* ipa_dnsrecord fix error when using dnsttl and nothing to change
* Add changelog and bump version
* ipa_dnsrecord list comp in dnsrecord_find
Co-authored-by: Felix Fontein <felix@fontein.de>
* 11559 changelog fragment fix capitalization
* ipa_dnsrecord dnsrecord_find ttl transform to integer always
* ipa_dnsrecord dnsrecord_find method refactor
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* add module logrotate
* add values for start
* fix docs
* version 12.5.0 and fix test
---------
Co-authored-by: Александр Габидуллин <agabidullin@astralinux.ru>
* Binary attribute support for `ldap_attrs` and `ldap_entry`
This commit implements binary attribute support for the `ldap_attrs` and
`ldap_entry` plugins. This used to be "supported" before, because it was
possible to simply load arbitrary binary data into the attributes, but
no longer functions on recent Ansible versions.
In order to support binary attributes, this commit introduces two new
options to both plugins:
* `binary_attributes`, a list of attribute names which will be
considered as being binary,
* `honor_binary_option`, a flag which is true by default and will
handle all attributes that include the binary option (see RFC 4522)
as binary automatically.
When an attribute is determined to be binary through either of these
means, the plugin will assume that the attribute's value is in fact
base64-encoded. It will proceed to decode it and handle it accordingly.
While changes to `ldap_entry` are pretty straightforward, more work was
required on `ldap_attrs`.
* First, because both `present` and `absent` state require checking
the attribute's current values and normally do that using LDAP search
queries for each value, a specific path for binary attributes was
added that loads and caches all values for the attribute and compares
the values in the Python code.
* In addition, generating both the modlist and the diff output require
re-encoding binary attributes' values into base64 so it can be
transmitted back to Ansible.
* Various fixes on `ldap_attrs`/`ldap_entry` from PR 11558 discussion
* Rename `honor_binary_option` to `honor_binary`
* Add some general documentation about binary attributes
* Fix changelog fragment after renaming one of the new options
* Add examples of `honor_binary` and `binary_attributes`
* Add note that indicates that binary values are supported from 12.5.0+
* Fix punctuation
* Add links to RFC 4522 to `ldap_attrs` and `ldap_entry`
* Catch base64 decoding errors
* Rephrase changelog fragment
* Use f-string to format the encoding error message
* nmcli: fix idempotency issue with macvlan
The nmcli module is not idempotent for macvlan interfaces.
Ansible running in diff mode for a case where the interface in question
already exists:
```
TASK [nm_macvlan : Check macvlan connection] *********************************************************************************
--- before
+++ after
@@ -11,5 +11,5 @@
"ipv6.method": "disabled",
"macvlan.mode": "2",
"macvlan.parent": "eth0",
- "macvlan.tap": "no"
+ "macvlan.tap": "False"
}
```
The problem is that `macvlan.tap` isn't treated as boolean option. Fix it.
* Update changelogs/fragments/11551-fix-nmcli-idempotency-for-macvlan.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* TIAAS-12174: fix(keycloak_authentication): handle None authenticationExecutions
When a flow is defined without authenticationExecutions, module.params.get()
returns None but the key still exists in the config dict. The 'in' check
passes but iterating over None raises TypeError.
Guard the iteration with an explicit None check.
* keycloak_authentication: add changelog fragment for NoneType fix
* keycloak_authentication: update changelog fragment with PR link
* Update plugins/modules/keycloak_authentication.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Changelog polishing
---------
Co-authored-by: Ivan Kokalovic <ivan.kokalovic@example.com>
Co-authored-by: Felix Fontein <felix@fontein.de>
* feat: Icinga 2 downtime module added allowing to schedule and remove downtimes through its REST API.
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* ensure compatibility with ModuleTestCase
feat: errors raised from MH now contain the changed flag
ref: move module exit out of the decorated run method
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* revised module
ref: module refactored using StateModuleHelper now
ref: suggested changes by reviewer added
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* revert change regarding changed flag in MH
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* refactoring and set changed flag explicitly on error
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* Check whether there was a state change on module failure removed.
