Ansible条件判断报错求助：directory_status未定义问题

需求与问题代码 #

需要先通过stat模块检查目录/my_directory是否存在，仅当不存在时由root创建该目录（后续将通过fstab挂载，挂载后目录使用不同UID/GID）。编写的剧本如下：

---
- name: Create a directory if it does not exist.
  hosts: server1
  connection: ssh
  tasks:
    - block:
        - name: Check if directory exists.
          ansible.builtin.stat:
            path: '/my_directory'
          register: directory_status
    
        - debug: var=directory_status.stat.path
    
        - name: Create the directory if it does not exist.
          ansible.builtin.file:
            path: /my_directory
            state: directory
            owner: root
            group: root
            mode: '0775'
      when:
        - not directory_status.stat.exists

报错信息 #

运行剧本时触发如下错误：

TASK [Check if directory exists.] ******************************************************************************************
task path: /etc/ansible/playbooks/directory.yml:9
fatal: [server1]: FAILED! => {"msg": "The conditional check 'not directory_status.stat.exists' failed. The error was: error while evaluating conditional (not directory_status.stat.exists): 'directory_status' is undefined. 'directory_status' is undefined\n\nThe error appears to be in '/etc/ansible/playbooks/directory.yml': line 9, column 11, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n      - block:\n        - name: Check if directory exists.\n          ^ here
"}

对比的正常代码片段 #

之前可正常运行的类似逻辑代码片段：

- name: Register mdatp_onboard.json
  stat:
    path: /etc/opt/microsoft/mdatp/mdatp_onboard.json
  register: mdatp_onboard

- name: Extract WindowsDefenderATPOnboardingPackage.zip into /etc/opt/microsoft/mdatp
  unarchive:
    src: /etc/ansible/files/mdatp/WindowsDefenderATPOnboardingPackage.zip
    dest: /etc/opt/microsoft/mdatp
    mode: 0600
    owner: root
    group: root
  when:
    - "not mdatp_onboard.stat.exists"

- name: Register mdatp_managed.json
  stat:
    path: /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
    register: mdatp_managed

- name: Create Microsoft mdatp_managed.json file from template.
  template:
    src: /etc/ansible/templates/mdatp_managed.json.j2
    dest: /etc/opt/microsoft/mdatp/managed/mdatp_managed.json
    mode: 0600
  when:
    - not mdatp_managed.stat.exists
    - ansible_os_family == "RedHat"

问题原因与修复方案 #

原因 #

错误核心是将when条件绑定到了整个block上：directory_status是block内部的stat task注册的变量，在执行block的条件判断时，该变量还未被定义，因此触发"undefined"错误。

而正常代码中，stat task和后续带条件的task是平级的，stat先执行完成并注册变量，后续task的条件判断才能正常引用该变量。

修复后的剧本 #

将when条件移动到创建目录的task上，确保stat任务先执行并完成变量注册：

---
- name: Create a directory if it does not exist.
  hosts: server1
  connection: ssh
  tasks:
    - name: Check if directory exists.
      ansible.builtin.stat:
        path: '/my_directory'
      register: directory_status

    - debug: var=directory_status.stat.path

    - name: Create the directory if it does not exist.
      ansible.builtin.file:
        path: /my_directory
        state: directory
        owner: root
        group: root
        mode: '0775'
      when: not directory_status.stat.exists

如果仍需要使用block（比如批量加标签、错误处理），可以保留block，但移除block的when条件，仅给创建目录的task添加条件：

---
- name: Create a directory if it does not exist.
  hosts: server1
  connection: ssh
  tasks:
    - block:
        - name: Check if directory exists.
          ansible.builtin.stat:
            path: '/my_directory'
          register: directory_status
    
        - debug: var=directory_status.stat.path
    
        - name: Create the directory if it does not exist.
          ansible.builtin.file:
            path: /my_directory
            state: directory
            owner: root
            group: root
            mode: '0775'
          when: not directory_status.stat.exists

内容的提问来源于stack exchange，提问作者ealric