Ansible 8 is based on Ansible-core 2.15.
We suggest you read this page along with the Ansible 8 Changelog to understand what updates you may need to make.
Conditionals - due to mitigation of security issue CVE-2023-5764 in ansible-core 2.15.7, conditional expressions with embedded template blocks can fail with the message “Conditional is marked as unsafe, and cannot be evaluated.” when an embedded template consults data from untrusted sources like module results or vars marked !unsafe. Conditionals with embedded templates can be a source of malicious template injection when referencing untrusted data, and can nearly always be rewritten without embedded templates. Playbook task conditional keywords such as when and until have long displayed warnings discouraging use of embedded templates in conditionals; this warning has been expanded to non-task conditionals as well, such as the assert action.
- name: task with a module result (always untrusted by Ansible)
shell: echo "hi mom"
register: untrusted_result
# don't do it this way...
# - name: insecure conditional with embedded template consulting untrusted data
# assert:
# that: '"hi mom" is in {{ untrusted_result.stdout }}'
- name: securely access untrusted values directly as Jinja variables instead
assert:
that: '"hi mom" is in untrusted_result.stdout'
ansible-galaxy search is now 0 instead of 1 and the stdout is empty when results are empty to align with other ansible-galaxy commands.Providing a list of dictionaries to vars: is deprecated in favor of supplying a dictionary.
Instead of:
vars: - var1: foo - var2: bar
Use:
vars: var1: foo var2: bar
No notable changes
The following modules no longer exist:
No notable changes
No notable changes
No notable changes
No notable changes
No notable changes
ansible-core 2.12 and ansible-core 2.13. While we take no active measures to prevent usage and there are no plans to introduce incompatible code to the modules, we will stop testing those versions. Both are or will soon be End of Life and if you are still using them, you should consider upgrading to the latest Ansible / ansible-core 2.15 or later as soon as possible (https://github.com/ansible-collections/community.mysql/pull/574).column_case_sensitive argument’s default value will be changed to true in community.mysql 4.0.0. If your playbook expected the column to be automatically uppercased for your roles privileges, you should set this to false explicitly (https://github.com/ansible-collections/community.mysql/issues/578).column_case_sensitive argument’s default value will be changed to true in community.mysql 4.0.0. If your playbook expected the column to be automatically uppercased for your users privileges, you should set this to false explicitly (https://github.com/ansible-collections/community.mysql/issues/577).ibm.spectrum_virtualize has been renamed to ibm.storage_virtualize. For now, both collections are included in Ansible. The content in ibm.spectrum_virtualize will be replaced with deprecated redirects to the new collection in Ansible 10.0.0, and these redirects will eventually be removed from Ansible. Please update your FQCNs for ibm.spectrum_virtualize.10 for the timeout option is deprecated and will change to 60 in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/7295).community.azure collection is officially unmaintained and has been archived. Therefore, it will be removed from Ansible 10. There is already a successor collection azure.azcollection in the community package which should cover the same functionality (https://github.com/ansible-community/community-topics/issues/263).hpe.nimble collection is considered unmaintained and will be removed from Ansible 10 if no one starts maintaining it again before Ansible 10. See the removal process for details on how this works (https://github.com/ansible-community/community-topics/issues/254).vaultid parameter is deprecated and will be removed in ansible-core 2.20. Use vault_id instead.t_systems_mms.icinga_director has been renamed to telekom_mms.icinga_director. For now both collections are included in Ansible. The content in t_systems_mms.icinga_director will be replaced with deprecated redirects to the new collection in Ansible 9.0.0, and these redirects will eventually be removed from Ansible. Please update your FQCNs for t_systems_mms.icinga_director.vultr.cloud (using the recent v2 Vultr API) in the community package which covers the functionality but might not have compatible syntax (https://github.com/ansible-community/community-topics/issues/257).false of the asn1_base64 option is deprecated and will change to true in community.crypto 3.0.0 (https://github.com/ansible-collections/community.crypto/pull/600).logging in favour of producing more detailed information in the module output (https://github.com/ansible-collections/community.general/pull/7043).community.postgresql 4.0.0. Please use the postgresql_ext module instead (https://github.com/ansible-collections/community.postgresql/issues/559).community.sap has been renamed to community.sap_libs. For now both collections are included in Ansible. The content in community.sap will be replaced with deprecated redirects to the new collection in Ansible 9.0.0, and the collection will be removed from Ansible 10 completely. Please update your FQCNs for community.sap.proxmox_default_behavior will be removed in community.general 10.0.0 (https://github.com/ansible-collections/community.general/pull/6836).junos_ospfv2 - add deprecate warning for area_range.power_cap is not within the supported range of 0 to 32767, Unable to complete the request because PowerCap does not exist or is not applicable for the resource URI.
