CertGrid CertGrid
Hands-on Lab·Ansible

Ansible Role Variables and Overrides

There are three ways to call a role and they are not interchangeable. roles: runs it before the play's tasks; import_role inserts it statically where you put it; include_role resolves it at run time. The difference shows up most sharply in tags, where one propagates and the other does not - which is captured here rather than described.

Roles and Collections Guide 25 of 45 Intermediate

import_* is static: parsed when the playbook is loaded, so its tasks appear in --list-tasks and inherit tags. include_* is dynamic: resolved when the task runs, so its contents are invisible until then and tags do not reach inside. Dynamic is what you need for a loop or a when on the include itself; static is what you need for tags.

One managed node, running the `webapp` role built in the previous guide.
Server NameIP AddressOSRolesCPURAMHDD
ANS-CTL01192.168.0.36Ubuntu 26.04 LTSAnsible Control Node2 Core3 GB50 GB
ANS-A01192.168.0.37Ubuntu 26.04 LTSManaged Node (group: web)2 Core3 GB50 GB

This guide includes

Use this when a role has to behave differently in two places. This matters because there are three ways to call a role and they are not interchangeable - and a value in vars/main.yml cannot be overridden the way a default can.

Before you start

  1. The configuration this guide assumes

  2. Calling a role

  3. Overriding the defaults

  4. What you cannot override

  5. import_role versus include_role

  6. The tag difference

Official sources

← All Ansible guides