Ansibleのloopとregistered変数設計入門｜with_items廃止後の繰り返し処理と結果制御パターン

この記事のポイント

・with_items は非推奨。loop: キーワードが現在の標準的な繰り返し構文
・loop_control の label でログ出力を短縮し、index_var でインデックス番号を取得できる
・register 変数はループ全体の結果を .results リストとして保持する
・register + when の組み合わせで「失敗したアイテムにだけ再処理をかける」設計が可能

$ ansible --version
ansible [core 2.14.17]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.11/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.11.7 (main, Feb 12 2024, 11:00:00)
  jinja version = 3.1.2
  libyaml = True

[DEPRECATION WARNING]: with_items is deprecated.
You can use the 'loop' keyword instead.
For more details refer to the following URL:
https://docs.ansible.com/ansible-core/2.14/playbook_guide/playbooks_loops.html

# install-packages.yml
- name: 開発ツールをまとめてインストールする
  hosts: webservers
  become: yes
  tasks:
    - name: 必要パッケージを導入する
      ansible.builtin.dnf:
        name: "{{ item }}"
        state: present
      loop:
        - git
        - vim
        - wget
        - unzip

TASK [必要パッケージを導入する] ***
changed: [192.0.2.10] => (item=git)
changed: [192.0.2.10] => (item=vim)
ok: [192.0.2.10] => (item=wget)
changed: [192.0.2.10] => (item=unzip)

- name: アプリケーションユーザーを作成する
  ansible.builtin.user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    groups: "{{ item.groups }}"
    create_home: yes
    shell: /bin/bash
  loop:
    - { name: deploy, uid: 1100, groups: "wheel" }
    - { name: monitor, uid: 1101, groups: "nobody" }
    - { name: appuser, uid: 1102, groups: "wheel" }

# label未設定の場合のログ（見づらい）
changed: [192.0.2.10] => (item={'name': 'deploy', 'uid': 1100, 'groups': 'wheel'})
changed: [192.0.2.10] => (item={'name': 'monitor', 'uid': 1101, 'groups': 'nobody'})

- name: アプリケーションユーザーを作成する
  ansible.builtin.user:
    name: "{{ item.name }}"
    uid: "{{ item.uid }}"
    groups: "{{ item.groups }}"
  loop:
    - { name: deploy, uid: 1100, groups: "wheel" }
    - { name: monitor, uid: 1101, groups: "nobody" }
  loop_control:
    label: "{{ item.name }}"

# label設定後のログ（スッキリ読みやすい）
changed: [192.0.2.10] => (item=deploy)
changed: [192.0.2.10] => (item=monitor)

- name: 設定ファイルを番号付きで配置する
  ansible.builtin.template:
    src: "app-config.j2"
    dest: "/etc/app/config_{{ idx + 1 }}.conf"
    owner: appuser
    group: appuser
    mode: "0640"
  loop: "{{ config_targets }}"
  loop_control:
    label: "{{ item }}"
    index_var: idx

- name: EC2インスタンスにタグを付与する（API制限対応）
  amazon.aws.ec2_tag:
    region: "{{ aws_region }}"
    resource: "{{ item.instance_id }}"
    tags:
      Environment: production
      ManagedBy: ansible
  loop: "{{ ec2_instances }}"
  loop_control:
    label: "{{ item.instance_id }}"
    pause: 2

- name: サービスの稼働状態を確認する
  ansible.builtin.command:
    cmd: "systemctl is-active {{ item }}"
  register: service_check
  loop:
    - nginx
    - mariadb
    - crond
  ignore_errors: yes

ok: [192.0.2.10] => {
    "service_check": {
        "results": [
            {
                "item": "nginx",
                "rc": 0,
                "stdout": "active",
                "stderr": "",
                "failed": false,
                "changed": true
            },
            {
                "item": "mariadb",
                "rc": 0,
                "stdout": "active",
                "stderr": "",
                "failed": false,
                "changed": true
            },
            {
                "item": "crond",
                "rc": 3,
                "stdout": "inactive",
                "stderr": "",
                "failed": false,
                "changed": true
            }
        ]
    }
}

- name: 停止しているサービスを起動する
  ansible.builtin.service:
    name: "{{ item.item }}"
    state: started
    enabled: yes
  loop: "{{ service_check.results }}"
  when: item.rc != 0
  loop_control:
    label: "{{ item.item }}"

TASK [停止しているサービスを起動する] ***
skipping: [192.0.2.10] => (item=nginx)
skipping: [192.0.2.10] => (item=mariadb)
changed: [192.0.2.10] => (item=crond)

# group_vars/all.yml
users:
  - name: deploy
    uid: 1100
    ssh_keys:
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAbcdefghijk deploy@pc"
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIXyzabcdefgh deploy@work-pc"
  - name: monitor
    uid: 1101
    ssh_keys:
      - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMonitorKey1 monitor@ops-pc"

- name: ユーザーの公開鍵を配置する
  ansible.posix.authorized_key:
    user: "{{ item.0.name }}"
    key: "{{ item.1 }}"
    state: present
  loop: "{{ users | subelements('ssh_keys') }}"
  loop_control:
    label: "{{ item.0.name }}"

TASK [ユーザーの公開鍵を配置する] ***
changed: [192.0.2.10] => (item=deploy)
changed: [192.0.2.10] => (item=deploy)
changed: [192.0.2.10] => (item=monitor)

# with_itemsの場合: [1, 2, 3, 4] にフラット化される
- with_items:
    - [1, 2]
    - [3, 4]

# loopの場合: [[1, 2], [3, 4]] のままでネストが維持される
- loop:
    - [1, 2]
    - [3, 4]

- loop: "{{ [[1, 2], [3, 4]] | flatten(1) }}"

# vars定義
vars:
  service_ports:
    nginx: 80
    mariadb: 3306
    redis: 6379

# with_dictの場合（非推奨）
- with_dict: "{{ service_ports }}"

# loopの場合（現在の標準）
- loop: "{{ service_ports | dict2items }}"

- name: firewalldでポートを開放する
  ansible.posix.firewalld:
    port: "{{ item.value }}/tcp"
    permanent: yes
    state: enabled
  loop: "{{ service_ports | dict2items }}"
  loop_control:
    label: "{{ item.key }}:{{ item.value }}"

# 全環境×全サービスの組み合わせをループ
- name: 環境ごとにサービスを確認する
  ansible.builtin.debug:
    msg: "環境: {{ item.0 }} / サービス: {{ item.1 }}"
  loop: "{{ ['dev', 'stg', 'prod'] | product(['nginx', 'mariadb']) | list }}"

ok: [192.0.2.10] => (item=['dev', 'nginx']) => {"msg": "環境: dev / サービス: nginx"}
ok: [192.0.2.10] => (item=['dev', 'mariadb']) => {"msg": "環境: dev / サービス: mariadb"}
ok: [192.0.2.10] => (item=['stg', 'nginx']) => {"msg": "環境: stg / サービス: nginx"}
ok: [192.0.2.10] => (item=['stg', 'mariadb']) => {"msg": "環境: stg / サービス: mariadb"}
ok: [192.0.2.10] => (item=['prod', 'nginx']) => {"msg": "環境: prod / サービス: nginx"}
ok: [192.0.2.10] => (item=['prod', 'mariadb']) => {"msg": "環境: prod / サービス: mariadb"}