no_log feature in some modules;seq_num in fortios_router_static;member_path in all the modules;/ has been deprecated and will be removed in a release after 2025-12-01 (https://github.com/ansible-collections/amazon.aws/pull/1549).cmd_runner_fmt.as_default_type() formatter (https://github.com/ansible-collections/community.general/pull/6601).VarsMixin and supporting classes in favor of plain vardict module util (https://github.com/ansible-collections/community.general/pull/6649).compatibility is deprecated as default for parameter mode (https://github.com/ansible-collections/community.general/pull/6512).module_utils.redhat module is deprecated, as effectively unused: the Rhsm, RhsmPool, and RhsmPools classes will be removed in community.general 9.0.0; the RegistrationBase class will be removed in community.general 10.0.0 together with the rhn_register module, as it is the only user of this class; this means that the whole module_utils.redhat module will be dropped in community.general 10.0.0, so importing it without even using anything of it will fail (https://github.com/ansible-collections/community.general/pull/6663).autosubscribe alias for the auto_attach option has been deprecated for many years, although only in the documentation. Officially mark this alias as deprecated, and it will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/6646).pool option is deprecated in favour of the more precise and flexible pool_ids option (https://github.com/ansible-collections/community.general/pull/6650).state=present has not been working as expected for many years, and it seems it was not noticed so far; also, “presence” is not really a valid concept for subscription repositories, which can only be enabled or disabled. Hence, mark the present and absent values of the state option as deprecated, slating them for removal in community.general 10.0.0 (https://github.com/ansible-collections/community.general/pull/6673).nqn, wwns, host_password, host_user, target_password`and `target_user were deprecatedendpoint_type parameter is now deprecated and will be removed in version 2.0.0VOLUME instructions may be unable to start, when previously the containers started correctly. Remove the VOLUME instructions to resolve the issue. Containers with this condition will cause ansible-test to emit a warning.ansible-test with Podman.pytest assertion rewriting on Python 2.7.dnf and the new dnf5 module. As a result the following dnf5 options are effectively a no-op: cacheonly, enable_plugin, disable_plugin and lock_timeout.local_status_page_enabled and remote_status_page_enabled as these no longer work.close_notify TLS alert without closing the connection with Python’s SSLSocket (https://github.com/ansible-collections/community.docker/issues/605, https://github.com/ansible-collections/community.docker/pull/621).stdin option is used! This is caused by the inability to send an close_notify TLS alert without closing the connection with Python’s SSLSocket (https://github.com/ansible-collections/community.docker/issues/605, https://github.com/ansible-collections/community.docker/pull/621).queue tree are defined as human readable - for example 25M -, the configuration will be correctly set in ROS, but the module will indicate the item is changed on every run even when there was no change done. This is caused by the ROS API which returns the number in bytes - for example 25000000 (which is inconsistent with the CLI behavior). In order to mitigate that, the limits have to be defined in bytes (those will still appear as human readable in the ROS CLI) (https://github.com/ansible-collections/community.routeros/pull/131).routing ospf area, routing ospf area range, routing ospf instance, routing ospf interface-template paths are not fully implemented for ROS6 due to the significant changes between ROS6 and ROS7 (https://github.com/ansible-collections/community.routeros/pull/131).Unable to perform the import or export operation because there are pending attribute changes or a configuration job is in progress. Wait for the job to complete and run the task again.unable to perform the import or export operation because there are pending attribute changes or a configuration job is in progress. Wait for the job to complete and run the task again.power_cap is not within the supported range of 0 to 32767, Unable to complete the request because PowerCap does not exist or is not applicable for the resource URI.
