ansible.builtin.yum - Manages packages with the yum package manager

ansible.builtin.yum - Manages packages with the yum package manager

This module is part of ansible-base and included in all Ansible installations. In most cases, you can use the short module name yum even without specifying the collections: keyword. Despite that, we recommend you use the FQCN for easy linking to the module documentation and to avoid conflicting with other collections that may have the same module name.

Synopsis
Requirements
Parameters
Notes
Examples

Synopsis

Installs, upgrade, downgrades, removes, and lists packages and groups with the yum package manager.
This module only works on Python 2. If you require Python 3 support see the ansible.builtin.dnf module.

This module has a corresponding action plugin.

Requirements

The below requirements are needed on the host that executes this module.

yum

Parameters

Parameter Choices/Defaults Comments

allow_downgrade
boolean

no ←
yes

Specify if the named package and version is allowed to downgrade a maybe already installed higher version of that package. Note that setting allow_downgrade=True can make this module behave in a non-idempotent way. The task could end up with a set of packages that does not match the complete list of specified packages to install (because dependencies between the downgraded package and others can cause changes to the packages which were in the earlier transaction).

autoremove
boolean

no ←
yes

If yes, removes all "leaf" packages from the system that were originally installed as dependencies of user-installed packages but which are no longer required by any such package. Should be used alone or when state is absent
NOTE: This feature requires yum >= 3.4.3 (RHEL/CentOS 7+)

bugfix
string
Default:

"no"

If set to yes, and state=latest then only installs updates that have been marked bugfix related.

conf_file
string

The remote yum configuration file to use for the transaction.

disable_excludes
string

Disable the excludes defined in YUM config files.
If set to all, disables all excludes.
If set to main, disable excludes defined in [main] in yum.conf.
If set to repoid, disable excludes defined for given repo id.

disable_gpg_check
boolean

no ←
yes

Whether to disable the GPG checking of signatures of packages being installed. Has an effect only if state is present or latest.

disable_plugin
string

Plugin name to disable for the install/update operation. The disabled plugins will not persist beyond the transaction.

disablerepo
string

Repoid of repositories to disable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them with a ",".
As of Ansible 2.7, this can alternatively be a list instead of "," separated string

download_dir
string

Specifies an alternate directory to store packages.
Has an effect only if download_only is specified.

download_only
boolean

no ←
yes

Only download the packages, do not install them.

enable_plugin
string

Plugin name to enable for the install/update operation. The enabled plugin will not persist beyond the transaction.

enablerepo
string

Repoid of repositories to enable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them with a ",".
As of Ansible 2.7, this can alternatively be a list instead of "," separated string

exclude
string

Package name(s) to exclude when state=present, or latest

install_repoquery
boolean

no
yes ←

If repoquery is not available, install yum-utils. If the system is registered to RHN or an RHN Satellite, repoquery allows for querying all channels assigned to the system. It is also required to use the 'list' parameter.
NOTE: This will run and be logged as a separate yum transation which takes place before any other installation or removal.
NOTE: This will use the system's default enabled repositories without regard for disablerepo/enablerepo given to the module.

install_weak_deps
boolean

no
yes ←

Will also install all packages linked by a weak dependency relation.
NOTE: This feature requires yum >= 4 (RHEL/CentOS 8+)

installroot
string
Default:

"/"

Specifies an alternative installroot, relative to which all packages will be installed.

list
string

Package name to run the equivalent of yum list --show-duplicates <package> against. In addition to listing packages, use can also list the following: installed, updates, available and repos.
This parameter is mutually exclusive with name.

lock_timeout
integer
Default:

30

Amount of time to wait for the yum lockfile to be freed.

name
list / elements=string

A package name or package specifier with version, like name-1.0.
If a previous version is specified, the task also needs to turn allow_downgrade on. See the allow_downgrade documentation for caveats with downgrading packages.
When using state=latest, this can be '*' which means run yum -y update.
You can also pass a url or a local path to a rpm file (using state=present). To operate on several packages this can accept a comma separated string of packages or (as of 2.0) a list of packages.

aliases: pkg

releasever
string

Specifies an alternative release from which all packages will be installed.

security
boolean

no ←
yes

If set to yes, and state=latest then only installs updates that have been marked security related.

skip_broken
boolean

no ←
yes

Skip packages with broken dependencies(devsolve) and are causing problems.

