Repository: ansible/molecule

Issue:
Check on docker registry password too restrictive
# Issue Type

- Bug report

# Molecule and Ansible details

```
molecule, version 2.19.0
ansible 2.6.3
  config file = /home/rtp/.ansible.cfg
  configured module search path = [u'/home/rtp/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, Sep 26 2018, 18:42:22) [GCC 6.3.0 20170516]
```

Molecule installation method (one of):

- pip

Ansible installation method (one of):

- OS package

Detail any linters or test runners used:

I'm using vagrant on my system and docker for my local gitlab ci. For the gitlab-ci side, I'm using a container hosted by this gitlab server. To do this, I'm using two scenarii with only differences are the driver and platform used.

My molecule platforms setting for the ci job is:
```
platforms:
- name: instance
  image: ${CI_REGISTRY}/stretch/systemd:latest
  registry:
    url: https://${CI_REGISTRY}
    credentials:
      username: gitlab-ci-token
      password: $CI_JOB_TOKEN
```

# Desired Behavior

It would be easier if the regexp used to validate the password allows:
- environment variables with underscores
- syntax like ${CI_JOB_TOKEN:-invalidpassword}

# Actual Behaviour

- When running the scenario with the vagrant driver, I'm getting:
```
ERROR: Failed to validate.

{'platforms': [{0: [{'registry': [{'credentials': [{'password': ['null value not allowed']}]}]}]}]}
```

- If I create an environment variable, It now complains about the underscores :
```
ERROR: Failed to validate.

{'platforms': [{0: [{'registry': [{'credentials': [{'password': ["value does not match regex '^[{$]+[a-z0-9A-Z]+[}]*$'"]}]}]}]}]}
```
This one happens also when running the scenario on gitlab ci.



Discussion:
Right, this is a bug. Should be fixed.

Resolving patch:
diff --git a/molecule/driver/docker.py b/molecule/driver/docker.py
--- a/molecule/driver/docker.py
+++ b/molecule/driver/docker.py
@@ -124,14 +124,14 @@ class Docker(base.Base):
 
         $ pip install molecule[docker]
 
-    When pulling from a private registry, the username and password must be
-    exported as environment variables in the current shell. The only supported
-    variables are $USERNAME and $PASSWORD.
+    When pulling from a private registry, it is the user's discretion to decide
+    whether to use hard-code strings or environment variables for passing
+    credentials to molecule.
 
-    .. code-block:: bash
+    .. important::
 
-        $ export USERNAME=foo
-        $ export PASSWORD=bar
+        Hard-coded credentials in ``molecule.yml`` should be avoided, instead use
+        `variable substitution`_.
 
     Provide a list of files Molecule will preserve, relative to the scenario
     ephemeral directory, after any ``destroy`` subcommand execution.
diff --git a/molecule/model/schema_v2.py b/molecule/model/schema_v2.py
--- a/molecule/model/schema_v2.py
+++ b/molecule/model/schema_v2.py
@@ -104,8 +104,7 @@ def pre_validate_base_schema(env, keep_string):
                                 'type': 'dict',
                                 'schema': {
                                     'password': {
-                                        'type': 'string',
-                                        'regex': '^[{$]+[a-z0-9A-Z]+[}]*$',
+                                        'type': 'string'
                                     },
                                 }
                             },


Test patch:
diff --git a/test/unit/model/v2/test_pre_validate.py b/test/unit/model/v2/test_pre_validate.py
--- a/test/unit/model/v2/test_pre_validate.py
+++ b/test/unit/model/v2/test_pre_validate.py
@@ -58,7 +58,7 @@ def _model_platforms_docker_errors_section_data():
   - name: instance
     registry:
       credentials:
-        password: foo
+        password: 123
 """.strip()
 
 
@@ -70,10 +70,7 @@ def test_platforms_docker_has_errors(_stream, _env, _keep_string):
             0: [{
                 'registry': [{
                     'credentials': [{
-                        'password': [
-                            ('value does not match regex '
-                             "'^[{$]+[a-z0-9A-Z]+[}]*$'"),
-                        ]
+                        'password': ['must be of string type']
                     }]
                 }]
             }]