diff --git a/roles/bindep/tasks/packages.yaml b/roles/bindep/tasks/packages.yaml
index f0982aef5..bd3d1555d 100644
--- a/roles/bindep/tasks/packages.yaml
+++ b/roles/bindep/tasks/packages.yaml
@@ -18,5 +18,5 @@
 
 - name: Fail if we cannot install all packages
   fail:
-    msg: "bindep failed to install from {{ bindep_file}} - {{ bindep_final_check.stdout }}"
+    msg: "bindep failed to install from {{ bindep_file }} - {{ bindep_final_check.stdout }}"
   when: bindep_final_check is failed
diff --git a/roles/build-python-release/tasks/main.yaml b/roles/build-python-release/tasks/main.yaml
index fe8369e56..fd7b7084d 100644
--- a/roles/build-python-release/tasks/main.yaml
+++ b/roles/build-python-release/tasks/main.yaml
@@ -1,4 +1,4 @@
 - name: Build a tarball and wheel
-  command: "{{release_python}} setup.py sdist bdist_wheel {{bdist_wheel_xargs}}"
+  command: "{{ release_python }} setup.py sdist bdist_wheel {{ bdist_wheel_xargs }}"
   args:
     chdir: "{{ zuul_work_dir }}"
diff --git a/roles/create-afs-token/tasks/main.yaml b/roles/create-afs-token/tasks/main.yaml
index 3a66b94ff..4d9dcae89 100644
--- a/roles/create-afs-token/tasks/main.yaml
+++ b/roles/create-afs-token/tasks/main.yaml
@@ -10,7 +10,7 @@
     mode: 0400
 
 - name: Obtain ticket for Kerberos
-  command: "kinit -k -t {{ afs_keytab_tmp.path}} {{ afs.service_name }}"
+  command: "kinit -k -t {{ afs_keytab_tmp.path }} {{ afs.service_name }}"
 
 - name: Delete AFS keytab tempfile
   file:
diff --git a/roles/fetch-sphinx-tarball/tasks/main.yaml b/roles/fetch-sphinx-tarball/tasks/main.yaml
index 5fde05e90..982f8c83b 100644
--- a/roles/fetch-sphinx-tarball/tasks/main.yaml
+++ b/roles/fetch-sphinx-tarball/tasks/main.yaml
@@ -6,7 +6,7 @@
 
 - name: Parse sphinx build directory
   set_fact:
-    sphinx_dir: "{{sphinx_dir.files | map(attribute='path') | map('regex_replace', '^.*/(.*)$', '\\1') | list}}"
+    sphinx_dir: "{{ sphinx_dir.files | map(attribute='path') | map('regex_replace', '^.*/(.*)$', '\\1') | list }}"
 
 - name: Process sphinx HTML
   when: "'html' in sphinx_dir"
diff --git a/roles/mirror-workspace-git-repos/tasks/main.yaml b/roles/mirror-workspace-git-repos/tasks/main.yaml
index 82212d952..4fe069dc2 100644
--- a/roles/mirror-workspace-git-repos/tasks/main.yaml
+++ b/roles/mirror-workspace-git-repos/tasks/main.yaml
@@ -3,11 +3,11 @@
     name: receive.denyCurrentBranch ignore
     value: ignore
     scope: local
-    repo: "{{ ansible_user_dir }}/{{ item.value.src_dir}}"
+    repo: "{{ ansible_user_dir }}/{{ item.value.src_dir }}"
   with_dict: "{{ zuul.projects }}"
 
