The mysql-percona-replication role sets the root password, but the task will fail if the root password has already been set. Maybe `debconf` could be used to set the root password no matter its previous value.