keycloak_realm: Add support for setting first broker login flow (#11622)
* keycloak_realm: Add support for setting first broker login flow
* Update plugins/modules/keycloak_realm.py
* Add changelog fragment
---------
(cherry picked from commit 7c039918e0)
Co-authored-by: Nils Bergmann <Nils1794@gmail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
nmcli: fix setting_types() to properly handle routing_rules as a list type (#11635)
* Fix setting_types() to properly handle routing_rules as a list type
* Add changelog fragment for ipv6.routing-rules bugfix
* Update changelogs/fragments/11630-nmcli-ipv6-routing-rules.yml
* Add PR URL to changelog fragment
---------
(cherry picked from commit 3c21ac961b)
Co-authored-by: Ted W. <ted.l.wood@gmail.com>
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
osx_defaults: add dict support (#11659)
* osx_defaults: add dict support
* add changelog frag
* osx_defaults: fix dict idempotency by using plutil -extract for type-preserving read
The previous approach piped `defaults read` output (old-style plist text)
through `plutil -convert json`. Old-style plist loses boolean type info
(booleans appear as 1/0, indistinguishable from integers), causing the
comparison to fail and reporting changed=True on every run.
Fix by exporting the domain binary plist to a temp file and using
`plutil -extract key json` which correctly preserves all plist types
(booleans stay true/false, integers stay integers, etc.).
* change param from bool to str
* Apply suggestion from review
* Update plugins/modules/osx_defaults.py
---------
(cherry picked from commit d6cb56c022)
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
supervisorctl: skip no such process for all (#11632)
* feat(supervisorctl): skip no such process for all
Do not fail, if there are no matching processes for name=all
* feat(supervisorctl): add changelog
* Update 11621-skip-no_such_process-for-name-all.yml
* fix(supervisorctl): replace single quotes to double
---------
(cherry picked from commit 69b9a3f8e2)
Co-authored-by: zr0dy <58261587+zr0dy@users.noreply.github.com>
Co-authored-by: zr0dy <zr0dy@mail.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
test: uthelper now generates one test function per test case (#11636)
(cherry picked from commit 1dfc4fed40)
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
CI: Remove FreeBSD 14.3 for devel, and replace macOS 15.3 with 26.3 (#11631)
* Replace FreeBSD 14.3 with 14.4, and macOS 15.3 with 26.3.
* FreeBSD 14.4 seems to have the same problem as FreeBSD 15.0, disabling for now.
(cherry picked from commit b4336659f6)
Co-authored-by: Felix Fontein <felix@fontein.de>
CI: Replace apt_repository and apt_key with deb822_repository (#11625)
Replace apt_repository and apt_key with deb822_repository.
(cherry picked from commit bc22fbcaa0)
Co-authored-by: Felix Fontein <felix@fontein.de>
merge_variables: extended merge capabilities added (#11536)
* merge_variables: extended merge capabilities added
This extension gives you more control over the variable merging process of the lookup plugin `merge_variables`. It closes the gap between Puppet's Hiera merging capabilities and the limitations of Ansible's default variable plugin `host_group_vars` regarding fragment-based value definition. You can now decide which merge strategy should be applied to dicts, lists, and other types. Furthermore, you can specify a merge strategy that should be applied in case of type conflicts.
The default behavior of the plugin has been preserved so that it is fully backward-compatible with the already implemented state.
