaced by the raw_connection_parameters key (https://github.com/ansible-collections/community.aws/pull/518).purge_capacity_providers, the current default of False will be changed to True in release 9.0.0. To maintain the current behaviour explicitly set purge_capacity_providers=False (https://github.com/ansible-collections/community.aws/pull/1640).purge_placement_constraints, the current default of False will be changed to True in release 9.0.0. To maintain the current behaviour explicitly set purge_placement_constraints=False (https://github.com/ansible-collections/community.aws/pull/1716).purge_placement_strategy, the current default of False will be changed to True in release 9.0.0. To maintain the current behaviour explicitly set purge_placement_strategy=False (https://github.com/ansible-collections/community.aws/pull/1716).community.crypto.acme[.documentation] docs fragment is deprecated and will be removed from community.crypto 3.0.0. Replace it with both the new community.crypto.acme.basic and community.crypto.acme.account fragments (https://github.com/ansible-collections/community.crypto/pull/735).CryptoBackend must override get_ordered_csr_identifiers(). The current default implementation, which simply sorts the result of get_csr_identifiers(), will then be removed (https://github.com/ansible-collections/community.crypto/pull/725).get_cert_information() method for a ACME crypto backend must be implemented from community.crypto 3.0.0 on (https://github.com/ansible-collections/community.crypto/pull/736).crypto.module_backends.common module utils is deprecated and will be removed from community.crypto 3.0.0. Use the improved argspec module util instead (https://github.com/ansible-collections/community.crypto/pull/749)._pipe: if the object needs to be (re-)generated, only the changed status is set, but the object is not updated. From community.crypto 3.0.0 on, the modules will ignore check mode and always act as if check mode is not active. This behavior can already achieved now by adding check_mode: false to the task. If you think this breaks your use-case of this module, please create an issue in the community.crypto repository (https://github.com/ansible-collections/community.crypto/issues/712, https://github.com/ansible-collections/community.crypto/pull/714).filters option has been renamed to simple_filters. The old name will stop working in community.hrobot 2.0.0 (https://github.com/ansible-collections/community.dns/pull/181).community.docker.docker_compose_v2 module, which works with Docker Compose v2 (https://github.com/ansible-collections/community.docker/issues/823, https://github.com/ansible-collections/community.docker/pull/833).ignore for the image_name_mismatch parameter has been deprecated and will switch to recreate in community.docker 4.0.0. A deprecation warning will be printed in situations where the default value is used and where a behavior would change once the default changes (https://github.com/ansible-collections/community.docker/pull/703).ssl_version option has been deprecated and will be removed from community.docker 4.0.0. It has already been removed from Docker SDK for Python 7.0.0, and was only necessary in the past to work around SSL/TLS issues (https://github.com/ansible-collections/community.docker/pull/853).module_utils.mh.mixin.deps.DependencyCtxMgr in favour of module_utils.deps (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.AnsibleModule (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.DependencyCtxMgr (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.StateMixin (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.VarDict, (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.VarMeta (https://github.com/ansible-collections/community.general/pull/8280).plugins.module_utils.module_helper.VarsMixin (https://github.com/ansible-collections/community.general/pull/8280).VarsMixin in favor of using the VardDict module_utils (https://github.com/ansible-collections/community.general/pull/8226).VarMeta, VarDict and VarsMixin to version 11.0.0 (https://github.com/ansible-collections/community.general/pull/8226).state=present and state=installed is deprecated and will change in community.general 11.0.0. Right now the module will upgrade a package to the latest version if one of these two states is used. You should explicitly use state=latest if you want this behavior, and switch to state=present_not_latest if you do not want to upgrade the package if it is already installed. In community.general 11.0.0 the behavior of state=present and state=installed will change to that of state=present_not_latest (https://github.com/ansible-collections/community.general/issues/8217, https://github.com/ansible-collections/community.general/pull/8285).consul_token and consul_policy can be used instead (https://github.com/ansible-collections/community.general/pull/7901).ack_venv_creation_deprecation option has no more effect and will be removed from community.general 11.0.0 (https://github.com/ansible-collections/community.general/pull/8198).false for use_tls and validate_certs have been deprecated and will change to true in community.general 10.0.0 to improve security. You can already improve security now by explicitly setting them to true. Specifying values now disables the deprecation warning (https://github.com/ansible-collections/community.general/pull/7578).filters option has been renamed to simple_filters. The old name will stop working in community.hrobot 2.0.0 (https://github.com/ansible-collections/community.hrobot/pull/94).openshift inventory plugin has been deprecated and will be removed in release 4.0.0 (https://github.com/ansible-collections/kubernetes.core/issues/31).vm_tools_install_status will be removed from next major version (5.0.0) of the collection since the API call that provides this information has been deprecated by VMware. Use vm_tools_running_status / vm_tools_version_status instead (https://github.com/ansible-collections/community.vmware/issues/2033).dellemc_idrac_storage_volume module is deprecated and replaced with idrac_storage_volume.k8s inventory plugin has been deprecated and will be removed in release 4.0.0 (https://github.com/ansible-collections/kubernetes.core/issues/31).
© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_10.html