 - name: Synchronize src repos to workspace directory
-  command: "git push {% if mirror_workspace_quiet %}--quiet{% endif %} --mirror git+ssh://{{ ansible_user }}@{{ ansible_host | ipwrap }}:{{ ansible_port }}/{{ ansible_user_dir }}/{{ item.value.src_dir}}"
+  command: "git push {% if mirror_workspace_quiet %}--quiet{% endif %} --mirror git+ssh://{{ ansible_user }}@{{ ansible_host | ipwrap }}:{{ ansible_port }}/{{ ansible_user_dir }}/{{ item.value.src_dir }}"
   args:
     chdir: "{{ zuul.executor.work_root }}/{{ item.value.src_dir }}"
   with_dict: "{{ zuul.projects }}"
diff --git a/roles/multi-node-bridge/tasks/peer.yaml b/roles/multi-node-bridge/tasks/peer.yaml
index 8eeba1213..c1dea7d1f 100644
--- a/roles/multi-node-bridge/tasks/peer.yaml
+++ b/roles/multi-node-bridge/tasks/peer.yaml
@@ -29,7 +29,7 @@
   command: >-
     ovs-vsctl --may-exist add-port {{ bridge_name }}
     {{ bridge_name }}_{{ nodepool_ip }}
-    -- set interface {{ bridge_name }}_{{ nodepool_ip}}
+    -- set interface {{ bridge_name }}_{{ nodepool_ip }}
     type=vxlan options:remote_ip={{ nodepool_ip }} options:key={{ vni }}
     options:local_ip={{ switch_ip }}
   delegate_to: "{{ switch }}"
diff --git a/roles/prepare-workspace-git/tasks/main.yaml b/roles/prepare-workspace-git/tasks/main.yaml
index 89922cdde..9c5de2146 100644
--- a/roles/prepare-workspace-git/tasks/main.yaml
+++ b/roles/prepare-workspace-git/tasks/main.yaml
@@ -9,11 +9,11 @@
 - name: Clone cached repo to workspace
   shell: |
     set -e
-    git clone --bare {{ cached_repos_root }}/{{ item.0.canonical_name }} {{ ansible_user_dir }}/{{ item.0.src_dir}}/.git
+    git clone --bare {{ cached_repos_root }}/{{ item.0.canonical_name }} {{ ansible_user_dir }}/{{ item.0.src_dir }}/.git
     cd {{ ansible_user_dir }}/{{ item.0.src_dir }}
     git config --local --bool core.bare false
   args:
-    creates: "{{ ansible_user_dir }}/{{ item.0.src_dir}}"
+    creates: "{{ ansible_user_dir }}/{{ item.0.src_dir }}"
   when: item.1.stat.exists
   with_together:
     - "{{ zuul.projects.values() | list }}"
@@ -24,9 +24,9 @@
     - skip_ansible_lint
 
