By default, Ansible performs tasks on managed node (e.g. target system). The connection parameter with the local flag is used to perform a task on the control node (that's the Ansible server) instead of on the managed node (e.g. target system). In this example, the ssh-keyscan command is invoked on the control node.
---
- hosts: all
connection: local
tasks:
- name: ssh-keyscan
command: "ssh-keyscan {{ ansible_host|default(inventory_hostname)}}"
register: out
Often, run_once: true is used so that the task is only ran one time on the control node.
---
- hosts: all
connection: local
tasks:
- name: ssh-keyscan
command: "ssh-keyscan {{ ansible_host|default(inventory_hostname)}}"
run_once: true
register: out
Roles
All of the tasks in a particular role can be performed on the control node. In this example, every task in the "foo" role will be performed on the control node.
Or like this.
---
- hosts: all
roles:
- role: foo
connection: local