state
string

absent
installed
latest
present
removed

Whether to install (present or installed, latest), or remove (absent or removed) a package.
present and installed will simply ensure that a desired package is installed.
latest will update the specified package if it's not of the latest available version.
absent and removed will remove the specified package.
Default is None, however in effect the default action is present unless the autoremove option is enabled for this module, then absent is inferred.

update_cache
boolean

no ←
yes

Force yum to check if cache is out of date and redownload if needed. Has an effect only if state is present or latest.

aliases: expire-cache

update_only
boolean

no ←
yes

When using latest, only update installed packages. Do not install packages.
Has an effect only if state is latest

use_backend
string

auto ←
yum
yum4
dnf

This module supports yum (as it always has), this is known as yum3/YUM3/yum-deprecated by upstream yum developers. As of Ansible 2.7+, this module also supports YUM4, which is the "new yum" and it has an dnf backend.
By default, this module will select the backend based on the ansible_pkg_mgr fact.

validate_certs
boolean

no
yes ←

This only applies if using a //docs.ansible.com/ansible/latest/collections/black.css url as the source of the rpm. e.g. for localinstall. If set to no, the SSL certificates will not be validated.
This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
Prior to 2.1 the code worked as if this was set to yes.

Notes

When used with a loop: each package will be processed individually, it is much more efficient to pass the list directly to the name option.
In versions prior to 1.9.2 this module installed and removed each package given to the yum module separately. This caused problems when packages specified by filename or url had to be installed or removed together. In 1.9.2 this was fixed so that packages are installed in one yum transaction. However, if one of the packages adds a new yum repository that the other packages come from (such as epel-release) then that package needs to be installed in a separate task. This mimics yum's command line behaviour.
Yum itself has two types of groups. 'Package groups' are specified in the rpm itself while 'environment groups' are specified in a separate file (usually by the distribution). Unfortunately, this division becomes apparent to ansible users because ansible needs to operate on the group of packages in a single transaction and yum requires groups to be specified in different ways when used in that way. Package groups are specified as '@development-tools' and environment groups are '@^gnome-desktop-environment'. Use the 'yum group list hidden ids' command to see which category of group the group you want to install falls into.
The yum module does not support clearing yum cache in an idempotent way, so it was decided not to implement it, the only method is to use command and call the yum command directly, namely 'command: yum clean all' //github.com/ansible/ansible/pull/31450#issuecomment-352889579

Examples

- name: Install the latest version of Apache yum: name: httpd state: latest - name: Install a list of packages (suitable replacement for 2.11 loop deprecation warning) yum: name: - nginx - postgresql - postgresql-server state: present - name: Install a list of packages with a list variable yum: name: "{{ packages }}" vars: packages: - httpd - httpd-tools - name: Remove the Apache package yum: name: httpd state: absent - name: Install the latest version of Apache from the testing repo yum: name: httpd enablerepo: testing state: present - name: Install one specific version of Apache yum: name: httpd-2.2.29-1.4.amzn1 state: present - name: Upgrade all packages yum: name: '*' state: latest - name: Upgrade all packages, excluding kernel & foo related packages yum: name: '*' state: latest exclude: kernel*,foo* - name: Install the nginx rpm from a remote repo yum: name: http://nginx.org/packages/centos/6/noarch/RPMS/nginx-release-centos-6-0.el6.ngx.noarch.rpm state: present - name: Install nginx rpm from a local file yum: name: /usr/local/src/nginx-release-centos-6-0.el6.ngx.noarch.rpm state: present - name: Install the 'Development tools' package group yum: name: "@Development tools" state: present - name: Install the 'Gnome desktop' environment group yum: name: "@^gnome-desktop-environment" state: present - name: List ansible packages and register result to print with debug later yum: list: ansible register: result - name: Install package with multiple repos enabled yum: name: sos enablerepo: "epel,ol7_latest" - name: Install package with multiple repos disabled yum: name: sos disablerepo: "epel,ol7_latest" - name: Download the nginx package but do not install it yum: name: - nginx state: latest download_only: true

Authors

Ansible Core Team
Seth Vidal (@skvidal)
Eduard Snesarev (@verm666)
Berend De Schouwer (@berenddeschouwer)
Abhijeet Kasurde (@Akasurde)
Adam Miller (@maxamillion)

