community.postgresql 5.0.0 Released - Major Update to postgresql_membership and Removal of Legacy Options

Introduction

community.postgresql is the Ansible collection that provides modules and plugins to manage PostgreSQL databases, roles, privileges, and configuration from playbooks. It is one of the collections bundled in the ansible community package and is commonly used for automating database provisioning and access control.

Version 5.0.0 is a major release, jumping from 4.2.0. Unlike a routine patch bump, this release contains breaking changes centered almost entirely on the postgresql_membership module, plus the removal of previously deprecated connection options across the collection. Anyone using postgresql_membership in production playbooks should read the porting guide below before upgrading.

Whats New

Minor Changes

• Replaced the deprecated ansible.module_utils.six compatibility shims with their Python standard library equivalents. ansible.module_utils.six is deprecated in ansible-core 2.21 and scheduled for removal in 2.24.
• postgresql_membership - added granted_by_any, both at the top level and per memberships row, to manage every grant of a membership regardless of who made it, matching the behavior of the deprecated groups option. GRANT then names no granting role, and state=absent / state=exact revoke every grant of the membership.
• postgresql_membership - added the grants and effective_options return values, listing every grant of the requested pairs and the options the target role effectively holds.
• postgresql_membership - added the memberships option: one membership per row, each with its own target_roles, granted_by, admin_option, inherit_option, and set_option, applied in a single transaction. It is mutually exclusive with groups; the top-level target_roles acts as the default for rows that name none (see issue #757).
• postgresql_membership - moved PgMembership out of the postgres module_utils into a new membership module_utils, split into PgMembershipByPair (the groups model) and PgMembershipByGrantor (the memberships model). External code importing these classes must follow the move.
• postgresql_membership - with memberships, the module now checks before emitting a GRANT that the connecting role has the privileges of the granting role and that the granting role holds ADMIN OPTION on the group, failing and naming the roles that do hold it. The deprecated groups option records the same privilege check for every granting role found before it revokes. A task with nothing left to do is not checked.

Breaking Changes / Porting Guide

• postgresql_membership - state=exact now reports granted with an entry for every requested group, the same as state=present does, so result.granted == {} no longer holds on an unchanged run.
• postgresql_membership - a memberships row must set granted_by when the connecting role holds ADMIN OPTION on a group only through another role, since PostgreSQL refuses to record a grant under a role that lacks the option. The deprecated groups option is not affected by this rule.
• postgresql_membership - on PostgreSQL 16 and later, a memberships row manages only the grant recorded under its granting role (the bootstrap superuser when the connecting role is a superuser, the connecting role otherwise, or the role named by granted_by). state=present creates that grant even if another role has already granted the membership, while state=absent and state=exact neither revoke nor report grants recorded under another role. This means a previously unchanged task may report changed on its first run and trigger handlers. The deprecated groups option still treats the (group, target role) pair as the membership regardless of who granted it (see issue #757).

Deprecated Features

• postgresql_membership - the top-level groups option is deprecated and will be removed in community.postgresql 6.0.0. granted_by_any combined with the groups key of memberships behaves identically across versions; target_roles remains at the top level, and an empty memberships list with state=exact replaces an empty groups list.

Removed Features (previously deprecated)

• PostgreSQL modules - the previously deprecated login, host, and unix_socket-related legacy connection options (announced for removal in earlier changelogs) have been dropped from this release. Playbooks still referencing these legacy option names should be updated to the current connection parameters before upgrading.

postgresql_membership: groups vs memberships at a glance

Installation and Verification

# Install or upgrade the collection from Ansible Galaxy
ansible-galaxy collection install community.postgresql --upgrade

# Verify the installed version
ansible-galaxy collection list community.postgresql

# Inspect the changelog shipped with the collection
cat ~/.ansible/collections/ansible_collections/community/postgresql/CHANGELOG.rst

Before upgrading in environments that rely on postgresql_membership, test playbooks against a staging PostgreSQL instance (ideally version 16+) to confirm the new grant-tracking behavior does not unexpectedly report changed on tasks previously considered idempotent.