Remove code that modifies ansible import paths #4380

ssbarnea · 2025-01-27T12:03:47Z

As part of new test-isolation strategy, molecule will no longer take
care itself about modification of:

ANSIBLE_COLLECTIONS_PATH
ANSIBLE_ROLES_PATH
ANSIBLE_LIBRARY
ANSIBLE_FILTER_PLUGINS

Test isolation is supposed to be covered transparently by ansible-compat runtime when code runs inside a virtual environment. Molecule is already using it for running all its external commands.

Related: https://ansible.readthedocs.io/projects/dev-tools/user-guide/test-isolation/

As part of new test-isolation strategy, molecule will no longer take care itself about modification of: - ANSIBLE_COLLECTIONS_PATH - ANSIBLE_ROLES_PATH - ANSIBLE_LIBRARY - ANSIBLE_FILTER_PLUGINS Test isolation is supposed to be covered transparently by ansible-compat runtime when code runs inside a virtual environment. Related: https://ansible.readthedocs.io/projects/dev-tools/user-guide/test-isolation/

jsf9k · 2025-01-28T18:04:45Z

@ssbarnea - This breaks my molecule setup (and probably that of many other folks), and I'm not sure the best way to fix it. See, e.g., the most recent GitHub Actions runs from cisagov/ansible-role-assessment-tool#62 where molecule can no longer find the role that is being tested (ansible-role-assessment-tool). I'd like molecule to find and use the local version of the role that is in the code checked out from GitHub, since that is the version I want to be tested. In this case, am I now expected to set an environment variable before running molecule to add the local project directory to the role path, since molecule no longer does this for me?

In cisagov/skeleton-ansible-role#217 I tried explicitly listing the role to be tested in molecule.default/requirements.yml as a solution, but if I do that and modify the Ansible code for the role in a feature branch then running molecule from said feature branch will not pick up the local changes (since it will pull the default branch from the GitHub repo). This is obviously subpar.

If there are more changes forthcoming that will fix this then I can pin to <25.2.0 for now, but I'm not sure if that is the case.

alix-rm · 2025-01-29T15:38:40Z

Hello, I concurr with the above comment by @jsf9k.

@ssbarnea Could you please explain the correct way to upgrade to version 25.2.0 of molecule for the common layout of ansible-role-myrole/molecule/default?

I understand the rationale of test isolation behind the change but my feeling is that testing a local role's code is the first and most common thing people do with molecule.

I think this change could deter most the maintainers of the most common OSS roles from upgrading to this version of molecule and thus following current best practices. For instance all the geerlinguy. roles use this layout.

First thing most people will be tempted to do is pin molecule to < 25.2.0, which is probably not healthy in the long run.

Happy do discuss this and available to help easing the migration.

Molecule used to modify the roles path for us, but as of v25.2.0 no longer does. (See ansible/molecule#4380 for details.) As a result we must now modify it ourselves.

remod · 2025-01-30T15:45:16Z

We fixed it by explicitly setting ANSIBLE_COLLECTIONS_PATH=/path/to/collection before invoking molecule.

jsf9k · 2025-01-30T15:48:21Z

cisagov/skeleton-ansible-role#221 shows how I am intending to work around this. Very similar to @remod's solution.

pierrehenrymuller · 2025-01-31T15:17:48Z

Molecule and Ansible must behave in exactly the same way when searching for roles. Ansible has its own rules, and Molecule must test that Ansible will work properly in production. Changing this on the Molecule side no longer guarantees that when Ansible is running, everything will work properly.

Everything's broken with this new version, and a step backwards is imperative.

How does Molecule benefit from managing things differently?
What is the need to randomize functional testing?

Adding an environment variable to return to normal operation is not an efficient solution.

git clean -xdf tar zcvf ../python-molecule_25.2.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.2.0-1.spec cp ../python*-molecule*25.2.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.2.0/ rm -rf ../python*-molecule*25.2.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

hswong3i · 2025-02-05T07:49:00Z

Once I revert this PR my CI case working fine again:

alix-rm · 2025-02-06T09:28:20Z

@ssbarnea would you care to comment on these changes?

From a user perspective, your commits through ansible-compat, molecule and even ansible-lint just broke a lot of people's workflows. The documentation is not sufficient for such drastic changes and unexpected for a minor version.

dgibbs64 · 2025-02-06T10:53:14Z

Can confirm testing of all my ansible roles is now broken since update to 25.2.0. Getting the following error. Is there a workaround or update planned to release asap?

ansible_compat.errors.AnsibleCommandError: Got 250 exit code while running: ansible-galaxy collection install -r /home/runner/work/ansible-role-nodejs/ansible-role-nodejs/requirements.yml

matthijs-oosterhoff · 2025-02-06T14:53:25Z

These changes seem to break setups using molecule-plugins[vagrant] (and I suppose more), see ansible-community/molecule-plugins#301.

