Ansible roles that survive production
Idempotency, naming, testing with Molecule — the habits that keep automation trustworthy after year one.
Ansible is easy to start and easy to outgrow. Here's how we structure roles that still make sense 18 months later.
Idempotency is the contract
Every task must be safe to re-run. Handlers over inline restarts, creates/removes guards, and explicit changed_when when the shell lies.
Test every role
Molecule with Docker drivers catches the "works on my controller" class of bugs before merge.
Document the why
Comments should explain decisions, not narrate the YAML.