Regarding Ansible Testing For Linux, Mac and Windows

[mavsravikiran]

Description

• I am using ansible automation to install softwares like maven, node ,java, Terraform etc in both Windows and WSL(Linux)
• We are planning some automated testing for Windows, WSL and even for MacOS using Github Actions
• We are providing different software installations like java, node, aws, terraform, python, maven etc

Scripting

• Actually i am trying to implement for one of the sample role maven

Requirement

• We are planning to have some testing for role level using molecule for the Windows, WSL, Macos using Github Actions
• Using Molecule how can we have the script at role level. need script for that would be more helpful

Ask / Help

• Does the molecule would be a better choice for doing the functional and integration at role level?
• If that is possible need some script how to do at each role and Need to define Github Actions Workflow to include all the roles for testing the workflow

Please kindly help on this and quick support is much Appreciated 👍

[mavsravikiran]

@ssbarnea / @cidrblock / @audgirka / @alisonlhart ---- Hello, Need Quick Help/ Guidance would be much Appreciated 👍

[isuftin]

@mavsravikiran - Can you explain a bit further? Do you have multiple roles per repository as in a collection or do you have one role in a repository and you're trying to test that?

I can't speak for Windows, but we run Molecule in MacOS as well as Linux to test individual roles, playbooks and also multiple roles within a collection.

[mavsravikiran]

@isuftin--- Hello, Thanks for the Quick Revert 💯

• Yes we have multiple roles in a single repository as in a collection . Please Refer the Below Screenshot

• As i had given an example of the Maven role and the sample code block (Regarding Ansible Testing For Linux, Mac and Windows #4248 (comment)) above . We have the similar structure of the scripting practice across the repository.

• So i am taking a maven role as starting point to test the code locally and github actions using molecule, such that i can go ahead with other roles once the maven role tested successfully.

• I need Help / Guidance on using the molecule how to test the Each Role in my local and Github Actions as well would be much Appreciated 🙂

• Hope this helps and please let me know if anything required from my end 🙂

[mavsravikiran]

@isuftin ---- Quick Help/ Support is much Appreaciated

[mavsravikiran]

@isuftin /@ssbarnea / @cidrblock / @audgirka / @alisonlhart --- Quick Help/Support is much Appreciated 🙂

[isuftin]

What I've done is set things up as an actual collection, included a /playbooks/ directory which includes one playbook per role I'm testing. I then override Molecule's converge playbook just run each playbook which, in turn, runs each role.

Here's what that looks like:

 tree
.
├── CHANGELOG.md
├── README.md
├── galaxy.yml
├── meta
│   ├── requirements.yml
│   └── runtime.yml
├── molecule
│   ├── aws-marketplace-rhel8-ec2
│   │   ├── molecule.yml
│   │   └── prepare.yml
│   ├── aws-marketplace-rhel9-ec2
│   │   ├── molecule.yml
│   │   └── prepare.yml
│   └── common
│       ├── collections_requirements.yml
│       ├── converge.yml
│       ├── ec2
│       │   ├── cloudformation
│       │   │   └── cloudformation.yml
│       │   ├── create.yml
│       │   ├── destroy.yml
│       │   └── host_vars
│       │       └── localhost.yml
│       ├── group_vars
│       │   └── ssl_certificates.yml
│       ├── role_requirements.yml
│       └── tests
│           ├── roles
│           │   ├── docker
│           │   │   └── tasks
│           │   │       └── main.yml
│           │   ├── ssl_certificates
│           │   │   └── tasks
│           │   │       └── main.yml
│           │   └── template_content
│           │       └── tasks
│           │           └── main.yml
│           └── verify.yml
├── playbooks
│   ├── docker
│   │   ├── README.md
│   │   └── site.yml
│   └── ssl_certificates
│       ├── README.md
│       └── site.yml
├── plugins
│   └── README.md
├── requirements.txt
└── roles
    ├── docker
    │   ├── README.md
    │   ├── defaults
    │   │   └── main.yml
    │   ├── meta
    │   │   ├── argument_specs.yml
    │   │   └── main.yml
    │   └── tasks
    │       ├── add_users_to_docker_group.yml
    │       ├── install_docker.yml
    │       ├── install_docker_repository.yml
    │       ├── main.yml
    │       └── prepare_system_for_docker.yml
    └── ssl_certificates
        ├── README.md
        ├── defaults
        │   └── main.yml
        ├── handlers
        │   └── main.yml
        ├── meta
        │   ├── argument_specs.yml
        │   └── main.yml
        └── tasks
            ├── java_import.yml
            ├── main.yml
            └── ssl_certs.yml