 - name: Initialize non-cached repos
-  command: "git init {{ ansible_user_dir }}/{{ item.0.src_dir}}"
+  command: "git init {{ ansible_user_dir }}/{{ item.0.src_dir }}"
   args:
-    creates: "{{ ansible_user_dir }}/{{ item.0.src_dir}}"
+    creates: "{{ ansible_user_dir }}/{{ item.0.src_dir }}"
   when: not item.1.stat.exists
   with_together:
     - "{{ zuul.projects.values() | list }}"
@@ -43,7 +43,7 @@
     git remote -v | grep origin && git remote rm origin || true
     git remote add origin file:///dev/null
   args:
-    chdir: "{{ ansible_user_dir }}/{{ item.src_dir}}"
+    chdir: "{{ ansible_user_dir }}/{{ item.src_dir }}"
   with_items: "{{ zuul.projects.values() | list }}"
   # ANSIBLE0006: git remote is not supported by ansible module
   tags:
diff --git a/roles/push-to-intermediate-registry/tasks/push-image.yaml b/roles/push-to-intermediate-registry/tasks/push-image.yaml
index eba18a975..33c92d61f 100644
--- a/roles/push-to-intermediate-registry/tasks/push-image.yaml
+++ b/roles/push-to-intermediate-registry/tasks/push-image.yaml
@@ -2,7 +2,7 @@
   command: >-
     skopeo --insecure-policy copy
     docker://127.0.0.1:{{ socat_port }}/{{ image.repository }}:{{ image_tag }}
-    docker://{{ intermediate_registry.host | ipwrap }}:{{ intermediate_registry.port}}/{{ image.repository }}:{{ zuul.build }}_{{ image_tag }}
+    docker://{{ intermediate_registry.host | ipwrap }}:{{ intermediate_registry.port }}/{{ image.repository }}:{{ zuul.build }}_{{ image_tag }}
   retries: 3
   register: result
   until: result is success
@@ -16,7 +16,7 @@
       zuul:
         artifacts:
           - name: "image_{{ image.repository }}:{{ image_tag }}"
-            url: "docker://{{ intermediate_registry.host | ipwrap }}:{{ intermediate_registry.port}}/{{ image.repository }}:{{ zuul.build }}_{{ image_tag}}"
+            url: "docker://{{ intermediate_registry.host | ipwrap }}:{{ intermediate_registry.port }}/{{ image.repository }}:{{ zuul.build }}_{{ image_tag }}"
             metadata:
               type: container_image
               repository: "{{ image.repository }}"
diff --git a/roles/run-buildset-registry/tasks/main.yaml b/roles/run-buildset-registry/tasks/main.yaml
index 3c0cab05e..3a5291f34 100644
--- a/roles/run-buildset-registry/tasks/main.yaml
+++ b/roles/run-buildset-registry/tasks/main.yaml
@@ -21,7 +21,7 @@
 - name: Ensure Docker registry volume directories exists
   file:
     state: directory
-    path: "{{ buildset_registry_root}}/{{ item }}"
+    path: "{{ buildset_registry_root }}/{{ item }}"
   loop:
     - certs
     - auth
@@ -32,23 +32,23 @@
   htpasswd:
     create: true
     crypt_scheme: bcrypt
-    path: "{{ buildset_registry_root}}/auth/htpasswd"
+    path: "{{ buildset_registry_root }}/auth/htpasswd"
     name: "zuul"
     password: "{{ registry_password }}"
 - name: Generate a TLS key for the Docker registry
   openssl_privatekey:
-    path: "{{ buildset_registry_root}}/certs/domain.key"
+    path: "{{ buildset_registry_root }}/certs/domain.key"
 - name: Generate a TLS CSR for the Docker registry
   openssl_csr:
-    path: "{{ buildset_registry_root}}/certs/domain.csr"
-    privatekey_path: "{{ buildset_registry_root}}/certs/domain.key"
+    path: "{{ buildset_registry_root }}/certs/domain.csr"
+    privatekey_path: "{{ buildset_registry_root }}/certs/domain.key"
     common_name: "{{ ansible_host }}"
     subject_alt_name: "DNS:zuul-jobs.buildset-registry,DNS:{{ ansible_host }},IP:{{ ansible_host }},IP:127.0.0.1"
 - name: Generate a TLS cert for the Docker registry
   openssl_certificate:
-    path: "{{ buildset_registry_root}}/certs/domain.crt"
-    csr_path: "{{ buildset_registry_root}}/certs/domain.csr"
-    privatekey_path: "{{ buildset_registry_root}}/certs/domain.key"
+    path: "{{ buildset_registry_root }}/certs/domain.crt"
+    csr_path: "{{ buildset_registry_root }}/certs/domain.csr"
+    privatekey_path: "{{ buildset_registry_root }}/certs/domain.key"
     provider: selfsigned
   register: generated_cert
 - name: Read TLS certificate
@@ -73,8 +73,8 @@
       REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
       REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
     volumes:
-      - "{{ buildset_registry_root}}/certs:/certs"
-      - "{{ buildset_registry_root}}/auth:/auth"
+      - "{{ buildset_registry_root }}/certs:/certs"
+      - "{{ buildset_registry_root }}/auth:/auth"
 - name: Start a docker proxy
   docker_container:
     name: buildset_proxy
@@ -93,8 +93,8 @@
       REGISTRY_PROXY_USERNAME: ''
       REGISTRY_PROXY_PASSWORD: ''
     volumes:
-      - "{{ buildset_registry_root}}/certs:/certs"
-      - "{{ buildset_registry_root}}/auth:/auth"
+      - "{{ buildset_registry_root }}/certs:/certs"
+      - "{{ buildset_registry_root }}/auth:/auth"
 - name: Set registry information fact
   set_fact:
     buildset_registry:
diff --git a/roles/stage-output/tasks/main.yaml b/roles/stage-output/tasks/main.yaml
index cae190d0d..29d0bc526 100644
--- a/roles/stage-output/tasks/main.yaml
+++ b/roles/stage-output/tasks/main.yaml
@@ -59,7 +59,7 @@
 - name: Copy files and folders to staging folder
   # remote_src copy does not work recursively, synchronise is restricted by
   # zuul, using command
-  command: cp -pRL {{ item.source}} {{ stage_dir }}/{{ item.dest }}
+  command: cp -pRL {{ item.source }} {{ stage_dir }}/{{ item.dest }}
   become: true
   with_items: "{{ all_sources }}"
 
