Ansible 当循环条件

Question

我正在尝试设置一个角色来推出用户。 我有一个用户列表及其变量，我只想在设置变量pubkey时推出 authorized_key。 这是我的代码：

provisioning_user:
  - name: ansible
    state: present
    pubkeys:
      - 'ssh-rsa peter-key-1 peter@key1'
      - 'ssh-rsa peter-key-3 peter@key3'
    root: true
    # removes directorys associated with the user
    remove: true
    create_home: true
    comment: Deploy user for ansible
    # If set to true when used with home: , attempt to move the user’s old home
    # directory to the specified directory if it isn’t there already and the
    # old home exists.
    #non_unique: false
    #uid: 11
    #group:
    groups: admin, developer
    # If false, user will only be added to the groups specified in groups,
    # removing them from all other groups.
    append: yes
    password: '!'
    #ssh_public_keyfiles: ['ansible.pub', 'patrick.pub']
    #key: ssh-ed25519 AAAAC3NzetfqeafaC1lZDI1NTE5AAAAIHu28wqv0r4aqoK1obosoLCBP0vqZj8MIlkvpAbXv0LL
    #key_options:
    #key_comment:
    key_exclusive: true
    key_manage_dir: true

  - name: testuser2
    state: present
    # removes directorys associated with the user
    #remove: false
    create_home: yes
    comment: Deploy user for ansible

如您所见，第二个用户没有属性pubkeys 。 这是我的 Ansible 代码：

- name: test key
  authorized_key:
    user: "{{ item.name }}"
    key: "{{ '\n'.join(provisioning_user|map(attribute='pubkeys')|flatten) }}"
    comment: "{{ item.key_comment | default('managed by ansible') }}"
    state: "{{ item.state | default('true') }}"
    exclusive: "{{ item.key_exclusive | default('true') }}"
    key_options: "{{ item.key_options | default(omit) }}"
    manage_dir: "{{ item.manage_dir | default('true') }}"
  loop: "{{ provisioning_user }}"
  when: item.pubkeys is defined

这就是 Ansible 所说的：

fatal: [cloud.xxx.xxx]: FAILED! => 
  msg: |-
    The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'pubkeys'
  
    The error appears to be in '/home/xxx/gitlab.com/xxx/ansible/roles/provisioning/tasks/keys.yaml': line 2, column 3, but may
    be elsewhere in the file depending on the exact syntax problem.
  
    The offending line appears to be:
  
    ---
    - name: test key
      ^ here

你能帮我得到 when 条件吗？ 我只希望在用户定义了公钥时运行此任务，而不仅仅是跳过它。

Answer 1

这没有任何意义：

key: "{{ '\n'.join(provisioning_user|map(attribute='pubkeys')|flatten) }}"

您在此任务中循环遍历provisioning_user的内容； provisioning_user没有密钥pubkeys ，相反，该列表中的每个单独项目都可能有一个pubkeys值。 所以你想要这样的东西：

key: "{{ '\n'.join(item.pubkeys) }}"

使完整的任务看起来像：

- name: test key
  authorized_key:
    user: "{{ item.name }}"
    key: "{{ '\n'.join(item.pubkeys) }}"
    comment: "{{ item.key_comment | default('managed by ansible') }}"
    state: "{{ item.state | default('true') }}"
    exclusive: "{{ item.key_exclusive | default('true') }}"
    key_options: "{{ item.key_options | default(omit) }}"
    manage_dir: "{{ item.manage_dir | default('true') }}"
  loop: "{{ provisioning_user }}"
  when: item.pubkeys is defined

在测试环境中运行上面的代码会产生：

TASK [test key] *****************************************************************************************
changed: [node0] => (item={'name': 'ansible', 'state': 'present', 'pubkeys': ['ssh-rsa peter-key-1 peter@key1', 'ssh-rsa peter-key-3 peter@key3'], 'root': True, 'remove': True, 'create_home': True, 'comment': 'Deploy user for ansible', 'groups': 'admin, developer', 'append': True, 'password': '!', 'key_exclusive': True, 'key_manage_dir': True})
skipping: [node0] => (item={'name': 'testuser2', 'state': 'present', 'create_home': True, 'comment': 'Deploy user for ansible'})

...这就是我认为你想要的。