Ansible — Testing Playbooks — Molecule & ansible-lint

# Lint the whole project (uses .ansible-lint config)
ansible-lint

# Lint with the strictest preset
ansible-lint --profile production

# Lint a specific role
ansible-lint roles/mysql

# Auto-fix what's auto-fixable
ansible-lint --fix

# List all rules
ansible-lint -L

---
profile: production

skip_list:
  - role-name             # we use snake_case
  - meta-no-info          # internal roles only

exclude_paths:
  - .cache/
  - molecule/
  - .github/

# Treat warnings as errors in CI
strict: true

mock_modules:
  - community.mysql.mysql_query
  - community.proxysql.proxysql_query

# Install
pip install "molecule[docker]" "molecule-plugins[docker]" pytest-testinfra

# In an existing role directory
cd roles/mysql

# Create the default scenario
molecule init scenario default --driver-name docker

# Layout created:
# roles/mysql/molecule/default/
# ├── molecule.yml      ← scenario config
# ├── converge.yml      ← playbook that applies the role
# ├── verify.yml        ← post-run assertions
# └── tests/test_default.py    ← testinfra Python tests

---
dependency:
  name: galaxy
  options:
    requirements-file: requirements.yml

driver:
  name: docker

platforms:
  - name: oel8
    image: oraclelinux:8
    pre_build_image: false
    privileged: true                      # systemd needs privileged
    command: /usr/sbin/init                # boot systemd inside container
    cgroupns_mode: host
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    capabilities:
      - SYS_ADMIN
    tmpfs:
      - /run
      - /tmp

  - name: oel9
    image: oraclelinux:9
    privileged: true
    command: /usr/sbin/init
    cgroupns_mode: host
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw

provisioner:
  name: ansible
  inventory:
    group_vars:
      all:
        # Test-specific values (override role defaults)
        mysql_root_password: TestPassword123!
        mysql_databases:
          - {{ name: testdb }}
        mysql_users:
          - {{ name: testuser, password: TestUserPwd!, priv: "testdb.*:ALL" }}
  config_options:
    defaults:
      stdout_callback: yaml
      callback_result_format: yaml

verifier:
  name: ansible
  # Or: name: testinfra
  # directory: tests/

---
- name: Converge — apply the role under test
  hosts: all
  become: true

  pre_tasks:
    - name: Install Python deps the role needs (in the container)
      ansible.builtin.dnf:
        name:
          - python3-pip
          - python3-PyMySQL
        state: present

  roles:
    - role: mysql

---
- name: Verify — assert the role's effects
  hosts: all
  become: true
  gather_facts: false

  tasks:
    - name: MySQL service is enabled and running
      ansible.builtin.systemd:
        name: mysqld
      register: svc

    - ansible.builtin.assert:
        that:
          - svc.status.ActiveState == "active"
          - svc.status.UnitFileState == "enabled"

    - name: MySQL is reachable on 3306
      ansible.builtin.wait_for:
        port: 3306
        timeout: 10

    - name: testdb database exists
      community.mysql.mysql_query:
        login_user: root
        login_password: TestPassword123!
        query: "SHOW DATABASES LIKE 'testdb'"
      register: db_check

    - ansible.builtin.assert:
        that:
          - db_check.query_result[0] | length == 1

    - name: testuser can connect and SELECT
      community.mysql.mysql_query:
        login_user: testuser
        login_password: TestUserPwd!
        login_db: testdb
        query: "SELECT 1 AS ok"
      register: user_query

    - ansible.builtin.assert:
        that:
          - user_query.query_result[0][0].ok == 1

    - name: my.cnf has the expected innodb_buffer_pool_size
      ansible.builtin.shell: |
        grep '^innodb_buffer_pool_size' /etc/my.cnf
      register: cnf
      changed_when: false

    - ansible.builtin.assert:
        that:
          - "'128M' in cnf.stdout"

# Run the FULL lifecycle (create → converge → idempotence → verify → destroy)
molecule test

# Just create + converge, leave the container running for debugging
molecule converge

# Drop into the test container
molecule login

# Run only verify against an already-converged container
molecule verify

# Tear down
molecule destroy

# Full test, but for a different scenario (e.g. testing the cluster role)
molecule test -s cluster

# Output goes to stdout; failures fail the command
echo $?      # 0 = pass, non-zero = fail

---
# BAD: command always reports changed (even when nothing happened)
- name: Initialise the database
  ansible.builtin.command: |
    mysql_install_db --datadir=/var/lib/mysql

# GOOD: guard with creates
- name: Initialise the database
  ansible.builtin.command: |
    mysql_install_db --datadir=/var/lib/mysql
  args:
    creates: /var/lib/mysql/mysql/user.frm    # if this file exists, skip task

# BAD: shell always re-runs
- name: Add line to config
  ansible.builtin.shell: echo 'log-error=/var/log/mysqld.log' >> /etc/my.cnf

# GOOD: lineinfile is idempotent
- name: Set log path in my.cnf
  ansible.builtin.lineinfile:
    path: /etc/my.cnf
    line: 'log-error=/var/log/mysqld.log'
    insertafter: "[mysqld]"

roles/mysql/molecule/
├── default/                  # baseline single-host install
│   ├── molecule.yml
│   ├── converge.yml
│   └── verify.yml
├── replica/                  # configures as replica
│   ├── molecule.yml
│   ├── converge.yml
│   └── verify.yml
└── cluster/                  # 3-node MGR cluster
    ├── molecule.yml
    ├── converge.yml
    └── verify.yml

---
# .pre-commit-config.yaml — runs on every git commit
repos:
  - repo: https://github.com/ansible-community/ansible-lint
    rev: v24.7.0
    hooks:
      - id: ansible-lint
        args: ["--profile=production"]

  - repo: https://github.com/adrienverge/yamllint
    rev: v1.35.1
    hooks:
      - id: yamllint

pip install pre-commit
pre-commit install

# Now every git commit auto-runs lint + yamllint.
# Failures block the commit until fixed.