Modular System group and corresponding child groups.Custom Groups group and corresponding child groups.PLUGIN GROUPS group and corresponding child groups._ as deprecated (https://github.com/ansible/ansible/pull/79362).755 or 644 may need to be updated to set the necessary permissions as part of the test run.vcenter test plugin now defaults to using a user-provided static configuration instead of the govcsim simulator for collections. Set the ANSIBLE_VCSIM_CONTAINER environment variable to govcsim to use the simulator. Keep in mind that the simulator is deprecated and will be removed in a future release._ were treated as deprecated, even when they were not marked as deprecated in meta/runtime.yml. This is no longer the case (https://github.com/ansible/ansible/pull/79362).missing-python-doc error code in validate modules, missing-documentation is used instead for missing PowerShell module documentation.botocore<1.25.0 and boto3<1.22.0. Most modules will continue to work with older versions of the AWS SDK, however compatibility with older versions of the SDK is not guaranteed and will not be tested. When using older versions of the SDK a warning will be emitted by Ansible (https://github.com/ansible-collections/amazon.aws/pull/1342).instance_id alias for the device_id parameter has been removed. Please use the device_id parameter name instead (https://github.com/ansible-collections/amazon.aws/issues/1176).instance_type has been removed. At least one of instance_type or launch_template must be specified when launching new instances (https://github.com/ansible-collections/amazon.aws/pull/1315).new_options return value has been deprecated after being renamed to dhcp_config. Please use the dhcp_config or dhcp_options return values (https://github.com/ansible-collections/amazon.aws/pull/1327).policy_file parameter has been removed. I(policy) with a file lookup can be used instead (https://github.com/ansible-collections/amazon.aws/issues/1178).classic_link_enabled return value has been removed. Support for EC2 Classic networking was dropped by AWS (https://github.com/ansible-collections/amazon.aws/pull/1374).classic_link_dns_status return value has been removed. Support for EC2 Classic networking was dropped by AWS (https://github.com/ansible-collections/amazon.aws/pull/1374).classic_link_enabled return value has been removed. Support for EC2 Classic networking was dropped by AWS (https://github.com/ansible-collections/amazon.aws/pull/1374).CloudRetry.backoff has been removed. Please use CloudRetry.exponential_backoff or CloudRetry.jittered_backoff instead (https://github.com/ansible-collections/amazon.aws/issues/1110).botocore<1.25.0 and boto3<1.22.0. Most modules will continue to work with older versions of the AWS SDK, however compatability with older versions of the SDK is not guaranteed and will not be tested. When using older versions of the SDK a warning will be emitted by Ansible (https://github.com/ansible-collections/community.aws/pull/1743).sudo to most commands. This behaviour was incorrect and has been removed. To execute commands as a specific user, including the root user, the become and become_user directives should be used. See the Ansible documentation for more information (https://github.com/ansible-collections/community.aws/issues/853).tags parameter now accepts a dict representing the tags, rather than the boto3 format (https://github.com/ansible-collections/community.aws/pull/1643).community.sap_libs if you are using any of the sapcar_extract, sap_task_list_execute, and hana_query modules. Without that collection installed, the redirects for these modules do not work.msg, exception, output, vars, or changed, the actual output will prefix those names with _ (underscore symbol) only when they clash with output variables generated by ModuleHelper itself, which only occurs when handling exceptions. Please note that this breaking change does not require a new major release since before this release, it was not possible to add such variables to the output due to a bug (https://github.com/ansible-collections/community.general/pull/5765).gconftool-2 when key does not exist, returning null instead of empty string for both value and previous_value return values (https://github.com/ansible-collections/community.general/issues/6028).access_level_on_creation changed from false to true (https://github.com/ansible-collections/community.general/pull/6428).hairpin option changed from true to false (https://github.com/ansible-collections/community.general/pull/6428).unprivileged