Ansible Molecule component

Use this component to run Molecule scenarios and publish their Ansible results as a GitLab test report. The job also retains its console log for troubleshooting.

Usage

The component follows Molecule's collection layout, extensions/molecule, and runs every discovered scenario by default:

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/ansible-molecule@stable

Set path when the collection is not at the repository root. For a traditional project or role layout, override the glob and matching existence rule. To select scenarios, pass an array:

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/ansible-molecule@stable
    inputs:
      name: role
      molecule-glob: molecule/*/molecule.yml
      scenarios:
        - default
        - rocky
      rules:
        - exists:
            - molecule/**/molecule.yml

Scenario names are passed to Molecule. Use paths such as appliance_vlans/merged for nested collection scenarios. An empty array runs every scenario discovered by molecule-glob. Use args for simple additional Molecule flags. Values are split on whitespace; options containing embedded spaces should be placed in the Molecule project configuration instead.

The generated job uses the int GitLab environment by default with the verify action. This makes environment-scoped CI/CD variables available to integration scenarios without starting or stopping the environment. Set the environment input when a project uses another environment name.

Podman scenarios

The default image contains Molecule, Ansible, the containers.podman collection, and Podman. Molecule jobs select VFS storage through CI_CONTAINER_STORAGE_DRIVER=vfs, so they do not require /dev/fuse. The runner must still permit nested containers; select it with tags when the project has a dedicated Podman-capable runner.

Molecule's current Ansible-native model keeps container lifecycle in ordinary inventory and playbooks. Configure the ansible executor, inventory, and lifecycle playbooks directly; do not add the legacy driver, platforms, or provisioner sections. A scenario can define two Enterprise Linux 10 hosts like this:

all:
  children:
    molecule:
      hosts:
        centos-stream-10:
          ansible_connection: containers.podman.podman
          container_image: quay.io/centos/centos:stream10
        rocky-linux-10:
          ansible_connection: containers.podman.podman
          container_image: docker.io/rockylinux/rockylinux:10

Provide repeatable create.yml, converge.yml, verify.yml, and destroy.yml playbooks in the scenario. Molecule runs the configured sequence and fails the job when convergence, its repeatability check, or verification fails.

For nested Podman scenarios on restricted runners, use a private process namespace and process filesystem. Podman requires pid: private when cgroups: disabled; do not share the host process namespace. Use network: host only when a scenario needs the CI job's network.

Ansible Vault

Two protected, masked GitLab CI/CD variable forms are supported:

• ANSIBLE_VAULT_PASSWORD_FILE: a GitLab file-type variable or readable path. This takes precedence and is passed through unchanged.
• ANSIBLE_VAULT_PASSWORD: a masked password value. The component writes it to a mode 0600 temporary file, exports ANSIBLE_VAULT_PASSWORD_FILE for Ansible, and removes the file when the job exits.

Do not commit a vault password file or print either variable in a job script.

JUnit reports

Molecule itself does not emit JUnit XML. The component enables the built-in Ansible junit callback and writes its detailed reports below .molecule/junit/raw by default. It also publishes molecule-summary.xml to GitLab with one test suite per scenario and one test case per non-local inventory host. Failed Ansible tasks mark their host as failed; failures that cannot be attributed to one host mark every platform in the scenario as failed. molecule-output.log and the raw callback reports are retained for troubleshooting.

Set junit-output-dir to another relative directory when the project already reserves .molecule. Keep the path relative so GitLab can upload it as an artifact.

Inputs

Name	Description	Default	Type
---	---	---	---
args	Additional whitespace-separated arguments passed to molecule test.		string
environment	GitLab environment assigned to the Molecule job.	int	string
image	Ansible execution-environment image with Molecule and Podman.	${CI_TOOLS_REPO}/ansible-ee:${CI_TOOLS_COMPONENT_VERSION}	string
junit-output-dir	Relative directory for Ansible JUnit callback reports.	.molecule/junit	string
molecule-glob	Scenario discovery glob relative to path.	extensions/molecule/**/molecule.yml	string
name	Name appended to the Molecule job.	molecule	string
needs	Jobs that must complete before Molecule starts.	[]	array
path	Ansible project or collection root.	.	string
rules	Rules controlling when the Molecule job runs.	[{"if":"$CI_PIPELINE_SOURCE == \"schedule\"","when":"never"},{"exists":["extensions/molecule/**/molecule.yml"],"when":"on_success"},{"when":"never"}]	array
scenarios	Scenario names to run. An empty array runs every discovered scenario.	[]	array
stage	Pipeline stage for the Molecule job.	test	string
tags	Runner tags required by the Molecule job.	[]	array
timeout	Maximum duration of the Molecule job.	2h	string