Parameter	Choices/Defaults	Comments
allow_downgrade boolean	no ← yes	Specify if the named package and version is allowed to downgrade a maybe already installed higher version of that package. Note that setting allow_downgrade=True can make this module behave in a non-idempotent way. The task could end up with a set of packages that does not match the complete list of specified packages to install (because dependencies between the downgraded package and others can cause changes to the packages which were in the earlier transaction).
autoremove boolean	no ← yes	If yes, removes all "leaf" packages from the system that were originally installed as dependencies of user-installed packages but which are no longer required by any such package. Should be used alone or when state is absent NOTE: This feature requires yum >= 3.4.3 (RHEL/CentOS 7+)
bugfix string	Default: "no"	If set to yes, and state=latest then only installs updates that have been marked bugfix related.
conf_file string		The remote yum configuration file to use for the transaction.
disable_excludes string		Disable the excludes defined in YUM config files. If set to all, disables all excludes. If set to main, disable excludes defined in [main] in yum.conf. If set to repoid, disable excludes defined for given repo id.
disable_gpg_check boolean	no ← yes	Whether to disable the GPG checking of signatures of packages being installed. Has an effect only if state is present or latest.
disable_plugin string		Plugin name to disable for the install/update operation. The disabled plugins will not persist beyond the transaction.
disablerepo string		Repoid of repositories to disable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them with a ",". As of Ansible 2.7, this can alternatively be a list instead of "," separated string
download_dir string		Specifies an alternate directory to store packages. Has an effect only if download_only is specified.
download_only boolean	no ← yes	Only download the packages, do not install them.
enable_plugin string		Plugin name to enable for the install/update operation. The enabled plugin will not persist beyond the transaction.
enablerepo string		Repoid of repositories to enable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them with a ",". As of Ansible 2.7, this can alternatively be a list instead of "," separated string
exclude string		Package name(s) to exclude when state=present, or latest
install_repoquery boolean	no yes ←	If repoquery is not available, install yum-utils. If the system is registered to RHN or an RHN Satellite, repoquery allows for querying all channels assigned to the system. It is also required to use the 'list' parameter. NOTE: This will run and be logged as a separate yum transation which takes place before any other installation or removal. NOTE: This will use the system's default enabled repositories without regard for disablerepo/enablerepo given to the module.
install_weak_deps boolean	no yes ←	Will also install all packages linked by a weak dependency relation. NOTE: This feature requires yum >= 4 (RHEL/CentOS 8+)
installroot string	Default: "/"	Specifies an alternative installroot, relative to which all packages will be installed.
list string		Package name to run the equivalent of yum list --show-duplicates <package> against. In addition to listing packages, use can also list the following: installed, updates, available and repos. This parameter is mutually exclusive with name.
lock_timeout integer	Default: 30	Amount of time to wait for the yum lockfile to be freed.
name list / elements=string		A package name or package specifier with version, like name-1.0. If a previous version is specified, the task also needs to turn allow_downgrade on. See the allow_downgrade documentation for caveats with downgrading packages. When using state=latest, this can be '*' which means run yum -y update. You can also pass a url or a local path to a rpm file (using state=present). To operate on several packages this can accept a comma separated string of packages or (as of 2.0) a list of packages. aliases: pkg
releasever string		Specifies an alternative release from which all packages will be installed.
security boolean	no ← yes	If set to yes, and state=latest then only installs updates that have been marked security related.
skip_broken boolean	no ← yes	Skip packages with broken dependencies(devsolve) and are causing problems.
state string	absent installed latest present removed	Whether to install (present or installed, latest), or remove (absent or removed) a package. present and installed will simply ensure that a desired package is installed. latest will update the specified package if it's not of the latest available version. absent and removed will remove the specified package. Default is None, however in effect the default action is present unless the autoremove option is enabled for this module, then absent is inferred.
update_cache boolean	no ← yes	Force yum to check if cache is out of date and redownload if needed. Has an effect only if state is present or latest. aliases: expire-cache
update_only boolean	no ← yes	When using latest, only update installed packages. Do not install packages. Has an effect only if state is latest
use_backend string	auto ← yum yum4 dnf	This module supports yum (as it always has), this is known as yum3/YUM3/yum-deprecated by upstream yum developers. As of Ansible 2.7+, this module also supports YUM4, which is the "new yum" and it has an dnf backend. By default, this module will select the backend based on the ansible_pkg_mgr fact.
validate_certs boolean	no yes ←	This only applies if using a //docs.ansible.com/ansible/latest/collections/black.css url as the source of the rpm. e.g. for localinstall. If set to no, the SSL certificates will not be validated. This should only set to no used on personally controlled sites using self-signed certificates as it avoids verifying the source site. Prior to 2.1 the code worked as if this was set to yes.