What's the difference between roles and tasks (and tags) in Ansible?

Question

I'm finding myself getting confused between roles and tasks all the time.

I get that tags are a way to tag individual items, but I'm confused how I'd use them.

Let's say I had to do the following

Users
  Create a user named "deploy"
  Add ssh key for "deploy" user

Git
  Install git
  Clone some git repo

Would "Users" and "Git" be my two main roles in the top level YML file? Would each sub-item (e.g "Install Git") be a task? Would I tag each sub-task with a tag? Or do I tag roles with a tag?

Just looking for an overview of Ansible hierarchy.

Answer 1

tl;dr A task is a single declaration (operation); a role is one of many ways for grouping tasks.

• A task in Ansible is a basic unit of work, a kind of counterpart to a line of code in other languages.

  A task is executed and has a result (ok, changed, failed).

  In most cases a task calls an action module which takes care of idempotence, making a task a declarative unit of programming.

  However there are tasks that perform meta actions, includes, and wrappers for other commands.

• A role in Ansible is one of many abstraction layers for grouping a set of tasks (plus default data, templates, handlers, files) into a more complex definitions.

  Roles hide implementation details (similarly to functions, procedures, methods in other languages) and allow easy reuse of code.

Would "Users" and "Git" be my two main roles in the top level YML file?

There is no single way to organise things in Ansible. You can achieve the same result using different constructs: roles, includes, conditionals, etc.

How you use Ansible depends on your (and your organisation's) objectives: you can create Ansible playbooks so that they read like a full, contained, linear documents describing the configuration; or you can create complex configurations with dependencies, abstraction levels, and modular architecture.