option changed from false to true (https://github.com/ansible-collections/community.general/pull/6428).ansible-core 2.11 and 2.12 has been removed (https://github.com/ansible-collections/community.hashi_vault/issues/340).hvac for community.hashi_vault is now 1.1.0 (https://github.com/ansible-collections/community.hashi_vault/issues/324).password argument is deprecated and will be removed in community.postgresql 4.0.0, use the login_password argument instead (https://github.com/ansible-collections/community.postgresql/issues/406).fortios.py for higher performance;dellemc.os10 was considered unmaintained and removed from Ansible 8 as per the removal from Ansible process. Users can still install this collection with ansible-galaxy collection install dellemc.os10.dellemc.os6 was considered unmaintained and removed from Ansible 8 as per the removal from Ansible process. Users can still install this collection with ansible-galaxy collection install dellemc.os6.dellemc.os9 was considered unmaintained and removed from Ansible 8 as per the removal from Ansible process. Users can still install this collection with ansible-galaxy collection install dellemc.os9.mellanox.onyx was considered unmaintained and removed from Ansible 8 as per the removal from Ansible process. Users can still install this collection with ansible-galaxy collection install mellanox.onyx.ANSIBLE_CALLBACK_WHITELIST configuration environment variable, use ANSIBLE_CALLBACKS_ENABLED instead. (https://github.com/ansible/ansible/issues/78821)ANSIBLE_COW_WHITELIST configuration environment variable, use ANSIBLE_COW_ACCEPTLIST instead. (https://github.com/ansible/ansible/issues/78819)callback_whitelist configuration option, use callbacks_enabled instead. (https://github.com/ansible/ansible/issues/78822)cow_whitelist configuration option, use cowsay_enabled_stencils instead. (https://github.com/ansible/ansible/issues/78820)query parameter was removed. The amazon.aws.ec2_vpc_endpoint_info module now only queries for endpoints. Services can be queried using the amazon.aws.ec2_vpc_endpoint_service_info module (https://github.com/ansible-collections/amazon.aws/pull/1308).s3_object module has been removed. S3 buckets can be created and deleted using the amazon.aws.s3_bucket module (https://github.com/ansible-collections/amazon.aws/issues/1112).sap modules have been removed from this collection. They have been migrated to the community.sap_libs collection. Redirections have been provided. Following modules are affected: - sapcar_extract - sap_task_list_execute - hana_queryfmt alias of cmd_runner_fmt has been removed. Use cmd_runner_fmt instead (https://github.com/ansible-collections/community.general/pull/6428).appname and environment options have been removed. They did not do anything (https://github.com/ansible-collections/community.general/pull/6428).show-diff of the show_diff option has been removed. Use show_diff instead (https://github.com/ansible-collections/community.general/pull/6428).property, channel and value continued to be generated by mistake. This behaviour has been removed and xfconf generate no facts whatsoever (https://github.com/ansible-collections/community.general/pull/5502).previous_value and type continued to be generated by mistake. This behaviour has been removed and xfconf generate no facts whatsoever (https://github.com/ansible-collections/community.general/pull/5502).ConnectionBase()._new_stdin attribute is deprecated, use display.prompt_until(msg) instead.foreman test plugin is now deprecated. It will be removed in a future release.govcsim simulator in the vcenter test plugin is now deprecated. It will be removed in a future release. Users should switch to providing their own test environment through a static configuration file.vars: is deprecated in favor of specifying a dictionary.boto3_profile alias for the profile option has been deprecated, please use profile instead (https://github.com/ansible-collections/amazon.aws/pull/1225).amazon.aws.aws_credentials docs fragment has been deprecated please use amazon.aws.common.plugins instead (https://github.com/ansible-collections/amazon.aws/pull/1248).amazon.aws.aws_region docs fragment has been deprecated please use amazon.aws.region.plugins instead (https://github.com/ansible-collections/amazon.aws/pull/1248).amazon.aws.aws docs fragment has been deprecated please use amazon.aws.common.modules instead (https://github.com/ansible-collections/amazon.aws/pull/1248).amazon.aws.ec2 docs fragment has been deprecated please use amazon.aws.region.modules instead (https://github.com/ansible-collections/amazon.aws/pull/1248).ansible_collections.amazon.aws.module_utils.policy.sort_json_policy_dict has been deprecated consider using ansible_collections.amazon.aws.module_utils.poilcies.compare_policies instead (https://github.com/ansible-collections/amazon.aws/pull/1136).dualstack and endpoint_url at the same time has been deprecated, the dualstack parameter is ignored when endpoint_url is passed. Support will be removed in a release after 2024-12-01 (https://github.com/ansible-collections/amazon.aws/pull/1305).overwrite other than always, never, different or last last has been deprecated. Boolean values should be replaced by the strings always or never Support will be removed in a release after 2024-12-01 (https://github.com/ansible-collections/amazon.aws/pull/1305).dualstack and endpoint_url at the same time has been deprecated, the dualstack parameter is ignored when endpoint_url is passed. Support will be removed in a release after 2024-12-01 (https://github.com/ansible-collections/amazon.aws/pull/1305).purge_placement_constraints will be change from false to true (https://github.com/ansible-collections/community.aws/pull/1716).purge_placement_strategy will be change from false to true (https://github.com/ansible-collections/community.aws/pull/1716).iam_role and changed have been deprecated and will be removed in a release after 2023-12-01 (https://github.com/ansible-collections/community.aws/issues/551).assume_role_policy_document will no longer be converted from CamelCase to snake_case. The assume_role_policy_document_raw return value already returns the policy document in this future format (https://github.com/ansible-collections/community.aws/issues/551).assume_role_policy_document will no longer be converted from CamelCase to snake_case. The assume_role_policy_document_raw return value already returns the policy document in this future format (https://github.com/ansible-collections/community.aws/issues/551).mode option is deprecated; use crl_mode instead. The mode option will change its meaning in community.crypto 3.0.0, and will refer to the CRL file’s mode instead (https://github.com/ansible-collections/community.crypto/issues/596).txt_character_encoding will change from octal to decimal in community.dns 3.0.0. The new default will be compatible with RFC 1035 (https://github.com/ansible-collections/community.dns/pull/134).deps mixin for MH classes deprecated in favour of using the deps module_utils (https://github.com/ansible-collections/community.general/pull/6465).state=absent (https://github.com/ansible-collections/community.general/pull/5772).access_level_on_creation will change from false to true in community.general 7.0.0. This will cause access_level to be used during runner registration as well, and not only during updates (https://github.com/ansible-collections/community.general/pull/5908).access_level will lose its default value in community.general 8.0.0. From that version on, you have set this option to ref_protected explicitly, if you want to have a protected runner (https://github.com/ansible-collections/community.general/issues/5925).state=list in favour of using community.general.manageiq_policies_info (https://github.com/ansible-collections/community.general/pull/5721).state=list in favour of using community.general.manageiq_tags_info (https://github.com/ansible-collections/community.general/pull/5727).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).pyrax and will be removed in community.general 9.0.0 (https://github.com/ansible-collections/community.general/pull/5752).ansible-core versions 2.11 and 2.12 will be dropped in collection version 5.0.0, making 2.13 the minimum supported version of ansible-core (https://github.com/ansible-collections/community.hashi_vault/issues/340).v5.0.0 duplicate term string options will raise an exception instead of showing a warning (https://github.com/ansible-collections/community.hashi_vault/issues/356).hvac to be supported in collection version 5.0.0 will be at least 1.0.2; this minimum may be raised before 5.0.0 is released, so please subscribe to the linked issue and look out for new notices in the changelog (https://github.com/ansible-collections/community.hashi_vault/issues/324).`fusion_se` and Network Interface Groups `fusion_nig`
© 2012–2018 Michael DeHaan
© 2018–2025 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/latest/porting_guides/porting_guide_8.html