molecule/common/converge.yml looks like:

---
- name: Run SSL Certificates Playbook
  import_playbook: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/playbooks/ssl_certificates/site.yml"

- name: Run Docker Playbook
  import_playbook: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/playbooks/docker/site.yml"

playbooks/docker/site.yml looks like:

---
- name: Docker
  hosts: all
  gather_facts: false
  tasks:
    - name: Include Docker Role
      ansible.builtin.include_role:
        name: wma.general.docker

(note that my collection's namespace is wma and name is general). I have it locally inside of a directory path that is /home/myuser/ansible/collections/ansible_collections/wma/general

in /home/myuser I also have .ansible.cfg that includes:

[default]
collections_path=~/.ansible/collections:/usr/share/ansible/collections:/home/myuser/ansible/collections/ansible_collections/

Let me know if you have questions about that

[mavsravikiran]

@isuftin -- Thanks for the Quick Revert 🙂

Ask / Query

• As i have multiple roles like below screenshot
  

• Can i have the below tree structure
  

• I need to test the each individual role locally using molecule test first to verify how the test scenarios are going on 🙂

• Is there any possibility to use github actions to test the existing roles using different distros for Windows , Linux, Mac ?

Hope this helps and need guidance on the point #3 and point #4 would be more helpful for me 🙂

[isuftin]

Unfortauntely I'm not familiar enough with GitHub actions to be of much help here. However, in GitLab, we do parallel testing for multiple scenarios, each scenario testing whatever we include in our converge.yml, which in our case is all roles in a collection.

This is done via GitLab's parallel-matrix pipeline feature which I'm guessing that GitHub also has, if only named something different. The trick for us is we did have to set scenario-specific things like EC2 instance ids in a project-root level .env.yml which gets picked up by Molecule. Then we have a the project file .config/molecule/config.yml which Molecule uses as a base config template.

Ours looks like:

---
# This is common configuration for all concrete molecule scenarios. A molecule
# scenario can override content set here by setting the configuration in the
# individual scenario file.
#
# This is a function of molecule. Content with lists cannot be set here which is
# why I leave the `platforms` configuration in each scenario.

# https://ansible.readthedocs.io/projects/molecule/configuration/#dependency
#
# This configuration sets molecule to download roles and collections at the
# beginning of each run.
dependency:
  name: galaxy
  options:
    # The env vars used here are set in .env in the root dir.
    #
    # ANSIBLE_MOLECULE_ROLE_FILE points to molecule/common/role_requirements.yml
    #
    # ANSIBLE_MOLECULE_COLLECTIONS_FILE points to
    # molecule/common/collections_requirements.yml
    #
    # Both of these files are dependency configurations for molecule testing.
    # Typically this will be the same roles and collections as the role being
    # tested but you can also add other roles and collections in these files if
    # you need them during testing (usually when running the prepare, destroy or
    # cleanup stages)
    role-file: ${ANSIBLE_MOLECULE_ROLE_FILE}
    requirements-file: ${ANSIBLE_MOLECULE_COLLECTIONS_FILE}
    # "Force" is set to true here because during testing you might want to
    # change the version of a dependency you're using. If "Force" is false,
    # molecule will not download the new version and the old version will be
    # used. The tradeoff is that this makes subsequent local runs slower as it
    # will re-download the same versions of all dependencies if they haven't
    # been changed.
    force: true