diff --git a/roles/test-mirror-workspace-git-repos/tasks/main.yaml b/roles/test-mirror-workspace-git-repos/tasks/main.yaml
index 3cd81bf6f..65e9fec23 100644
--- a/roles/test-mirror-workspace-git-repos/tasks/main.yaml
+++ b/roles/test-mirror-workspace-git-repos/tasks/main.yaml
@@ -3,11 +3,11 @@
     name: receive.denyCurrentBranch ignore
     value: ignore
     scope: local
-    repo: "{{ ansible_user_dir }}/{{ item.value.src_dir}}"
+    repo: "{{ ansible_user_dir }}/{{ item.value.src_dir }}"
   with_dict: "{{ zuul.projects }}"
 
 - name: Synchronize src repos to workspace directory
-  command: "git push --mirror git+ssh://{{ ansible_user }}@{{ ansible_host | ipwrap }}:{{ ansible_port }}/{{ ansible_user_dir }}/{{ item.value.src_dir}}"
+  command: "git push --mirror git+ssh://{{ ansible_user }}@{{ ansible_host | ipwrap }}:{{ ansible_port }}/{{ ansible_user_dir }}/{{ item.value.src_dir }}"
   args:
     chdir: "{{ zuul.executor.work_root }}/{{ item.value.src_dir }}"
   with_dict: "{{ zuul.projects }}"
diff --git a/roles/upload-logs-swift/tasks/main.yaml b/roles/upload-logs-swift/tasks/main.yaml
index b66b1b023..eba0d2a3a 100644
--- a/roles/upload-logs-swift/tasks/main.yaml
+++ b/roles/upload-logs-swift/tasks/main.yaml
@@ -27,7 +27,7 @@
         indexes: "{{ zuul_log_create_indexes }}"
         files:
           - "{{ zuul.executor.log_root }}/"
-        delete_after: "{{zuul_log_delete_after | default(omit) }}"
+        delete_after: "{{ zuul_log_delete_after | default(omit) }}"
       register: upload_results
 
 - name: Return log URL to Zuul
diff --git a/roles/upload-logs/tasks/main.yaml b/roles/upload-logs/tasks/main.yaml
index 7092734b1..cd2b46a4c 100644
--- a/roles/upload-logs/tasks/main.yaml
+++ b/roles/upload-logs/tasks/main.yaml
@@ -9,7 +9,7 @@
 
     - name: Create log directories
       file:
-        path: "{{zuul_logserver_root}}/{{ zuul_log_path }}"
+        path: "{{ zuul_logserver_root }}/{{ zuul_log_path }}"
         state: directory
         recurse: yes
         mode: 0775
@@ -26,7 +26,7 @@
     - name: Upload logs to log server
       synchronize:
         src: "{{ zuul.executor.log_root }}/"
-        dest: "{{zuul_logserver_root}}/{{ zuul_log_path }}/"
+        dest: "{{ zuul_logserver_root }}/{{ zuul_log_path }}/"
         rsync_opts:
           - "--exclude=job-output.txt"
           - "--exclude=job-output.json"
@@ -44,7 +44,7 @@
     - name: Upload console log and json output
       synchronize:
         src: "{{ zuul.executor.log_root }}/{{ item }}.gz"
-        dest: "{{zuul_logserver_root}}/{{ zuul_log_path }}/{{ item }}.gz"
+        dest: "{{ zuul_logserver_root }}/{{ zuul_log_path }}/{{ item }}.gz"
         verify_host: true
       with_items:
         - job-output.txt
diff --git a/roles/upload-pypi/tasks/main.yaml b/roles/upload-pypi/tasks/main.yaml
index 5a32bcb23..671daeac7 100644
--- a/roles/upload-pypi/tasks/main.yaml
+++ b/roles/upload-pypi/tasks/main.yaml
@@ -18,7 +18,7 @@
 
