为何Ansible中failed_when条件为False仍导致debug任务失败？

我需要检查两个变量是否已定义且非空，因此编写了一个debug任务，设定当任一变量未定义或为空时任务需失败。但实际运行时，当两个变量均已定义，debug任务输出正确的提示信息“The version, previous_version values are present.”，但failed_when条件仍导致任务失败。即使我在msg中验证该条件结果为False，任务依然失败。

原任务代码：

- set_fact:
    my_variable:
      version: "2"
      previous_version: "1"

- name: Ensure versions are present
  ansible.builtin.debug:
    msg: |
      {% set missing_versions = [] %}
      {% set version_names = ['version','previous_version'] %}
      {% for version_name in version_names %}
        {% if my_variable[version_name] is not defined or my_variable[version_name] == '' %}
          {% set missing_versions = missing_versions + version_name %}
        {% endif %}
      {% endfor %}
      {% if missing_versions | length > 0 %}
        The following value(s) are missing: {{ missing_versions | join(', ') }}
      {% else %}
        The {{ version_names | join(', ') }} values are present.
      {% endif %}
  failed_when: missing_versions | length > 0

问题原因 #

核心问题是Jinja2模板内部定义的变量仅在模板渲染范围内有效：你在msg字段的模板里定义的missing_versions，只能用于生成debug的输出文本，无法被任务级别的failed_when条件引用。failed_when里的missing_versions是任务上下文里的变量，而这个变量根本没被定义，导致条件判断逻辑异常，最终触发任务失败。

解决办法 #

先通过set_fact在任务级别计算出missing_versions，再在debug任务和failed_when里引用这个全局变量：

- set_fact:
    my_variable:
      version: "2"
      previous_version: "1"

- name: Calculate missing versions
  set_fact:
    missing_versions: >-
      {% set names = ['version','previous_version'] %}
      {% set missing = [] %}
      {% for name in names %}
        {% if my_variable[name] is not defined or my_variable[name] | trim == '' %}
          {% do missing.append(name) %}
        {% endif %}
      {% endfor %}
      {{ missing }}

- name: Ensure versions are present
  ansible.builtin.debug:
    msg: >-
      {% if missing_versions | length > 0 %}
        The following value(s) are missing: {{ missing_versions | join(', ') }}
      {% else %}
        The version, previous_version values are present.
      {% endif %}
  failed_when: missing_versions | length > 0

注意：使用{% do missing.append(name) %}需要确保Ansible启用了jinja2.ext.do扩展（默认已启用，若未启用可在ansible.cfg中设置jinja2_extensions = jinja2.ext.do）。

优化建议 #

1. 使用assert模块更直观 #

Ansible的assert模块专门用于验证条件，比debug+failed_when的组合更简洁清晰：

- set_fact:
    my_variable:
      version: "2"
      previous_version: "1"

- name: Validate versions are present
  ansible.builtin.assert:
    that:
      - my_variable.version is defined
      - my_variable.version | trim != ''
      - my_variable.previous_version is defined
      - my_variable.previous_version | trim != ''
    fail_msg: "Missing required version values: check 'version' and 'previous_version'"
    success_msg: "All version values are present"

2. 批量检查多变量 #

如果需要检查的变量数量较多，可通过循环批量生成断言条件：

- set_fact:
    my_variable:
      version: "2"
      previous_version: "1"

- name: Validate all required versions
  ansible.builtin.assert:
    that:
      - "{{ item }} is defined"
      - "{{ item }} | trim != ''"
    loop:
      - my_variable.version
      - my_variable.previous_version
    fail_msg: "Missing required value: {{ item.split('.')[-1] }}"

3. 用default过滤器简化判断 #

通过default('')将未定义变量转为空字符串，再过滤出空值变量：

- set_fact:
    missing_versions: >-
      {% set names = ['version','previous_version'] %}
      {{ names | reject('map', attribute='', my_variable) | reject('default', '', true) | reject('ne', '') | list }}

内容的提问来源于stack exchange，提问作者jeremywat