Ansible task with tag ‘never’ inside role executed when the role is executed using another tag

ansibleansible-playbook

I have a playbook which has three roles netdata, netdata_master, netdata_slaves:

---
- hosts: netdata_master
  become: yes
  roles: 
    - role: netdata
    - role: netdata_master
  tags: ['netdata_master']

- hosts: netdata_slaves
  become: yes
  roles:
    - role: netdata
    - role: netdata_slave
  tags: ['netdata_slave']

Inside the netdata role I have a task which has tag never and update_netdata in order to be executed only when I pass the tag update_netdata:

- name: Generating Netdata prebuilt script
  template:
    src: kickstart-static64.sh.j2
    dest: /tmp/kickstart-static64.sh
    mode: 0744
- name: update netdata
  shell: /opt/netdata/usr/libexec/netdata/netdata-updater.sh
  tags: ['never', 'update_netdata']

The problem is when I execute the ansible playbook with no tags, everything works fine and update netdata is not executed but when I run the ansible playbook with netdata_slave tag, the update netdata task also gets executed.

I'm using ansible 2.9.2

How can I fix this?

Best Answer

Q: "When I run the ansible playbook with netdata_slave tag, the update netdata task also gets executed."

A: This works as expected. Quoting from Tag Inheritance:

Adding tags: to a play, or to statically imported tasks and roles, adds those tags to all of the contained tasks.

The directive tags: ['netdata_slave'] adds this tag to all of the contained tasks of the role: netdata

  roles:
    - role: netdata
  tags: ['netdata_slave']

This makes the task to look effectively

- name: update netdata
  shell: /opt/netdata/usr/libexec/netdata/netdata-updater.sh
  tags: ['never', 'update_netdata', 'netdata_slave']

Related Solutions

Ansible: Execute task only when a tag is specified

Ansible 2.5 comes with special tags never and always. Tag never can be used exactly for this purpose. E.g:

tasks:
  - debug: msg='{{ showmevar}}'
    tags: [ 'never', 'debug' ]

In this example, the task will only run when the debug (or never) tag is explicitly requested. [Reference on ansible docs]

Ansible: check supplied tags are valid before running a playbook

IMHO there is no such variable to "see which tags are set in a playbook". There are only ansible_run_tags and ansible_skip_tags. I'm afraid the only option would be to write an ansible-playbook wrapper to check if the supplied tags are present in the playbook ("to run in check-mode first, and manually parse the output").

BTW. Below is a simplified list of completed roles

completed_roles: "{{ completed_roles|default('') }} {{ this_role }}"

To avoid "pre-tasks get run, as do post tasks, which makes it appear that something is happening" you might want to use import_roles and when condition instead of tags. Below is an example where role3.yml and role4.yml print a message only.

play.yml

- hosts:
    - localhost
  tasks:
    - import_role: name=role3
      when: selector|default('') in [ 'role3', 'all_roles' ]
    - import_role: name=role4
      when: selector|default('') in [ 'role4', 'all_roles' ]

> ansible-playbook -e selector=role4 play.yml | grep msg
    "msg": "role4"

> ansible-playbook -e selector=all_roles play.yml | grep msg
    "msg": "role3"
    "msg": "role4"

Best Answer

Related Solutions

Ansible: Execute task only when a tag is specified

Ansible: check supplied tags are valid before running a playbook

Related Topic