Ansible with_items 循环遍历组，定义为列表

Question

I am trying to modify my ufw firewall playbook, so it would accept list of host groups from inventory, that will be allowed to connect. It works fine for one group, but that's just not flexible enough for my needs. But when I try this, it just won't work (I didn't expect it to work, but I just don't know, how to do it):

- name: allow only specified groups of servers to connect to any port
  ufw:
    rule: allow
    src: "{{ hostvars[item]['ansible_default_ipv4']['address']}}"
  with_items:
    - groups.{{ ufw_allow_groups }}

Variable is defined as a list:

ufw_allow_groups:
  - group_of_hosts1
  - group_of_hosts2

Error message:

FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: \"hostvars['groups.['group_of_hosts1', 'group_of_hosts']']\" is undefined

Any ideas on how to accomplish that? Thanks for any input!

Answer 1

I think working with only one group is flexible enough. Simply make supergroups.

So, let's say you have three groups, two of which you want to be allowed to connect:

[group1]
host1_1
host1_2

[group2]
host2_1
host2_2

[group3]
host3_1
host3_2

Now, you only want group1 and group3 hosts to be able to connect. Add a supergroup:

[ufw_allow_groups]
[ufw_allow_groups:children]
group1
group3