Special Tags

Two reserved tag names change the default filtering behavior in specific, useful ways, and one flag lets you discover what a playbook is even tagged with in the first place.

The always Tag

A task tagged always runs regardless of whatever --tags filter is active — it’s excluded only if explicitly skipped with --skip-tags always:

- name: Log that a run happened, no matter what was selected
  ansible.builtin.debug:
    msg: "Run started for {{ inventory_hostname }}"
  tags:
    - always

Even ansible-playbook site.yaml --tags configure still runs this task, despite it not being tagged configure at all — genuinely useful for logging, notifications, or any bookkeeping task that should happen regardless of which specific phase was selected.

The never Tag

The opposite: a task tagged never is skipped by default, even with no --tags filter applied at all, and only runs if explicitly requested:

- name: Dangerous cleanup, opt-in only
  ansible.builtin.file:
    path: /etc/myapp
    state: absent
  tags:
    - never
    - cleanup

ansible-playbook site.yaml --tags cleanup

Tagging something both never and a specific opt-in name (cleanup here) means it only ever runs when that specific tag is explicitly requested — a genuine safeguard for destructive or rarely-needed operations that shouldn’t accidentally run just because someone executed the playbook normally.

--list-tags: Discovering What A Playbook Is Tagged With

Recall this flag from the includes and imports section, now shown in its natural home:

ansible-playbook site.yaml --list-tags

Lists every tag used anywhere in the playbook, without running anything — the fastest way to discover what filtering options are actually available in a playbook you didn’t write yourself, or don’t fully remember the structure of.

Best Practices

• Use always for logging, notification, or bookkeeping tasks that should happen regardless of which specific phase a run was scoped to.
• Use never paired with a specific opt-in tag for destructive or rarely-needed operations — a genuine safeguard against something dangerous running accidentally.
• Run --list-tags before assuming you know a playbook’s available tags, especially for anything you didn’t write yourself.
• Keep tag names consistent and meaningful across a project — this is worth repeating, since inconsistent tagging quietly erodes the entire benefit of using tags at all.