AnsibleByExample

Community.Crypto 3.5.0 Released - What's New and How to Test

Beginner
2024-01-013By Luca Berton

Lesson 1 of 15 in Foundations

Ansible Foundations to Production — full curriculum
  1. 1. Introduction to Ansible and Automation
  2. 2. Installing and Configuring Ansible
  3. 3. Running Ad-Hoc Commands
  4. 4. Writing Your First Playbook
  5. 5. Understanding and Using Modules
  6. 6. Variables and Facts
  7. 7. Conditionals and Loops
  8. 8. Handlers and Idempotency
  9. 9. Structuring Projects with Roles
  10. 10. Inventory Management
  11. 11. Using Ansible Vault for Secrets
  12. 12. Debugging and Troubleshooting
  13. 13. Real-World Automation Examples
  14. 14. Final Project: Deploy a Web Server
  15. 15. Bonus - What's Next with Ansible?
View path overview →

Introduction

community.crypto is the Ansible collection that provides modules for managing X.509 certificates, OpenSSL keys and certificates, OpenSSH keys, ACME certificate issuance, and related cryptographic material on managed nodes. Version 3.5.0 has just been published on Galaxy, replacing 3.4.0.

This is a feature release. It adds support for a new post-quantum SSH key type in openssh_keypair, and it changes how several modules mark returned private key material when running on newer versions of ansible-core. It also includes one bugfix related to a deprecated function used internally.

Whats New

mldsa44 SSH key type support

openssh_keypair now supports generating mldsa44 keys via ssh-keygen. This key type is only available when backend=opensshbin, or when backend=auto is used and a compatible ssh-keygen binary is installed on the system (PR #1081).

Private key output marked as sensitive on ansible-core 2.22+

On ansible-core 2.22 and later, several modules and the related filter plugin now mark the private key content they return as sensitive, so it is masked in logs and output rather than printed in plain text (PR #1076). This affects:

  • openssl_pkcs12_info — when return_private_key=true
  • openssl_privatekey — when return_content=true
  • openssl_privatekey_info — when return_private_key_data=true
  • openssl_privatekey_info filter plugin — when return_private_key_data=true
  • openssl_privatekey_pipe — when return_content=true

On ansible-core versions older than 2.22, behavior is unchanged.

Bugfixes

  • openssl_privatekey_pipe — avoids calling a deprecated function when running on ansible-core 2.22+ (PR #1082).

Component Overview

ComponentChangeReference
openssh_keypairAdds mldsa44 key type supportPR #1081
openssl_pkcs12_infoPrivate key marked sensitive on core 2.22+PR #1076
openssl_privatekeyPrivate key content marked sensitive on core 2.22+PR #1076
openssl_privatekey_infoPrivate key data marked sensitive on core 2.22+PR #1076
openssl_privatekey_info filter pluginPrivate key data marked sensitive on core 2.22+PR #1076
openssl_privatekey_pipePrivate key content marked sensitive; deprecated function removedPR #1076, PR #1082

How to Install and Test

# Install or upgrade to the latest version
ansible-galaxy collection install community.crypto --upgrade

# Verify the installed version
ansible-galaxy collection list community.crypto

# Check the documentation for a specific module
ansible-doc community.crypto.openssh_keypair

# Quick smoke test: generate an mldsa44 SSH keypair
# (requires backend=opensshbin or backend=auto with a compatible ssh-keygen)
ansible localhost -m community.crypto.openssh_keypair -a \
  "path=/tmp/id_mldsa44 type=mldsa44 backend=opensshbin"

# Verify private key data is marked sensitive (ansible-core 2.22+)
ansible-playbook -vvv test_privatekey_info.yml

Conclusion

community.crypto 3.5.0 is a straightforward upgrade: it introduces mldsa44 support for OpenSSH keypairs and tightens handling of sensitive private key output on ansible-core 2.22+, with no breaking changes reported for earlier core versions. Users running playbooks that capture private key content via return_content or return_private_key_data should re-check their output handling once they move to ansible-core 2.22 or later, since that data will now be masked by default.

All Tutorials