Check a playbook is passing correct arguments when including a role by using the role argument spec?

[Rylon]

Hi,

I'm trying to see if this is already possible, but I didn't find anything in the documentation, but I was hoping there was a way to have Ansible Lint validate a playbook is passing the correct arguments when including a role, by comparing the arguments to that role's argument spec.

For example, imagine you have the following playbook:

---
- name: My playbook
  hosts:  myhost1
  gather_facts: true

  roles:
    - role: test_role
      test_role_argument_one: hello
      test_role_argument_two: goodbye

and the test_role role argument spec looks like this:

---
argument_specs:
  main:
    short_description: A small test role
    author: Me
    options:
      test_role_argument_one:
        description: The one and only test argument
        type:        str
        required:    true

I would expect Ansible Lint to report that the playbook failed to validate, because it is passing a role argument test_role_argument_two that is not defined in the role argument spec.

Similarly if the playbook contained incorrect values, or missing arguments, those cases should also be handled too.

Is such a thing possible? Thanks!

[chriscroome]

Yes it is possible, see the example here, to implement this create a vars/main.yml containing:

testvarnames: "{{ q('varnames', '^test_') | sort }}"
testhostvars: "{{ dict(testvarnames | list | zip(q('vars', *testvarnames))) }}"

Then add this to tasks/main.yml:

- name: Check test_ variables using meta/argument_specs.yml
  ansible.builtin.validate_argument_spec:
    argument_spec: "{{ (lookup('ansible.builtin.file', 'meta/argument_specs.yml') | from_yaml)['argument_specs']['main']['options'] }}"
    provided_arguments: "{{ testhostvars }}"

[Rylon]

Hmm, I'm not quite sure this is what we need, in this case the argument spec already exists and is already tested by Ansible when you attempt to run the playbook, however it would be nice if the same playbook and argument spec could be tested by Ansible Lint so any errors are caught during testing, not during execution of the playbook.

We'd like to do this generically for all the playbooks and roles in our repository. Have I misunderstood your answer?

[chriscroome]

The answer I posted above results in the variables being checked when the role is run, however it is a more strict check than the one automatically run since any variable that is defined with a test_ prefix (in the above example case above, test_ would generally be changed to the role name) that is not in the meta/argument_specs.yml file will result in a fail.

This approach could be run using Molecule if you are using that for testing?

However I think you are asking for the support that was added for the argument spec to be enhanced?

[Rylon]

Yeah, if it does already support it, how do we enable that check? In the test described at the start of this discussion, the argument spec didn't appear to be enforced. Is there a configuration option we need to use to enable this check? Thanks!

[chriscroome]

There will only be a failure if the meta/argument_specs.yml requires a variable that is not defined or is the wrong type / value, if you want to catch variables that are not defined in the meta/argument_specs.yml then you can use the method I suggested above.

[Rylon]

Ah I see, yeah it’s an enhancement request then as we’d expect it to catch the same errors in both cases.

With regards to the method described above I’m struggling to see how we’d do this in a generic way, other than creating a test playbook for every role we have? Do I understand that correctly?

[chriscroome]

I use this approach at a role level, see for example this role the main.yml file includes the task to validate the variables when fail2ban_validate is true and the two variables the task uses are set in the vars.yml file.

[Rylon]

Thanks Chris, in this example is fail2banhostvars just automatically defined containing all vars passed to the role, so for example if my role was called "testrole" this would be automatically available as testrolehostvars?

Second question, I'd expect Ansible to run the argument spec validation twice in this approach, once automatically, and second when this task runs in validate.yml?

[chriscroome]

if my role was called "testrole" this would be automatically available as testrolehostvars?

No, you have to define it, for example add this to vars/main.yml:

testrolevarnames: "{{ q('varnames', '^testrole_') | sort }}"
testrolehostvars: "{{ dict(testrolevarnames | list | zip(q('vars', *testrolevarnames))) }}"

And then use this task to validate all variables starting with testrole_:

- name: Check test_ variables using meta/argument_specs.yml
  ansible.builtin.validate_argument_spec:
    argument_spec: "{{ (lookup('ansible.builtin.file', 'meta/argument_specs.yml') | from_yaml)['argument_specs']['main']['options'] }}"
    provided_arguments: "{{ testrolehostvars }}"

I'd expect Ansible to run the argument spec validation twice in this approach, once automatically, and second when this task runs in validate.yml?

That is correct but it is only the additional check that will catch a testrole_foo variable that is not defined in meta/argument_specs.yml, which I believe is what you are after?

[Rylon]

Ok thanks very much, and sorry for my initial confusion :)