Idempotency is missing when testing with molecule.

[glavoix]

Dear Community,

We are in the process of implementing two roles from your collection: _ sap_generalpreconfigure sap_hana_preconfigure

They are working as expected however we are running integration tests using molecule and the testing fails during the idempotency phase as some role use OS command (like yum or sysctl), and therefore adding condition -> "changed_when: false" should be used for those specific task. Another way is to tag them with molecule-idempotence-notest as explained here: https://ansible.readthedocs.io/projects/molecule/configuration/#ansible

Here are a few tasks where we found that case: https://github.com/sap-linuxlab/community.sap_install/tree/main/roles/sap_hana_preconfigure/tasks/sapnote/2382421.yml#L70 https://github.com/sap-linuxlab/community.sap_install/tree/main/roles/sap_hana_preconfigure/tasks/sapnote/3024346.yml#L27

https://github.com/sap-linuxlab/community.sap_install/tree/main/roles/sap_general_preconfigure/tasks/RedHat/generic/configure-kernel-parameters.yml#L15

https://github.com/sap-linuxlab/community.sap_install/tree/main/roles/sap_general_preconfigure/tasks/RedHat/installation.yml#L118

Would it be possible to add such a tag or condition ?

Thanks, Guillaume

[berndfinger]

@glavoix I had decided to not use changed_when: false because this would give the impression that there is no change. But in case of the commands you mentioned, we just do not know. In these cases, I chose to skip the no-changed-when ansible-lint rule.

We could of course add tags to satisfy requirements for Molecule but before doing that, I am using the opportunity to ask around:

• Are there any examples of using changed_when (I'd rather use true instead of false, BTW) or another condition when using the command or shell module, e.g. for reloading kernel parameters?
• Are there any other tools or test environment which we should take into account and need to consider for adding tags?

[glavoix]

Dear Bernd,

Thanks for your quick answer. Regarding question "Are there any examples of using changed_when": -> For any module which is not "idem potent" like command and many others, we need to force it to "false" Here is a good explanation: https://symfonycasts.com/screencast/ansible/idempotency-changed-when

In my case, I've always used the changed_when:false flag to workaround this issue, however it seems the "proper way" is tagging.

Regarding tags: Ansible ignores tags by default, so you really need to specify --skip-tags or --tags for them to be considered so that should not be a problem. Here is another example where they have this use case and use the molecule-idempotence-notest tag https://medium.com/contino-engineering/testing-ansible-automation-with-molecule-pt-2-7e2ff5a70bcc

I hope that information helps following the best approach.