Ansible Jinja2 map(attribute)含特殊字符的正确转义方法问询

问题场景 #

我正在构建通过Namecheap API续订HTTPS证书的Ansible任务，API返回带XML命名空间的响应，使用community.general.xml模块解析时，需要提取<Certificate Type="INTERMEDIATE">节点内的证书内容拼接成证书链。但模块返回的属性名包含XML命名空间URL（带点号和大括号），导致set_fact任务报错。

XML响应示例 #

<?xml version="1.0" encoding="UTF-8"?>
<ApiResponse Status="OK" xmlns="http://api.namecheap.com/xml.response">
    <Errors/>
    <Warnings/>
    <RequestedCommand>namecheap.ssl.getInfo</RequestedCommand>
    <CommandResponse Type="namecheap.ssl.getInfo">
        <SSLGetInfoResult Status="active" StatusDescription="Certificate is Active." Type="EssentialSSL Wildcard" IssuedOn="9/8/2022" Years="1" Expires="9/22/2023" ActivationExpireDate="" OrderId="1234567890" SANSCount="0">
            <CertificateDetails>
                <CSR>
                    <![CDATA[-----BEGIN CERTIFICATE REQUEST----- ... -----END CERTIFICATE REQUEST-----]]>
                </CSR>
                <ApproverEmail>CNAMECSRHASH</ApproverEmail>
                <CommonName>*.example.com</CommonName>
                <AdministratorEmail>example@example.com</AdministratorEmail>
                <Certificates CertificateReturned="true" ReturnType="INDIVIDUAL">
                    <Certificate>
                        <![CDATA[-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----]]>
                    </Certificate>
                    <CaCertificates>
                        <Certificate Type="INTERMEDIATE">
                            <Certificate>
                                <![CDATA[-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----]]>
                            </Certificate>
                        </Certificate>
                        <Certificate Type="INTERMEDIATE">
                            <Certificate>
                                <![CDATA[-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----]]>
                            </Certificate>
                        </Certificate>
                        <Certificate Type="INTERMEDIATE">
                            <Certificate>
                                <![CDATA[-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----]]>
                            </Certificate>
                        </Certificate>
                    </CaCertificates>
                </Certificates>
            </CertificateDetails>
            <Provider>
                <OrderID>1234567890</OrderID>
                <Name>COMODO</Name>
            </Provider>
        </SSLGetInfoResult>
    </CommandResponse>
    <Server>e4fee023b712</Server>
    <GMTTimeDifference>--5:00</GMTTimeDifference>
    <ExecutionTime>0.117</ExecutionTime>
</ApiResponse>

当前Ansible任务基线 #

- name: parse info response for cert chain
  community.general.xml:
    xmlstring: "{{ namecheap_info.content }}"
    namespaces:
      x: 'http://api.namecheap.com/xml.response'
    xpath: '/x:ApiResponse/x:CommandResponse/x:SSLGetInfoResult/x:CertificateDetails/x:Certificates/x:CaCertificates/x:Certificate/x:Certificate'
    content: text
  register: parsed_cert_chain

- ansible.builtin.set_fact:
    namecheap_cert_chain_content: "{{ parsed_cert_chain.matches | map(attribute='{http://api.namecheap.com/xml.response}Certificate') }}"

报错及无效尝试 #

运行任务时收到报错：The task includes an option with an undefined variable. The error was: 'dict object' has no attribute '{http://api'.，原因是URL中的点号被Jinja2当作属性访问分隔符。尝试过以下方法均无效：

• 用反斜杠转义点号：'dict object' has no attribute '{http://api\\'.
• 用双反斜杠转义点号：'dict object' has no attribute '{http://api\\\\'.
• 转义大括号：'dict object' has no attribute '\\{http://api'.
• 用方括号包裹属性名：dict object has no element ['{http://api.namecheap.com/xml.response}Certificate'].

解决方案 #

不需要对特殊字符进行转义，改用lambda函数结合字典索引语法访问带特殊字符的键，替代map(attribute=...)的写法：

- ansible.builtin.set_fact:
    namecheap_cert_chain_content: "{{ parsed_cert_chain.matches | map(lambda x: x['{http://api.namecheap.com/xml.response}Certificate']) | list }}"

原理说明 #

map(attribute='xxx')会将参数解析为属性访问路径，遇到点号会自动拆分，无法识别包含特殊字符的完整键名。而lambda函数中使用x['键名']的字典索引方式，会直接将整个字符串作为键去查找，完美适配带命名空间的特殊键名。

如果需要将证书链拼接为单个字符串，可追加join('\n')过滤器：

- ansible.builtin.set_fact:
    namecheap_cert_chain_content: "{{ parsed_cert_chain.matches | map(lambda x: x['{http://api.namecheap.com/xml.response}Certificate']) | list | join('\n') }}"

内容的提问来源于stack exchange，提问作者inventor96