A role that configures production is code, and code is wrong until proven otherwise. With no state file to diff, the only honest proof a role converged is to run it and check — then run it again and watch nothing change. This chapter builds the testing pyramid for Ansible: yamllint and ansible-lint at the bottom, Molecule against a throwaway target in the middle, CI gating every merge, and ansible-test for published collections at the top.
6 topics
The larkspur_web role decides what nginx, gunicorn, and the app config look like on every production host in the Larkspur fleet. A bad when condition or a non-idempotent command ships a broken config to all six prod web hosts at once, with no plan to review before it lands. That blast radius is why a role earns the same testing rigor as the application it deploys — not a "it ran clean on my laptop" wave-through.
This chapter puts the larkspur_web role under test and wires the larkspur-io/infra pipeline to block any merge that isn't green. You'll order the checks by cost — cheap static linters, then Molecule against a disposable container, then a check-mode run against a staging-shaped host — make the second-run zero-changed rule the non-negotiable floor, and learn how the bar rises again when a role is packaged as a published collection. Six topics, bottom of the pyramid to top.