CertGrid CertGrid
Hands-on Lab·Ansible

Ansible Role Variables and Overrides

There are three ways to call a role and they are not interchangeable. `roles:` runs it before the play's tasks; `import_role` inserts it statically where you put it; `include_role` resolves it at run time. The difference shows up most sharply in tags, where one propagates and the other does not - which is captured here rather than described.

Roles and Collections Guide 25 of 45 Intermediate

Written against the versions above. `import_*` is **static**: parsed when the playbook is loaded, so its tasks appear in `--list-tasks` and inherit tags. `include_*` is **dynamic**: resolved when the task runs, so its contents are invisible until then and tags do not reach inside. Dynamic is what you need for a loop or a `when` on the include itself; static is what you need for tags.

One managed node, running the `webapp` role built in the previous guide.
Server NameIP AddressOSRolesCPURAMHDD
ANS-CTL01192.168.0.36Ubuntu 26.04 LTSAnsible Control Node2 Core3 GB50 GB
ANS-A01192.168.0.37Ubuntu 26.04 LTSManaged Node (group: web)2 Core3 GB50 GB

Before you start

  1. The configuration this guide assumes

  2. Calling a role

  3. Overriding the defaults

  4. What you cannot override

  5. import_role versus include_role

  6. The tag difference

Official sources

← All Ansible guides