* Update changelogs/fragments/11536-merge-variables-extended-merging-capabilities.yml
* Update plugins/lookup/merge_variables.py
* Periods added at the end of each choice description
* Update plugins/lookup/merge_variables.py
* ref: follow project standard for choice descriptions
* ref: more examples added and refactoring
* Update plugins/lookup/merge_variables.py
* ref: some more comments to examples added
* fix: unused import removed
* ref: re-add "merge" to strategy map
* Update comments
* Specification of transformations solely as string
* Comments updated
* ref: `append_rp` and `prepend_rp` removed
feat: options dict for list transformations re-added
feat: allow setting `keep` for dedup transformation with possible values: `first` (default) and `last`
* ref: improve options documentation
* ref: documentation improved, avoiding words like newer or older in merge description
* Update plugins/lookup/merge_variables.py
* ref: "prio" replaced by "dict"
* feat: two integration tests added
---------
(cherry picked from commit dae2157bb7)
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
Co-authored-by: Christoph Fiehe <cfiehe@users.noreply.github.com>
Co-authored-by: Fiehe Christoph <c.fiehe@eurodata.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Mark <40321020+m-a-r-k-e@users.noreply.github.com>
nictagadm: don't call is_valid_mac when etherstub is true (#11589)
* nictagadm: don't call is_valid_mac when etherstub is true
* Add changelog fragment
* update changelog fragment
* Shorten changelog fragement
* Update changelogs/fragments/nictagadm-etherstub-nonetype-bugfix.yml
---------
(cherry picked from commit d8bb637cba)
Co-authored-by: Adam D <44533090+emptyDir@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
github_secrets_info: new module (#11586)
* github_secrets_info: new module
* clean tests
* remove pynacl dep
* fqcn
* remove excess output
* just return result as sample
* only print secrets, adapt tests
* Update plugins/modules/github_secrets_info.py
* Update plugins/modules/github_secrets_info.py
* Update plugins/modules/github_secrets_info.py
* t is for typing, and typing is what we did
* add info_module attributes
---------
(cherry picked from commit df9b30448a)
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Co-authored-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
github_secrets: new module (#11514)
* add support for managing GitHub secrets
* fix tab
* update for sanity
* more sanity fixes
* update botmeta
* formating
* remove list function
* remove docstring, format text strings and return codes
* switch to deps
* black and ruff doesnt get along
* initial unit tests
* update non-existing secret test
* update description and details
* handle when a secret cant be deleted
* fail if not acceptable error codes
* add test for non-acceptable status codes
* remove local ruff config
* allow empty strings
* set required_
* extend tests
* cleanup
* cover all, got a git urlopen error
* cover all, got a git urlopen error
* ensure value cant be None
* check_mode
* bump to 12.5.0
* Update plugins/modules/github_secrets.py
* extend check_mode and related tests
* split constants and return dict when checking secret
* switch to HTTPStatus
* replace DELETE and UPDATE with NO_CONTENT
* Update plugins/modules/github_secrets.py
* Update plugins/modules/github_secrets.py
* update tests
* Update plugins/modules/github_secrets.py
* Update plugins/modules/github_secrets.py
* Update plugins/modules/github_secrets.py
* Update plugins/modules/github_secrets.py
* Update plugins/modules/github_secrets.py
---------
(cherry picked from commit 46ffec6f0e)
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Co-authored-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
ipa_dnsrecord fix error when using dnsttl and nothing to change (#11559)
* ipa_dnsrecord fix error when using dnsttl and nothing to change
* Add changelog and bump version
* ipa_dnsrecord list comp in dnsrecord_find
* 11559 changelog fragment fix capitalization
* ipa_dnsrecord dnsrecord_find ttl transform to integer always
* ipa_dnsrecord dnsrecord_find method refactor
---------
(cherry picked from commit 3194ed9d36)
Co-authored-by: Dor Breger <75537576+DorBreger@users.noreply.github.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
New module: `logrotate` (#11424)
* add module logrotate
* add values for start
* fix docs
* version 12.5.0 and fix test
---------
(cherry picked from commit f0e3edc892)
Co-authored-by: Aleksandr Gabidullin <101321307+a-gabidullin@users.noreply.github.com>
Co-authored-by: Александр Габидуллин <agabidullin@astralinux.ru>
Binary attribute support for `ldap_attrs` and `ldap_entry` (#11558)
* Binary attribute support for `ldap_attrs` and `ldap_entry`
This commit implements binary attribute support for the `ldap_attrs` and
`ldap_entry` plugins. This used to be "supported" before, because it was
possible to simply load arbitrary binary data into the attributes, but
no longer functions on recent Ansible versions.
