By default, Ansible performs tasks on managed node (e.g. target system). The connection parameter with the local flag is used to perform a task on the control node (that's the Ansible server) instead of on the managed node (e.g. target system). In this example, the ssh-keyscan command is invoked on the control node.

---
- hosts: all
  connection: local
  tasks:
    - name: ssh-keyscan
      command: "ssh-keyscan {{ ansible_host|default(inventory_hostname)}}"
      register: out

Often, run_once: true is used so that the task is only ran one time on the control node.

---
- hosts: all
  connection: local
  tasks:
    - name: ssh-keyscan
      command: "ssh-keyscan {{ ansible_host|default(inventory_hostname)}}"
      run_once: true
      register: out

Roles

All of the tasks in a particular role can be performed on the control node. In this example, every task in the "foo" role will be performed on the control node.

Or like this.

---
- hosts: all
  roles:
    - role: foo
      connection: local