Support Ansible 12 (ansible-core 2.19)

[stefanor]

Debian is looking at Ansible 12 support early, as we're entering the early stages of freeze now for Debian 13 (Trixie) and expect Ansible 12 to release well before we freeze solid.

[carnil]

FWIW, the report in Ansible is at: ansible/ansible#85017

[upekkha]

Ansible 12 is deprecating custom strategy plugins like mitogen: ansible/ansible/issues/84725

Use of strategy plugins not included in ansible.builtin are deprecated and do not carry any backwards compatibility guarantees. No alternative for third party strategy plugins is currently planned. This feature will be removed in a future release.

[moreati]

Notes to self

• Debian 13 (Trixie)
  • 15 Apr 2025 soft freeze, 15 May hard freeze
  • Ships Python 3.13
• Ansible 12 (core 2.19)
  • 16 Apr 2025 core feature freeze, 26 May 30 June core RC1, 21 July 2.19.0
  • Controller: Python 3.11 - 3.13 (unchanged from Ansible 11 (core 2.18))
  • Targets: Python 3.8 - 3.13 (also unchanged)

Refs

1. https://wiki.debian.org/DebianTrixie
2. https://distrowatch.com/table.php?distribution=debian
3. https://docs.ansible.com/ansible/devel/roadmap/COLLECTIONS_12.html
4. https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
5. https://forum.ansible.com/t/core-2-19-beta-extended-thru-june-30/43035

[moreati]

ansible.parsing.utils.jsonify was removed in ansible/ansible#84621 (Templating overhaul, Data Tagging), some fallout reported/discussed in ansible/ansible#85017, restored with deprecation warning in ansible/ansible#85032.

[moreati]

Prior to removal/restorationansible.parsing.utils.jsonify.jsonify() changed very little. Differences to json.dumps()

1. jsonify(None) -> u'{}' vs dumps(None) -> u'null'
2. jsonify(..., format: bool) vs dumps(..., indent: int|None, ...)
3. jsonify() always applies sort_keys=True.
4. jsonify() prefers ensure_ascii=False, falling back to ensure_ascii=True on UnicodeDecodeError. I'm unsure what would trigger that exception only in the former case.

Refs

1. https://github.com/ansible/ansible/blame/a0495fc31497798a7a833ba7406a9729e1528dd8/lib/ansible/parsing/utils/jsonify.py
2. https://docs.python.org/3/library/json.html#basic-usage

[moreati]

Porting guide items that caught my eye

Changes to templating in this release detects non-boolean conditionals during expression evaluation and reports an error by default. The error can be temporarily reduced to a warning with the ALLOW_BROKEN_CONDITIONALS config setting.

Playbook conditionals (e.g. when: ...) must evaluate to a boolean type. Relying on implicit Truthy semantics a lá Jinja or Python is now considered an error.

Embedding templates within other templates or expressions could previously result in untrusted templates being executed. The overhauled templating engine in this release no longer supports this insecure behavior.

This means {{ ... }} inside an assert:, or when: is an error, e.g.

- assert:
    that: 1 + {{ value }} == 2

Changelog doesn't mention https://docs.ansible.com/ansible/devel/reference_appendices/config.html#allow-embedded-templates

By default, untrusted templates are silently ignored. Troubleshooting trust issues with templates can be aided by enabling warnings or errors for untrusted templates. The environment variable _ANSIBLE_TEMPLAR_UNTRUSTED_TEMPLATE_BEHAVIOR can be used to control this behavior.

No mention of _ANSIBLE_TEMPLAR_UNTRUSTED_TEMPLATE_BEHAVIOR in config reference.

Timeout waiting on privilege escalation (become) is now an unreachable error instead of a task error. Existing playbooks should be changed to replace ignore_errors with ignore_unreachable on tasks where timeout on become should be ignored.

May have bearing on https://github.com/mitogen-hq/mitogen/blob/master/docs/ansible_detailed.rst?plain=1#L226-L244

Previously, ansible-core implicitly trusted all string values to be rendered as Jinja templates, but applied an “unsafe” wrapper object [...] This required any code that operated on strings to correctly propagate the wrapper object, which resulted in numerous CVE-worthy RCE (remote code execution) vulnerabilities.
This release inverts the previous trust model. Only strings marked as loaded from a trusted source are eligible to be rendered as templates. Untrusted values can (as before) be referenced by templates, but the template expression itself must always be trusted. While this change still requires consideration for propagation of trust markers when manipulating strings, failure to do so now results in a loss of templating ability instead of a potentially high-severity security issue.

Jinja’s native templating mode is now used exclusively. The configuration option for setting the templating mode is deprecated and no longer has any effect.

Handling of errors, warnings and deprecations throughout much of the ansible-core codebase has now been standardized. Tracebacks can be optionally collected and displayed for all exceptions, as well as at the call site of errors, warnings, or deprecations (even in module code) using the ANSIBLE_DISPLAY_TRACEBACK environment variable.

The ssh connection plugin now supports using SSH_ASKPASS to supply passwords for authentication as an alternative to the sshpass program. The default is to use SSH_ASKPASS instead of sshpass. This is controlled by the password_mechanism configuration for the ssh connection plugin

Coercing unrecognized input values in the bool filter is deprecated

Most values (other than True, False, 1, 0, '1', '0', 'yes', 'no') now emit a deprecation warning, e.g. "" | bool, None | bool

• internals - The AnsibleLoader and AnsibleDumper classes for working with YAML are now factory functions and cannot be extended.
• internals - The ansible.utils.native_jinja Python module has been removed.
• Task Execution / Forks - Forks no longer inherit stdio from the parent ansible-playbook process. stdout, stderr, and stdin within a worker are detached from the terminal, and non-functional. All needs to access stdio from a fork for controller side plugins requires use of Display. -- Don't inherit stdio ansible/ansible#82770
• modules - Modules returning non-UTF8 strings now result in an error. The MODULE_STRICT_UTF8_RESPONSE setting can be used to disable this check.
• removed deprecated pycompat24 and compat.importlib.
• yaml callback plugin - deprecate plugin in favor of result_format=yaml in plugin ansible.bulitin.default

Refs

1. https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_12.html

[stefanor]

We have also been receiving reports of a regression in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103652#34 that I haven't been able to reproduce.

[rfc1036]

I confirm that upekkha@98827c5 fixes the Debian bug that I reported.

[zerwes]

for the record: debian trixie will come with ansible==12.0.0~a2 ansible-core==2.19.0~beta2
ref: https://packages.debian.org/trixie/ansible

[moreati]

https://forum.ansible.com/t/making-a-collection-compatible-with-core-2-19-and-templating-changes/41717