# Understanding how roles, dependencies, and tags work together.

**URL:** <https://forum.ansible.com/t/understanding-how-roles-dependencies-and-tags-work-together/20149>\
**Category:** Ansible Developer\
**Created:** [January 8, 2016, 6:10am UTC](https://forum.ansible.com/t/understanding-how-roles-dependencies-and-tags-work-together/20149 "2016-01-08T06:10:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\
**Post date:** [January 8, 2016, 6:10am UTC](https://forum.ansible.com/t/understanding-how-roles-dependencies-and-tags-work-together/20149/1 "2016-01-08T06:10:26Z")

</div>

I’m trying to understand how roles, dependencies, and tags work together.

I’m seeing “wrong” behavior when I use meta/main.yml dependencies: and tags -or- I do not understand how all these things work together.

I apologize for the long post but I want to make sure I get all the details posted.

I have 3 roles.

The gnutls-certs role is for creating unsigned SSL certificates and I want to use it in any other role what needs SSL certificates. In this example it’s a dependency in nagios-servers and syslog-clients.

The nagios-servers role is for setting up a nagios server. It needs a SSL certificate for the web server.

The syslog-clients role is for setting up a rsyslog client using SSL to communicate back to a central rsyslog server.

Directory tree  
.  
├── group\_vars  
├── host\_vars  
├── roles  
│ ├── gnutls-certs  
│ │ ├── defaults  
│ │ ├── files  
│ │ ├── handlers  
│ │ ├── meta  
│ │ │ └── main.yml  
│ │ ├── tasks  
│ │ ├── templates  
│ │ ├── tests  
│ │ └── vars  
│ ├── nagios-servers  
│ │ ├── defaults  
│ │ ├── files  
│ │ ├── handlers  
│ │ ├── meta  
│ │ │ └── main.yml  
dependencies:

- { role: gnutls-certs }  
│ │ ├── tasks  
│ │ ├── templates  
│ │ └── vars  
│ │ │ └── main.yml  
MY\_ca\_pem: “/path/to/nagios-servers/ca.pem"  
MY\_ca\_key\_pem: “/path/to/nagios-servers/ca-key.pem"  
│ ├── syslog-clients  
│ │ ├── defaults  
│ │ ├── handlers  
│ │ ├── meta  
│ │ │ └── main.yml  
dependencies:
- { role: gnutls-certs }  
│ │ ├── tasks  
│ │ ├── templates  
│ │ └── vars  
│ │ │ └── main.yml  
MY\_ca\_pem: “/path/to/syslog-clients/ca.pem"  
MY\_ca\_key\_pem: “/path/to/syslog-clients/ca-key.pem"

Both the nagios-servers role and the syslog-clients role have a dependency on the gnutls-certs role identified via the meta/main.yml (see above)

The nagios-servers role identifies the CA (variable MY\_ca\_pem) and key (MY\_ca\_key\_pem) via the nagios-servers/vars/main.yml

The syslog-clients role identifies the CA (variable MY\_ca\_pem) and key (MY\_ca\_key\_pem) via the syslog-clients/vars/main.yml

Simple plays with debug.

---

<div class="post-metadata">

**Author:** ![Bob\_Tanner](https://avatars.discourse-cdn.com/v4/letter/b/49beb7/32.png) [@Bob\_Tanner](https://forum.ansible.com/u/Bob_Tanner)\
**Post date:** [January 11, 2016, 9:57pm UTC](https://forum.ansible.com/t/understanding-how-roles-dependencies-and-tags-work-together/20149/2 "2016-01-11T21:57:58Z")

</div>

If a role has a dependencies it looks like it’s run even if the role’s tag is not set?

syslog-clients and nagios-servers have a dependencies for gnutls-certs.  
All the plays in syslog-clients are tags: syslog-clients.  
All the plays in nagios-servers are tags: nagios-servers.  
All the plays in gnutls-certs are tags: gnutls-cert.

Running ansible with --tags=“nagios-servers,gnutls-certs” results in 2 runs of gnutls-certs. 1 for syslog-clients (tho not tagged) and one for nagios-servers.