Setting the ANSIBLE_LIBRARY variable to something like <your_venv>/lib/python<version>/site-packages/molecule_plugins/vagrant/modules resolves the issue. But I don't think it's really user friendly to have to set this variable before running molecule. Am I missing something? What is the advised way to manage these variables, now Molecule no longer takes care of them?

joerg · 2025-02-07T09:49:26Z

For us this release also breaks all our roles and molecule tests... and I am not sure why. We have pretty simple and standard roles and molecule/ansible is set up via venv. I tried reading through all the linked documentation that I found and tested some approaches but none of them seem to make any difference.
I think it has to do with the test isolation linked in the original comment but if the role I am develping and testing is not automatically picked up by molecule then molecule is simply not doing its job. Probably I am just missing some smaller changes required on my side but these should be documented somewhere at least.

chriscroome · 2025-02-10T09:02:34Z

FWIW when running Molecule in GitLab CI you can solve this issue by adding this at the top of the .gitlab-ci.yml file:

variables:
    ANSIBLE_ROLES_PATH: "${CI_PROJECT_DIR}/..:~/.ansible/roles:/usr/share/ansible/roles:/etc/ansible/roles"

This might be worth adding to the docs.

git clean -xdf tar zcvf ../python-molecule_25.3.1.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.3.1-1.spec cp ../python*-molecule*25.3.1*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.3.1/ rm -rf ../python*-molecule*25.3.1*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

git clean -xdf tar zcvf ../python-molecule_25.4.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.4.0-1.spec cp ../python*-molecule*25.4.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.4.0/ rm -rf ../python*-molecule*25.4.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

git clean -xdf tar zcvf ../python-molecule_25.5.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.5.0-1.spec cp ../python*-molecule*25.5.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.5.0/ rm -rf ../python*-molecule*25.5.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

MaKaNu · 2025-06-13T13:23:22Z

provide any documentation on this?

Well, I had also trouble to find the right documentation and let's begin with it: I am still not 100% sure if it is the right documentation and why they did not bring it up somewhere or provide proper Sematic Versioning.

Related: https://ansible.readthedocs.io/projects/dev-tools/user-guide/test-isolation/

There seems to be Documentation, but I would argue that "Related" is not the proper way of informing about breaking changes.

Combined with all recent references in this MR, I would argue that is still the case.

So my conclusion for now:

Getting started with Ansible Development Tools and check if this helps bumping to 25.2.0 and greater
Using following Workaround and check also

Just to finalize: Communication and Semantic Versioning is an issue.

git clean -xdf tar zcvf ../python-molecule_25.6.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.6.0-1.spec cp ../python*-molecule*25.6.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.6.0/ rm -rf ../python*-molecule*25.6.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

Exagone313 · 2025-06-27T15:43:41Z

I'm still not quite sure what is the recommended fix, as I didn't find one in the Molecule documentation, but I successfully run my tests after updating my molecule.yml with:

provisioner:
  name: ansible
  env:
    ANSIBLE_ROLES_PATH: ${HOME}/.ansible/roles

Indeed ansible-galaxy is creating a symbolic link to my role in the ~/.ansible/roles directory.

My take is that Molecule should deal with this stuff by itself, like before, but also I'm pretty sure this path is not portable and not bug-free. I shouldn't have to hardcode paths out of my project directory. With this, if I run Molecule on multiple projects in parallel on my local machine, these runs could have side effects.

MaKaNu · 2025-06-27T15:58:30Z

@Exagone313 I am still not able to verify, but what I can say:

take a look into https://ansible.readthedocs.io/projects/dev-tools/

Yes, the molecule documentation is missing a description at the moment, but since the documentation above also explains molecule stuff, I think we will be able to achieve stuff this way.

What I know so far, this seems to be intended only for collections, so no solo roles anymore.

git clean -xdf tar zcvf ../python-molecule_25.7.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.7.0-1.spec cp ../python*-molecule*25.7.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.7.0/ rm -rf ../python*-molecule*25.7.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

git clean -xdf tar zcvf ../python-molecule_25.9.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.9.0-1.spec cp ../python*-molecule*25.9.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.9.0/ rm -rf ../python*-molecule*25.9.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

…'t work ansible/molecule#4380 introduced a breaking change that makes molecule not infer the path to the libraries in the plugins automatically. As these plugins are in a dynamic dir (the python libraries dir -- changes with python versions) we cannot set this in a sane way and have to work around it by composing it through a command expansion that asks the python for the library path. See: - ansible-community/molecule-plugins#301 - ansible/molecule#4391 - ansible-community/molecule-plugins#301 (comment)