 - name: Report no wheels to be uploaded
   debug:
-    msg: "Found no wheels to upload: {{found_wheels.msg}}"
+    msg: "Found no wheels to upload: {{ found_wheels.msg }}"
   when: found_wheels.files == []
 
 - name: Register packages on the PyPI server (via wheels)
@@ -38,7 +38,7 @@
 
 - name: Report no tarballs to be uploaded
   debug:
-    msg: "Found no tarballs to upload: {{found_tarballs.msg}}"
+    msg: "Found no tarballs to upload: {{ found_tarballs.msg }}"
   when: found_tarballs.files == []
 
 - name: Register packages on the PyPI server (via tarballs)
diff --git a/roles/use-buildset-registry/tasks/main.yaml b/roles/use-buildset-registry/tasks/main.yaml
index 16c445058..a276442ea 100644
--- a/roles/use-buildset-registry/tasks/main.yaml
+++ b/roles/use-buildset-registry/tasks/main.yaml
@@ -66,7 +66,7 @@
 - name: Add registry to docker daemon configuration
   vars:
     new_config:
-      registry-mirrors: "['https://{{ buildset_registry_alias }}:{{ buildset_registry.port}}/', 'https://{{ buildset_registry_alias }}:{{ buildset_registry.proxy_port}}/']"
+      registry-mirrors: "['https://{{ buildset_registry_alias }}:{{ buildset_registry.port }}/', 'https://{{ buildset_registry_alias }}:{{ buildset_registry.proxy_port }}/']"
   set_fact:
     docker_config: "{{ docker_config | combine(new_config) }}"
 - name: Save docker daemon configuration
diff --git a/test-requirements.txt b/test-requirements.txt
index 0a19d62d6..6f062bf44 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -15,7 +15,7 @@ zuul
 ansible>=2.5.1,<2.6 # https://review.openstack.org/567007
 # Don't automatically switch to ansible-lint 5 when it becomes
 # available, so that it can be evaluated for an orderly transition.
-ansible-lint<5
+ansible-lint>=4.1.1a0,<5
 bashate>=0.2
 stestr>=1.0.0 # Apache-2.0
 # For upload-logs-swift:
diff --git a/tox.ini b/tox.ini
index 6d5ede496..757c0a7f2 100644
--- a/tox.ini
+++ b/tox.ini
@@ -43,11 +43,10 @@ commands =
   # Ansible lint
   # [ANSIBLE0012] Commands should not change things if nothing needs doing
   # [204] Lines should be no longer than 160 chars
-  # [206] Variables should have spaces before and after: {{ var_name }}
   bash -c "find playbooks -type f -regex '.*.ya?ml' -print0 | \
-    xargs -t -n1 -0 ansible-lint -xANSIBLE0012,204,206"
+    xargs -t -n1 -0 ansible-lint -xANSIBLE0012,204"
   bash -c 'find roles -maxdepth 1 -mindepth 1 -type d -printf "%p/\n" | \
-    xargs -t -n1 ansible-lint -xANSIBLE0012,204,206'
+    xargs -t -n1 ansible-lint -xANSIBLE0012,204'
   # Ansible Syntax Check
   bash -c "find playbooks -type f -regex '.*.ya?ml' -exec \
     ansible-playbook --syntax-check -i {toxinidir}/tests/inventory \{\} + > /dev/null"