# https://ansible.readthedocs.io/projects/molecule/configuration/#driver
#
# This configuration specifies which driver will be used to control the remote
# virtual machine. I set this to ec2 because in this example role I have four
# AWS-EC2 scenarios and only two for Vagrant. This simplifies the EC2 based
# scenarios and the Vagrant scenarios oveerride this configuration
driver:
  name: ec2

# https://ansible.readthedocs.io/projects/molecule/configuration/#provisioner
#
# This specifies the provisioner configuration. This content is used by molecule
# to write the inventory file for Ansible which molecule uses to deploy and
# communicate with the remote machine. You will notice that the config_options
# are Ansible configuration options. See
# https://docs.ansible.com/ansible/latest/reference_appendices/config.html
provisioner:
  name: ansible
  log: true
  env:
    # Unfortunately this is needed here for Molecule >=6.0.0
    # https://github.com/ansible/molecule/issues/4109#issuecomment-2130345067
    ANSIBLE_ROLES_PATH: ~/.ansible/roles:${MOLECULE_PROJECT_DIRECTORY}:${MOLECULE_PROJECT_DIRECTORY}/roles:${MOLECULE_EPHEMERAL_DIRECTORY}/roles
  config_options:
    defaults:
      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-load-callback-plugins
      bin_ansible_callbacks: true

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#callbacks-enabled
      # Set in .env.yml
      callbacks_enabled: ${ANSIBLE_CALLBACKS}

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#display-args-to-stdout
      display_args_to_stdout: true

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#cache-plugin
      # Fact caching is by default disabled. The following 3 parameters set up
      # fact caching for subsequent molecule runs on a given scenario
      fact_caching: jsonfile

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#cache-plugin-connection
      # MOLECULE_EPHEMERAL_DIRECTORY is a variable injected by Molecule. This
      # sets the fact_caching directory to a temporary location that is removed
      # when the scenario being run is destroyed
      fact_caching_connection: ${MOLECULE_EPHEMERAL_DIRECTORY}/facts_cache

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#cache-plugin-timeout
      fact_caching_timeout: 7200

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#ansible-pipelining
      # Set pipelining for faster runs
      pipelining: true

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#show-custom-stats
      show_custom_stats: true

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-stdout-callback
      # Set in .env.yml
      stdout_callback: ${ANSIBLE_STDOUT_CALLBACK}

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-timeout
      # Set in .env.yml
      timeout: ${ANSIBLE_CONNECTION_TIMEOUT}

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#use-persistent-connections
      use_persistent_connections: true

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-vault-password-file
      # This is the location for a plaintext file that contains the secret value
      # which Ansible injects into the play for the role ro decrypt contents
      # that are encrypted using Ansible Vault. The file in this project is just
      # used as an example. In real world scenarios, you will encrypt using a
      # development or production password which the Ansible Automation Platform
      # keeps and injects into the run
      vault_password_file: ${MOLECULE_SCENARIO_DIRECTORY}/../common/vault.pw

      # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-verbosity
      # Set in .env.yml
      verbosity: ${ANSIBLE_STDOUT_VERBOSITY}
    # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#diff-always
    # Configuration toggle to tell modules to show differences when in ‘changed’
    # status, equivalent to --diff
    diff:
      always: true