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* ref: test cases migrated to the new feature that allows passing through exceptions
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* Update plugins/module_utils/icinga2.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/module_utils/icinga2.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/icinga2_downtime.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* ref: make module helper private
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* fix: ensure that all non-null values are added to the request otherwise a `false` value is dropped
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* ref: module description extended with the note that check mode is not supported
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* Update plugins/modules/icinga2_downtime.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* fix: documentation updated
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* ref: documentation updated
ref: doc fragment added
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* Update plugins/doc_fragments/icinga2_api.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* ref: doc fragment renamed to `_icinga2_api.py`
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* ref: maintainer to doc fragment in BOTMETA.yml added
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
* Update plugins/modules/icinga2_downtime.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/icinga2_downtime.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/icinga2_downtime.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
---------
Signed-off-by: Fiehe Christoph <c.fiehe@eurodata.de>
Co-authored-by: Fiehe Christoph <c.fiehe@eurodata.de>
Co-authored-by: Felix Fontein <felix@fontein.de>
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* add support for localizationTexts in keycloak_realm.py
* add changelog fragment
* change version added to next minor release
* Update changelogs/fragments/11513-keycloak-realm-localizationTexts-support.yml
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* Update plugins/modules/keycloak_realm.py
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
---------
Co-authored-by: Alexei Znamensky <103110+russoz@users.noreply.github.com>
* fix(keycloak_user_rolemapping): handle None response for client role lookup
When adding a client role to a user who has no existing roles for that
client, get_client_user_rolemapping_by_id() returns None. The existing
code indexed directly into the result causing a TypeError. Add the same
None check that already existed for realm roles since PR #11256.
Fixes#10960
* fix(tests): use dict format for task vars in keycloak_user_rolemapping tests
Task-level vars requires a YAML mapping, not a sequence. The leading
dash (- roles:) produced a list instead of a dict, which ansible-core
2.20 rejects with "Vars in a Task must be specified as a dictionary".
* Update changelogs/fragments/keycloak-user-rolemapping-client-none-check.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* feat(keycloak_realm_key): add support for auto-generated key providers
Add support for Keycloak's auto-generated key providers where Keycloak
manages the key material automatically:
- rsa-generated: Auto-generates RSA signing keys
- hmac-generated: Auto-generates HMAC signing keys
- aes-generated: Auto-generates AES encryption keys
- ecdsa-generated: Auto-generates ECDSA signing keys
New algorithms:
- HMAC: HS256, HS384, HS512
- ECDSA: ES256, ES384, ES512
- AES: AES (no algorithm parameter needed)
New config options:
- secret_size: For HMAC/AES providers (key size in bytes)
- key_size: For RSA-generated provider (key size in bits)
- elliptic_curve: For ECDSA-generated provider (P-256, P-384, P-521)
Changes:
- Make private_key/certificate optional (only required for rsa/rsa-enc)
- Add provider-algorithm validation with clear error messages
- Fix KeyError when managing default realm keys (issue #11459)
- Maintain backward compatibility: RS256 default works for rsa/rsa-generated
Fixes: #11459
* fix: address sanity test failures
- Add 'default: RS256' to algorithm documentation to match spec
- Add no_log=True to secret_size parameter per sanity check
* feat(keycloak_realm_key): extend support for all Keycloak key providers
Add support for remaining auto-generated key providers:
- rsa-enc-generated (RSA encryption keys with RSA1_5, RSA-OAEP, RSA-OAEP-256)
- ecdh-generated (ECDH key exchange with ECDH_ES, ECDH_ES_A128KW/A192KW/A256KW)
- eddsa-generated (EdDSA signing with Ed25519, Ed448 curves)
Changes:
- Add provider-specific elliptic curve config key mapping
(ecdsaEllipticCurveKey, ecdhEllipticCurveKey, eddsaEllipticCurveKey)
- Add PROVIDERS_WITHOUT_ALGORITHM constant for providers that don't need algorithm
- Add elliptic curve validation per provider type
- Update documentation with all supported algorithms and examples
- Add comprehensive integration tests for all new providers
This completes full coverage of all Keycloak key provider types.
