What are tags in Ansible and how do you run parts of a playbook?
Learn how Ansible tags with --tags and --skip-tags let you run or skip parts of a playbook, including the always and never reserved tags and examples.
Expected Interview Answer
Tags in Ansible are labels you attach to tasks, roles, or plays so you can selectively run or skip parts of a playbook using the `--tags` and `--skip-tags` command-line options.
You add `tags:` to tasks or roles, then run `ansible-playbook site.yml --tags "deploy,config"` to execute only matching tasks, or `--skip-tags` to exclude them. Ansible has special reserved tags: `always` runs unless explicitly skipped, `never` runs only when the tag is requested, and `--tags tagged`/`untagged`/`all` select broad groups. Tags inherit — a tag on a play or role propagates to its tasks — which makes them ideal for targeting large playbooks without splitting them into separate files.
- Run only the relevant subset of a large playbook
- Skip slow or destructive tasks during quick runs
- Speed up iterative development and debugging
- Group cross-cutting tasks like config or deploy
- always and never tags give fine-grained control
AI Mentor Explanation
A coach labels net drills as batting, bowling, or fielding so a session can call just 'bowling today' and run only those stations, skipping the rest. The labels let you pick a subset of the practice plan. Ansible tags work the same — you tag tasks and run --tags bowling-equivalent to execute only that slice of the playbook.
Step-by-Step Explanation
Step 1
Tag your tasks
Add a `tags:` list to tasks, roles, or plays to label logical groups like config or deploy.
Step 2
Run a subset
Execute `ansible-playbook site.yml --tags "deploy,config"` to run only matching tasks.
Step 3
Skip a subset
Use `--skip-tags "slow"` to run everything except the tagged tasks you want to exclude.
Step 4
Use reserved tags
Mark setup as `always` so it runs unless skipped, or `never` so it runs only when requested.
Step 5
List available tags
Run `ansible-playbook site.yml --list-tags` to see every tag defined before executing.
What Interviewer Expects
- Knows how to add tags to tasks, roles, and plays
- Uses --tags and --skip-tags correctly
- Understands the always and never reserved tags
- Aware that tags inherit from plays and roles to tasks
- Can list tags with --list-tags before a run
Common Mistakes
- Expecting a task without the always tag to run when only other tags are selected
- Forgetting that always still runs unless explicitly in --skip-tags
- Assuming tags change task order — they only filter, not reorder
- Not realizing tags on a role apply to all its tasks
- Confusing --skip-tags with --start-at-task
Best Answer (HR Friendly)
“Tags are labels you put on parts of an automation script so you can run just the pieces you need. For example, you could tag the database steps and the web steps separately, then run only the web ones for a quick fix instead of executing the whole thing.”
Code Example
- name: Configure web server
hosts: web
tasks:
- name: Install nginx
ansible.builtin.apt:
name: nginx
state: present
tags:
- install
- name: Deploy site config
ansible.builtin.template:
src: site.conf.j2
dest: /etc/nginx/sites-available/site.conf
tags:
- config
- deploy
- name: Gather facts step
ansible.builtin.setup:
tags:
- always
# Run only config + deploy:
# ansible-playbook site.yml --tags "config,deploy"
# Run everything except install:
# ansible-playbook site.yml --skip-tags "install"Follow-up Questions
- What is the difference between the always and never reserved tags?
- How do tags behave when applied at the role or play level?
- How do you list all tags in a playbook without running it?
- What is the difference between --skip-tags and --start-at-task?
- Can a single task carry multiple tags, and how does selection work then?
MCQ Practice
1. Which option runs only tasks with a specific tag?
`--tags` limits the run to tasks carrying the listed tags; --skip-tags does the inverse.
2. The reserved 'always' tag means a task will:
An always-tagged task runs on every playbook execution unless it is named in --skip-tags.
3. A task tagged only with 'never' runs when:
The never tag keeps a task out of normal runs; it executes only when you explicitly request its tag.
Flash Cards
How do you run only tagged tasks? — Use ansible-playbook --tags "tag1,tag2" to execute only tasks carrying those tags.
What does the always tag do? — Runs the task on every execution unless it is explicitly listed in --skip-tags.
What does the never tag do? — Keeps a task out of normal runs; it runs only when its tag is explicitly requested.
Do tags inherit? — Yes — a tag on a play or role propagates to all the tasks it contains.