    # https://docs.ansible.com/ansible/latest/reference_appendices/config.html#galaxy-display-progress
    galaxy:
      display_progress: false

    ssh:
      # Set in .env.yml
      ssh_args: ${SSH_ARGS}
      reconnection_retries: ${SSH_RETRIES}
  # https://ansible.readthedocs.io/projects/molecule/configuration/#molecule.provisioner.ansible.Ansible.inventory
  #
  # Here I set the common inventory contents for the molecule run. The path is
  # relative to the scenario file under molecule/ that is being run. Therefore
  # it resolves to molecule/common/group_vars. Scenarios will add their own
  # content here like host_vars
  inventory:
    links:
      group_vars: ../common/group_vars
  # https://ansible.readthedocs.io/projects/molecule/configuration/#molecule.platforms.Platforms
  #
  # Points to common playbooks used by all scenarios. Scenarios will add their
  # own content here like the create and destroy playbook locations which are
  # specific to the type of driver being used. An ec2 driver uses the create and
  # destroy playbooks in the molecule/common/ec2 directory because I wrote
  # updated playbooks to override what the Molecule EC2 driver ships with. The
  # Vagrant scenarios will use the built in create and destroy playbooks that
  # ship with the Vagrant driver.
  playbooks:
    converge: ../common/converge.yml
    verify: ../common/tests/verify.yml

# https://ansible.readthedocs.io/projects/molecule/configuration/#verifier
# Specifies which verifier to use for Molecule testing. We're standardizing on
# the Ansible verifier. We used to use Testinfra but it looks like
# Ansible/Molecule is moving away from that.
#
verifier:
  name: ansible
  # See
  # https://docs.ansible.com/ansible/latest/collections/ansible/builtin/junit_callback.html#parameters
  env:
    # This ensures that all junit output goes to a "junit-output/" directory in
    # the root of this project
    JUNIT_OUTPUT_DIR: '${MOLECULE_PROJECT_DIRECTORY}/junit-output'
    # Configure the output to be one class per yaml file
    JUNIT_TASK_CLASS: 'true'
    JUNIT_TASK_RELATIVE_PATH: 'true'
    JUNIT_REPLACE_OUT_OF_TREE_PATH: ''

A lot of the variable names come in from .env.yml

Finally, we have concrete molecule.yml files such as molecule/aws-marketplace-rhel8-ec2 that look like:

---
platforms:
  - name: '${MOLECULE_SCENARIO_NAME}-${ROLE_NAME}-${MOLECULE_ANSIBLE_VERSION:-localtest}'
    region: ${AWS_REGION}
    vpc_id: ${AWS_VPC_ID}
    vpc_subnet_id: ${AWS_SUBNET}
    instance_type: ${AWS_INSTANCE_TYPE}
    security_groups: ${AWS_SECURITY_GROUPS}
    aws_iam_role: ${AWS_IAM_ROLE}
    tags:
      Name: Ansible Molecule - ${MOLECULE_SCENARIO_NAME}-${ROLE_NAME}-${MOLECULE_ANSIBLE_VERSION:-localtest}
    image: ${AWS_AMI_RHEL_8_MARKETPLACE}
    key_inject_method: ec2
    groups:
      - rhel8
      - ec2
      - linux
      - vault_molecule
      - molecule

provisioner:
  env:
    SSH_USERNAME: ec2-user
  inventory:
    links:
      host_vars: ../common/ec2/host_vars
  playbooks:
    create: ../common/ec2/create.yml
    destroy: ../common/ec2/destroy.yml

So you can see that the scenario-specific molecule.yml file picks up specific variables coming in from .env.yml (really just AWS_AMI_RHEL_8_MARKETPLACE). This allows this scenario to be tested using a specific AWS AMI while another scenario uses another AWS AMI, etc. When we run all of our scenarios in GitLab in a parallel matrix, this allows us to test all of the systems we're targeting at once.

I hope this helps

[mavsravikiran]

@isuftin --- thanks for the quick reponse and it helps 🙂

• I will take a look on how to do a poc using github actions 🙂 as per the guidance suggested by you

Query / Help

• I need to test the each individual role locally using molecule test first to verify how the test scenarios are going on 🙂. As per the below screenshot
  

• I need to verify for all the roles individually whether they are working as expected (or) not 🙂

Hope you got my point and please let me know if anything else required 🙂