The role resolution changed with molecule 25.2.0, making this change neccessary. See ansible/molecule#4391 and ansible/molecule#4380 for more details.

git clean -xdf tar zcvf ../python-molecule_25.11.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.11.0-1.spec cp ../python*-molecule*25.11.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.11.0/ rm -rf ../python*-molecule*25.11.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

git clean -xdf tar zcvf ../python-molecule_25.11.1.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.11.1-1.spec cp ../python*-molecule*25.11.1*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.11.1/ rm -rf ../python*-molecule*25.11.1*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

git clean -xdf tar zcvf ../python-molecule_25.12.0.orig.tar.gz --exclude=.git . debuild -uc -us cp python-molecule.spec ../python-molecule_25.12.0-1.spec cp ../python*-molecule*25.12.0*.{gz,xz,spec,dsc} /osc/home\:alvistack/ansible-community-molecule-25.12.0/ rm -rf ../python*-molecule*25.12.0*.* See ansible#4380 Signed-off-by: Wong Hoi Sing Edison <[email protected]>

ssbarnea requested a review from a team as a code owner January 27, 2025 12:03

ssbarnea added the major label Jan 27, 2025

ssbarnea requested review from audgirka, cidrblock and ganeshrn January 27, 2025 12:08

ssbarnea force-pushed the major/test-isolation branch 2 times, most recently from 9a7d114 to 19b6a10 Compare January 27, 2025 12:35

ssbarnea force-pushed the major/test-isolation branch from 19b6a10 to 68c96a4 Compare January 27, 2025 12:40

audgirka approved these changes Jan 27, 2025

View reviewed changes

ssbarnea merged commit 30a9749 into main Jan 27, 2025
21 of 23 checks passed

ssbarnea deleted the major/test-isolation branch January 27, 2025 14:15

jsf9k mentioned this pull request Jan 30, 2025

Define ANSIBLE_ROLES_PATH for the ansible provisioner cisagov/skeleton-ansible-role#221

Merged

6 tasks

alix-rm mentioned this pull request Feb 4, 2025

molecule test fails in ansible role directory with molecule version 25 #4391

Open

7 tasks

p-j-smith mentioned this pull request Feb 4, 2025

Remove DAX plugin UCL-MIRSG/ansible-collection-infra#163

Merged

konstruktoid mentioned this pull request Feb 4, 2025

various molecule fixes konstruktoid/ansible-role-hardening#836

Merged

hswong3i mentioned this pull request Feb 5, 2025

"couldn't resolve module/action 'vagrant'" error when installing molecule-plugins in a fresh environment ansible-community/molecule-plugins#301

Open

jhg03a mentioned this pull request Mar 27, 2025

Couldn't resolve module/action 'community.docker.docker_container' gofrolist/molecule-action#326

Open

tigattack mentioned this pull request May 7, 2025

chore(deps): update dependency molecule to v25 - autoclosed tigattack/ansible-role-dawarich#22

Closed

1 task

schurzi mentioned this pull request Jul 25, 2025

chore(deps): update dependency molecule to v25.6.0 - abandoned dev-sec/ansible-collection-hardening#849

Closed

1 task

pjanotti mentioned this pull request Oct 8, 2025

[chore] Update Ansible versions that are being tested against signalfx/splunk-otel-collector#6828

Merged

philnewm mentioned this pull request Dec 19, 2025

Update role include logic philnewm/molecule-podman-systemd#2

Open

Remove code that modifies ansible import paths #4380

Remove code that modifies ansible import paths #4380

Uh oh!

Conversation

ssbarnea commented Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

jsf9k commented Jan 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alix-rm commented Jan 29, 2025

Uh oh!

remod commented Jan 30, 2025

Uh oh!

jsf9k commented Jan 30, 2025

Uh oh!

pierrehenrymuller commented Jan 31, 2025

Uh oh!

hswong3i commented Feb 5, 2025

Uh oh!

alix-rm commented Feb 6, 2025

Uh oh!

dgibbs64 commented Feb 6, 2025

Uh oh!

matthijs-oosterhoff commented Feb 6, 2025

Uh oh!

joerg commented Feb 7, 2025

Uh oh!

chriscroome commented Feb 10, 2025

Uh oh!

MaKaNu commented Jun 13, 2025

Uh oh!

Exagone313 commented Jun 27, 2025

Uh oh!

MaKaNu commented Jun 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

ssbarnea commented Jan 27, 2025 •

edited

Loading

jsf9k commented Jan 28, 2025 •

edited

Loading