* style: apply ruff formatting
* feat(keycloak_realm_key): add java-keystore provider and update_password
Add support for java-keystore provider to import keys from Java
Keystore (JKS or PKCS12) files on the Keycloak server filesystem.
Add update_password parameter to control password handling for
java-keystore provider:
- always (default): Always send passwords to Keycloak
- on_create: Only send passwords when creating, preserve existing
passwords when updating (enables idempotent playbooks)
The on_create mode sends the masked value ("**********") that Keycloak
recognizes as "preserve existing password", matching the behavior when
re-importing an exported realm.
Replace password_checksum with update_password - the checksum approach
was complex and error-prone. The update_password parameter is simpler
and follows the pattern used by ansible.builtin.user module.
Also adds key_info return value containing kid, certificate fingerprint,
status, and expiration for java-keystore keys.
* address PR review feedback
- Remove no_log=True from secret_size (just an int, not sensitive)
- Add version_added: 12.4.0 to new parameters and return values
- Remove "Added in community.general 12.4.0" from description text
- Consolidate changelog entries into 4 focused entries
- Remove bugfix from changelog (now in separate PR #11470)
* address review feedback from russoz and felixfontein
- remove docstrings from module-local helpers
- remove line-by-line comments and unnecessary null guard
- use specific exceptions instead of bare except Exception
- use module.params["key"] instead of .get("key")
- consolidate changelog into single entry
- avoid "complete set" claim, reference Keycloak 26 instead
* address round 2 review feedback
- Extract remove_sensitive_config_keys() helper (DRY refactor)
- Simplify RS256 validation to single code path
- Add TypeError to inner except in compute_certificate_fingerprint()
- Remove redundant comments (L812, L1031)
- Switch .get() to direct dict access for module.params
* add support for management of keycloak localizations
* unit test for keycloak localization support
* keycloak_realm_localization botmeta record
* rev: improvements after code review
* fix(maven_artifact): resolve SNAPSHOT to latest using snapshot metadata block
Prefer the <snapshot> block (timestamp + buildNumber) from maven-metadata.xml
which always points to the latest build, instead of scanning <snapshotVersions>
and returning on the first match. Repositories like GitHub Packages keep all
historical entries in <snapshotVersions> (oldest first), causing the module to
resolve to the oldest snapshot instead of the latest.
Fixes#5117Fixes#11489
* fix(maven_artifact): address review feedback
- Check both timestamp and buildNumber before using snapshot block,
preventing IndexError when buildNumber is missing
- Remove unreliable snapshotVersions scanning fallback; use literal
-SNAPSHOT version for non-unique snapshot repos instead
- Add tests for incomplete snapshot block and non-SNAPSHOT versions
* fix(maven_artifact): restore snapshotVersions scanning with last-match
Restore <snapshotVersions> scanning as primary resolution (needed for
per-extension accuracy per MNG-5459), but collect the last match instead
of returning on the first. Fall back to <snapshot> block when no
<snapshotVersions> match is found, then to literal -SNAPSHOT version.
* docs: update changelog fragment to match final implementation
* fix(maven_artifact): use updated timestamp for snapshot resolution
Use the <updated> attribute to select the newest snapshotVersion entry
instead of relying on list order. This works independently of how the
repository manager sorts entries in maven-metadata.xml.
Also fix test docstring and update changelog fragment per reviewer
feedback.
* test(maven_artifact): shuffle entries to verify updated timestamp sorting
Reorder snapshotVersion entries so the newest JAR is in the middle,
not at the end. This ensures the test actually validates that resolution
uses the <updated> timestamp rather than relying on list position.
Add claims example for oidc-advanced-group-idp-mapper
For me it wasn't clear how to create claims using oidc-advanced-group-idp-mapper, perhaps other people can benefit from the following example.
