Further tweaks to variable precedence to make it match our docs

Also removes looking at role variables from the Block, as those are
merged in separately via VariableManager

2 files changed, 14 insertions, 4 deletions

diff --git a/lib/ansible/playbook/block.py b/lib/ansible/playbook/block.py
index 8b4a6c8a10..1f52dfbf88 100644
--- a/lib/ansible/playbook/block.py
+++ b/lib/ansible/playbook/block.py
@@ -65,8 +65,6 @@ class Block(Base, Become, Conditional, Taggable):
 
         all_vars = self.vars.copy()
 
-        if self._role:
-            all_vars.update(self._role.get_vars(self._dep_chain, include_params=False))
         if self._parent_block:
             all_vars.update(self._parent_block.get_vars())
         if self._task_include:
diff --git a/lib/ansible/vars/__init__.py b/lib/ansible/vars/__init__.py
index f64764a890..30068d12ad 100644
--- a/lib/ansible/vars/__init__.py
+++ b/lib/ansible/vars/__init__.py
@@ -323,25 +323,37 @@ class VariableManager:
                         display.vvv("skipping vars_file '%s' due to an undefined variable" % vars_file_item)
                         continue
 
+            # By default, we now merge in all vars from all roles in the play,
+            # unless the user has disabled this via a config option
             if not C.DEFAULT_PRIVATE_ROLE_VARS:
                 for role in play.get_roles():
                     all_vars = combine_vars(all_vars, role.get_vars(include_params=False))
 
+        # next, we merge in the vars from the role, which will specifically
+        # follow the role dependency chain, and then we merge in the tasks
+        # vars (which will look at parent blocks/task includes)
+        if task:
+            if task._role:
+                all_vars = combine_vars(all_vars, task._role.get_vars(include_params=False))
+            all_vars = combine_vars(all_vars, task.get_vars())
+
+        # next, we merge in the vars cache (include vars) and nonpersistent
+        # facts cache (set_fact/register), in that order
         if host:
             all_vars = combine_vars(all_vars, self._vars_cache.get(host.get_name(), dict()))
             all_vars = combine_vars(all_vars, self._nonpersistent_fact_cache.get(host.name, dict()))
 
+        # next, we merge in role params and task include params
         if task:
             if task._role:
-                all_vars = combine_vars(all_vars, task._role.get_vars(include_params=False))
                 all_vars = combine_vars(all_vars, task._role.get_role_params(task._block.get_dep_chain()))
-            all_vars = combine_vars(all_vars, task.get_vars())
 
             # special case for include tasks, where the include params
             # may be specified in the vars field for the task, which should
             # have higher precedence than the vars/np facts above
             all_vars = combine_vars(all_vars, task.get_include_params())
 
+        # finally, we merge in extra vars and the magic variables
         all_vars = combine_vars(all_vars, self._extra_vars)
         all_vars = combine_vars(all_vars, magic_variables)