In order to support binary attributes, this commit introduces two new
options to both plugins:
* `binary_attributes`, a list of attribute names which will be
considered as being binary,
* `honor_binary_option`, a flag which is true by default and will
handle all attributes that include the binary option (see RFC 4522)
as binary automatically.
When an attribute is determined to be binary through either of these
means, the plugin will assume that the attribute's value is in fact
base64-encoded. It will proceed to decode it and handle it accordingly.
While changes to `ldap_entry` are pretty straightforward, more work was
required on `ldap_attrs`.
* First, because both `present` and `absent` state require checking
the attribute's current values and normally do that using LDAP search
queries for each value, a specific path for binary attributes was
added that loads and caches all values for the attribute and compares
the values in the Python code.
* In addition, generating both the modlist and the diff output require
re-encoding binary attributes' values into base64 so it can be
transmitted back to Ansible.
* Various fixes on `ldap_attrs`/`ldap_entry` from PR 11558 discussion
* Rename `honor_binary_option` to `honor_binary`
* Add some general documentation about binary attributes
* Fix changelog fragment after renaming one of the new options
* Add examples of `honor_binary` and `binary_attributes`
* Add note that indicates that binary values are supported from 12.5.0+
* Fix punctuation
* Add links to RFC 4522 to `ldap_attrs` and `ldap_entry`
* Catch base64 decoding errors
* Rephrase changelog fragment
* Use f-string to format the encoding error message
(cherry picked from commit 0e4783dcc3)
Co-authored-by: Emmanuel Benoît <tseeker@nocternity.net>
nmcli: fix idempotency issue with macvlan (#11551)
* nmcli: fix idempotency issue with macvlan
The nmcli module is not idempotent for macvlan interfaces.
Ansible running in diff mode for a case where the interface in question
already exists:
```
TASK [nm_macvlan : Check macvlan connection] *********************************************************************************
--- before
+++ after
@@ -11,5 +11,5 @@
"ipv6.method": "disabled",
"macvlan.mode": "2",
"macvlan.parent": "eth0",
- "macvlan.tap": "no"
+ "macvlan.tap": "False"
}
```
The problem is that `macvlan.tap` isn't treated as boolean option. Fix it.
* Update changelogs/fragments/11551-fix-nmcli-idempotency-for-macvlan.yml
---------
(cherry picked from commit 1554f23bfb)
Co-authored-by: Martin Wilck <mwilck@suse.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
keycloak_authentication: fix TypeError when flow has no authenticationExecutions (#11548)
* TIAAS-12174: fix(keycloak_authentication): handle None authenticationExecutions
When a flow is defined without authenticationExecutions, module.params.get()
returns None but the key still exists in the config dict. The 'in' check
passes but iterating over None raises TypeError.
Guard the iteration with an explicit None check.
* keycloak_authentication: add changelog fragment for NoneType fix
* keycloak_authentication: update changelog fragment with PR link
* Update plugins/modules/keycloak_authentication.py
* Changelog polishing
---------
(cherry picked from commit 2f33ff1041)
Co-authored-by: Ivan Kokalovic <67540157+koke1997@users.noreply.github.com>
Co-authored-by: Ivan Kokalovic <ivan.kokalovic@example.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
Allow setting of independent custom domain for incus inventory (#11555)
Allowing the domain suffix to be appended independent of the `host_fqdn`
setting enables the inventory plugin to construct proper FQDNs if a
network has the `dns.domain` property set. Otherwise you would always
end up with something like `host01.project.local.example.net` despite
`host01.example.net` being the expected result.
(cherry picked from commit 71f8c15d2e)
Co-authored-by: Roland Sommer <rol@ndsommer.de>
Update links to iocage. Current iocage documentation is at freebsd.gi… (#11552)
Update links to iocage. Current iocage documentation is at freebsd.github.io/iocage/
(cherry picked from commit aaef821f60)
Co-authored-by: Vladimir Botka <vbotka@gmail.com>