* fix(keycloak_realm_key): handle missing config fields for default keys
Keycloak API may not return 'active', 'enabled', or 'algorithm' fields
in the config response for default/auto-generated realm keys. This caused
a KeyError when the module tried to compare these fields during state
detection.
Use .get() with the expected value as default to handle missing fields
gracefully, treating them as unchanged if not present in the API response.
Fixes: #11459
* add PR link to changelog entry per review feedback
At first glance, includepkgs seems to be something that would install
the package name from the given copr repo. This isn't helped by the
example that says "Install caddy" which very much looks like it is
installing the package from the repo. Not only did I, a human,
hallucinate this behaviour, so did a large search engine's AI
responses to related queries.
In fact these are labels to vary what packages DNF sees. Clarify this
by using wording and examples closer to the upstream documentation [1]
[1] https://dnf.readthedocs.io/en/latest/conf_ref.html
* feat(keycloak_client): add valid_post_logout_redirect_uris and backchannel_logout_url
Add two new convenience parameters that map to client attributes:
- valid_post_logout_redirect_uris: sets post.logout.redirect.uris
attribute (list items joined with ##)
- backchannel_logout_url: sets backchannel.logout.url attribute
These fields are not top-level in the Keycloak REST API but are stored
as client attributes. The new parameters provide a user-friendly
interface without requiring users to know the internal attribute names
and ##-separator format.
Fixes#6812, fixes#4892
* consolidate changelog and add PR link per review feedback
* 11453 remove id's as change from diff for protocol mappers
* Update changelogs/fragments/11453-keycloak-client-protocol-mapper-ids.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* fix gem module compatibility with ruby-4-rubygems
rubygem's `query` command has recently been removed, see ruby/rubygems#9083.
address this by using the `list` command instead.
resolves#11397
* add changelog
* Adjust changelog fragment.
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* Adding 'project' parameter support for the Scaleway SG module.
* Adding changelog fragment.
* Fixing documentation, organization is deprecated (although still available).
* Updating docs to show both org and project ID options.
* Incrementing version.
Co-authored-by: Felix Fontein <felix@fontein.de>
* Moving deprecated example to the end.
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* Adding 'project' parameter to Scaleway IP module.
* Adding changelog fragment.
* Incrementing version.
Co-authored-by: Felix Fontein <felix@fontein.de>
* Updating docs to show both org and project ID options.
* Moving deprecated example to the end.
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* nsupdate: support server FQDN
Right now, the server has to be specified as an IPv4/IPv6 address. This
adds support for specifing the server as a FQDN as well.
* nsupdate: support GSS-TSIG/Kerberos
Add support for GSS-TSIG (Kerberos) keys to nsupdate. This makes life
easier when working with Windows DNS servers or Bind in a Kerberos
environment.
Inspiration taken from here:
https://github.com/rthalley/dnspython/pull/530#issuecomment-1363265732Closes: #5730
* nsupdate: introduce query helper function
This simplifies the code by moving the protocol checks, etc, into a
single place.
* nsupdate: try all server IP addresses
Change resolve_server() to generate a list of IPv[46] addresses, then
try all of them in a round-robin fashion in query().
* nsupdate: some more cleanups
As suggested in the PR review.
* nsupdate: apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* move imports from functions to the top of the file
* add changelog frag
* Apply suggestions from code review
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* support diff mode for netcup-dns module
* Fix issue with yaml encoding after testing
* Add changelog fragment
* Fixed: proper and robust yaml import
* Remove need for yaml import
* Show whole zone in diff for context
* Update changelogs/fragments/11376-netcup-dns-diff-mode.yml
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/netcup_dns.py
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update get_manager_attributes method to support systems with multiple managers present
Fixes https://github.com/ansible-collections/community.general/issues/11294
* Add changelog fragment
Pre-define reponse for get_manager_attributes method
* Update changelogs/fragments/11301-idrac-info-multi-manager.yml
Update per suggestion!
Co-authored-by: Felix Fontein <felix@fontein.de>
* Update plugins/modules/idrac_redfish_info.py
Remove extra manager quantity check
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
