Repository: ansible/molecule

Issue:
ansible_args passed to all steps
# Issue Type

- Bug report

# Molecule and Ansible details

```
molecule 3.2.0a0
    ansible:2.9.7 python:3.8
    delegated:3.2.0a0 from molecule
    podman:0.3.0 from molecule_podman
    vagrant:0.5 from molecule_vagrant
```

Molecule installation method (one of):

- pip

Ansible installation method (one of):

- OS package

# Desired Behavior

I have a particular use case where I want to test a full playbook and it's roles. However, the playbook has to be called with specified tags. I would call the playbook in production like this:
```
ansible-playbook site.yml -t install
```
Therefore, I configured my `molecule.yml` like this:
```
---
dependency:
  name: galaxy
driver:
  name: vagrant
platforms:
  - name: opensuse15
    box: generic/opensuse15
  - name: debian10
    box: generic/debian10
provisioner:
  name: ansible
  ansible_args:
   - --tags=install
  playbooks:
    converge: ../../site.yml
verifier:
  name: ansible
```
I would expect molecule to pass these parameters to the converge step only. 

# Actual Behaviour
Molecule passes the tags also to create and destroy, which makes my machines never start/stop.

A good create command looks like this
```
COMMAND: ansible-playbook --diff --inventory /home/t/.cache/molecule/playbook/default/inventory --skip-tags molecule-notest,notest /home/t/.local/lib/python3.8/site-packages/molecule_vagrant/playbooks/create.yml
```
With `ansible_args` it looks like that: 
```
COMMAND: ansible-playbook --diff --inventory /home/t/.cache/molecule/playbook/default/inventory --skip-tags molecule-notest,notest --become --tags=install /home/t/.local/lib/python3.8/site-packages/molecule_default/playbooks/create.yml
```
The create playbook doesn't do anything with just this tag.

I have reprodiced this with both vagrant and podman driver.


Discussion:
My current workaround is to apply tags manually to the converge step, but i would like to avoid this
```
cat molecule.yml
---
dependency:
  name: galaxy
driver:
  name: vagrant
platforms:
  - name: opensuse15
    box: generic/opensuse15
  - name: debian10
    box: generic/debian10
provisioner:
  name: ansible
  playbooks:
    converge: ../../site.yml
verifier:
  name: ansible

molecule create
molecule converge -- -t install
molecule verify
molecule destroy
```

Resolving patch:
diff --git a/lib/molecule/provisioner/ansible_playbook.py b/lib/molecule/provisioner/ansible_playbook.py
--- a/lib/molecule/provisioner/ansible_playbook.py
+++ b/lib/molecule/provisioner/ansible_playbook.py
@@ -67,14 +67,20 @@ def bake(self):
             if options.get("become"):
                 del options["become"]
 
-        ansible_args = list(self._config.provisioner.ansible_args) + list(
-            self._config.ansible_args
-        )
-
-        # if ansible_args:
-        #     if self._config.action not in ["create", "destroy"]:
-        #         # inserts ansible_args at index 1
-        #         self._ansible_command.cmd.extend(ansible_args)
+        # We do not pass user-specified Ansible arguments to the create and
+        # destroy invocations because playbooks involved in those two
+        # operations are not always provided by end users. And in those cases,
+        # custom Ansible arguments can break the creation and destruction
+        # processes.
+        #
+        # If users need to modify the creation of deletion, they can supply
+        # custom playbooks and specify them in the scenario configuration.
+        if self._config.action not in ["create", "destroy"]:
+            ansible_args = list(self._config.provisioner.ansible_args) + list(
+                self._config.ansible_args
+            )
+        else:
+            ansible_args = []
 
         self._ansible_command = util.BakedCommand(
             cmd=[


Test patch:
diff --git a/lib/molecule/test/unit/provisioner/test_ansible_playbook.py b/lib/molecule/test/unit/provisioner/test_ansible_playbook.py
--- a/lib/molecule/test/unit/provisioner/test_ansible_playbook.py
+++ b/lib/molecule/test/unit/provisioner/test_ansible_playbook.py
@@ -118,8 +118,6 @@ def test_bake_does_not_have_ansible_args(_inventory_directory, _instance):
             _inventory_directory,
             "--skip-tags",
             "molecule-notest,notest",
-            "foo",
-            "bar",
             "playbook",
         ]