Ansible和AWS子网

Question

我是刚接触Ansible Core / Tower的新手，但我完全不知所措，导致了以下问题。 在过去的两天里，我一直在阅读我可以在该主题上找到的所有内容，但我仍然陷于困境，寻求帮助。

这是我目前已设置的内容（以及其他用于创建全新VPC的Ansible剧本，角色和任务）。

以下是我用来创建一组新子网（每个可用区一个）并从创建的结果中获取结果的任务。 通过AWS控制台验证，这些任务都可以完美地工作。

### Create the Internet-facing DMZ subnets ###
- name: Create Subnet(s) in VPC - DMZ
  ec2_vpc_subnet:
    state: present
    vpc_id: "{{ new_vpc_info['vpcs'][0]['id'] }}"
    region: "{{ vpc_region }}"
    az: "{{ item.az }}"
    cidr: "{{ item.subnet }}"
    resource_tags:
       Name: "{{ item.name }}"
       Role: "{{ role_tag }}"
       Team: "{{ team_tag }}"
       Product Area: "{{ product_area_tag }}"
       Portfolio: "{{ portfolio_tag }}"
  with_items: "{{ dmz_subnet_az }}"

- name: Get Sunbet Info - DMZ
  ec2_vpc_subnet_facts:
    region: "{{ vpc_region }}"
    filters:
      "tag:Name": "{{ item.name }}"
  with_items: "{{ dmz_subnet_az }}"
  register: new_dmz_subnets

- debug:
    var=new_dmz_subnets

下面提供了“ debug”命令的输出，将其截断以删除其余子网，并进行了删节，因此我不会大吼大叫，它与AWS控制台中的内容相匹配。

{
    "changed": false,
    "_ansible_verbose_always": true,
    "new_dmz_subnets": {
        "msg": "All items completed",
        "changed": false,
        "results": [
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_A",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1a",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_A"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_B",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1b",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_B"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },

......

            }
        ]
    },
    "_ansible_no_log": false
}

现在到我遇到问题的任务上，下面是我最近的尝试，由于我尝试了所有发现以使其正常运行，因此这可能完全在左侧。 我试图从已注册的“ new_dmz_subnets”变量中获取“ subnet_id”的列表，然后将其与在vars文件中设置的“名称”连接起来，最后使用该信息在每个子网。

### Create the NAT Gateway in VPC ###
- name: Set DMZ Subnet facts
  set_fact:
    subnet_id_items:
      subnet_id: '{{ item.subnets | map(attribute="subnet_id") | list }}'
  with_items: "{{ new_dmz_subnets }}"
  register: subnet_id_list

- name: Set Name and DMZ Subnet loop facts
  set_fact:
    name_subnet_items:
      name: "{{ nat_gateway.name }}"
      subnet_id: "{{ item.subnet_id }}"
  loop: "{{ subnet_id_list }}"
  register: name_subnet_list

- debug:
    var=name_subnet_list

- name: Create NAT Gateway, allocate new EIP, in VPC
  ec2_vpc_nat_gateway:
    state: present
    subnet_id: "{{ item.subnet_id }}"
    region: "{{ vpc_region }}"
    wait: yes
    if_exist_do_not_create: true
    tags:
      Name: "{{ item.name }}"
      Role: "{{ role_tag }}"
      Team: "{{ team_tag }}"
      Product Area: "{{ product_area_tag }}"
      Portfolio: "{{ portfolio_tag }}"
  with_items: "{{ name_subnet_list }}"
  register: new_nat_gateway

- debug:
    var=new_nat_gateway

当我运行此设置时，收到以下致命错误消息，在我尝试的每个变体中这几乎是相同的。

12:55:15
fatal: [localhost]: FAILED! => {
    "msg": "The task includes an option with an undefined variable. The error was: 'ansible.utils.unsafe_proxy.AnsibleUnsafeText object' has no attribute 'subnets'\n\nThe error appears to have been in '/var/lib/awx/projects/_6__erik_andresen_git/ansible/splunk_poc_playbook/roles/create_networking_role/tasks/create_gateways_task.yml': line 21, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n### Starting working on this Task ###\n- name: Set DMZ Subnet facts\n  ^ here\n"
} 

请让我知道是否可以提供其他详细信息，并在此先感谢您的帮助！！！

-埃里克

Answer 1

我遇到了一个实际可行的设置！ 这可能不是最好的方法，但我仍然愿意提出建议，但至少可以奏效。

这是“ ec2_vpc_subnet”模块的代码，并收集子网ID以供以后在剧本中使用。

### Create the Internet-facing DMZ subnets ###
- name: Create Subnet(s) in VPC - DMZ
  ec2_vpc_subnet:
    state: present
    vpc_id: "{{ vpc_id }}"
    region: "{{ vpc_region }}"
    az: "{{ item.az }}"
    cidr: "{{ item.subnet }}"
    resource_tags:
       Name: "{{ item.name }}"
       Role: "{{ role_tag }}"
       Team: "{{ team_tag }}"
       Product Area: "{{ product_area_tag }}"
       Portfolio: "{{ portfolio_tag }}"
       Created By: "{{ created_by }}"
  with_items: "{{ dmz_subnet_az }}"
  register: new_dmz_subnets

- name: Set facts for Subnet - DMZ
  set_fact:
    subnet_dmz_id: "{{ subnet_dmz_id | default({}) | combine({ item.subnet.tags.Name: item.subnet.id }) }}"
  loop: "{{ new_dmz_subnets.results }}"

- debug:
    var=subnet_dmz_id

这是使用“ ec2_vpc_nat_gateway”模块中的子网ID在每个可用区中创建NAT网关。

### Create the NAT Gateway in VPC ###
- name: Create NAT Gateway, allocate new EIP, in VPC
  ec2_vpc_nat_gateway:
    state: present
    # NAT Gateways being deployed in DMZ subnets
    subnet_id: "{{ subnet_dmz_id[item.subnet_name] }}"
    region: "{{ vpc_region }}"
    wait: yes
    if_exist_do_not_create: true
    # Tags not supported in the "ec2_vpc_nat_gateway" module
    # https://github.com/ansible/ansible/issues/44339
    #tags:
    #  Name: "{{ item.name }}"
    #  Role: "{{ role_tag }}"
    #  Team: "{{ team_tag }}"
    #  Product Area: "{{ product_area_tag }}"
    #  Portfolio: "{{ portfolio_tag }}"
    #  Created By: "{{ created_by }}"
  with_items: "{{ nat_gateway }}"
  register: new_nat_gateway

- debug:
    var=new_nat_gateway