Why Test Infrastructure Code

A role that installs and configures servers is real software. Like any code, it can have bugs that only surface in production.

An untested role can break hundreds of hosts at once. The blast radius of infrastructure code is far wider than a normal bug.

Spinning up a VM by hand to try a role is slow and forgettable. You need automated, repeatable tests instead.

Molecule is the standard testing framework for Ansible roles. It creates a clean host, runs your role on it, and checks the result.

Molecule is a Python tool. You install it with pip, usually alongside a driver like the Docker plugin for throwaway test hosts.

Molecule spins up a fresh container or VM, applies your role, then destroys it. Every test starts from a clean, known state.

Tests run in seconds on your laptop or in CI. You catch a broken role before it ever touches a real server.

Molecule runs your role twice and fails if the second run reports changes. It proves your role is truly idempotent.

Built-in lint checks run ansible-lint and yamllint, so bad practices and sloppy YAML get flagged automatically.

With tests guarding behavior, you can rewrite a tangled role freely. Green tests mean you did not break the contract.

The same molecule command you run locally also runs in CI, so every pull request is tested the exact same way.

Recall the core job Molecule does for an Ansible role.

Roles are code, so they need tests. Molecule spins up clean hosts, runs your role, checks idempotency and lint, and fits your pipeline. 🧪