Fixing role param precedence issues

* Make role param resolution follow the role dependency chain, rather
  than using all roles within the play
* Also move params to be merged in after role vars in general, to match
  our variable precedence rules
* Changes to the way var lookup is done in role helper methods for
  get_vars(), get_inherited_vars(), and get_role_params() to make the
  above possible without trampling on previously merged vars

Fixes #14472
Fixes #14475

lib/ansible/playbook/role/__init__.py

@@ -259,31 +259,31 @@ class Role(Base, Become, Conditional, Taggable):
         default_vars = combine_vars(default_vars, self._default_vars)
         return default_vars
 
-    def get_inherited_vars(self, dep_chain=[], include_params=True):
+    def get_inherited_vars(self, dep_chain=[]):
         inherited_vars = dict()
 
         if dep_chain:
             for parent in dep_chain:
                 inherited_vars = combine_vars(inherited_vars, parent._role_vars)
-                if include_params:
-                    inherited_vars = combine_vars(inherited_vars, parent._role_params)
         return inherited_vars
 
-    def get_role_params(self):
+    def get_role_params(self, dep_chain=[]):
         params = {}
-        for dep in self.get_all_dependencies():
-            params = combine_vars(params, dep._role_params)
+        if dep_chain:
+            for parent in dep_chain:
+                params = combine_vars(params, parent._role_params)
+        params = combine_vars(params, self._role_params)
         return params
 
     def get_vars(self, dep_chain=[], include_params=True):
-        all_vars = self.get_inherited_vars(dep_chain, include_params=include_params)
+        all_vars = self.get_inherited_vars(dep_chain)
 
         for dep in self.get_all_dependencies():
             all_vars = combine_vars(all_vars, dep.get_vars(include_params=include_params))
 
         all_vars = combine_vars(all_vars, self._role_vars)
         if include_params:
-            all_vars = combine_vars(all_vars, self._role_params)
+            all_vars = combine_vars(all_vars, self.get_role_params(dep_chain=dep_chain))
 
         return all_vars
 

lib/ansible/vars/__init__.py

@@ -308,12 +308,12 @@ class VariableManager:
 
             if not C.DEFAULT_PRIVATE_ROLE_VARS:
                 for role in play.get_roles():
-                    all_vars = combine_vars(all_vars, role.get_role_params())
                     all_vars = combine_vars(all_vars, role.get_vars(include_params=False))
 
         if task:
             if task._role:
                 all_vars = combine_vars(all_vars, task._role.get_vars())
+                all_vars = combine_vars(all_vars, task._role.get_role_params(task._block._dep_chain))
             all_vars = combine_vars(all_vars, task.get_vars())
 
         if host: