如何将Ansible变量传递给PowerShell脚本？问题排查与替代方案

你的PowerShell脚本 #

#Map the client cert to the User
param
(
    # Parameter help description
    [Parameter(Mandatory=$True,Position=1)]
    [string]$username
)

New-Item -Path WSMan:\localhost\ClientCertificate `
    -Subject "$username@localhost" `
    -URI * `
    -Issuer D2D38EE665F0AE3C106367EFB `
    -Credential H123Ansible `
    -Force

你的Ansible任务 #

- name: PS script to configure WinRM Certificate Authentication
  ansible.windows.win_shell: "C:\\Temp\\cert_based_winrm_auth.ps1 -username {{ username }}"

常见错误原因及修正方案 #

1. 权限不足（最可能的原因）

修改WSMan配置需要管理员权限，你的Ansible任务未提升权限会导致New-Item执行失败。修正任务，添加权限提升逻辑：

- name: PS script to configure WinRM Certificate Authentication
  ansible.windows.win_shell: 'C:\Temp\cert_based_winrm_auth.ps1 -username "{{ username }}"'
  become: yes
  become_method: runas
  become_user: Administrator

• 用单引号包裹整个命令，避免PowerShell解析Ansible变量时出现异常；双引号包裹{{ username }}确保变量值正确传递。

2. 脚本路径验证

先确认脚本已存在于目标机器的C:\Temp目录，若未上传，添加复制任务：

- name: Copy PS script to target Windows machine
  ansible.windows.win_copy:
    src: ./cert_based_winrm_auth.ps1  # 本地脚本路径
    dest: C:\Temp\cert_based_winrm_auth.ps1

3. 直接在Ansible中嵌入PowerShell脚本（无需单独PS文件）

如果不想依赖外部脚本文件，可以用win_powershell模块直接嵌入代码，参数传递更可靠：

- name: Configure WinRM Certificate Authentication inline
  ansible.windows.win_powershell:
    script: |
      param
      (
          [Parameter(Mandatory=$True)]
          [string]$username
      )

      New-Item -Path WSMan:\localhost\ClientCertificate `
          -Subject "$username@localhost" `
          -URI * `
          -Issuer D2D38EE665F0AE3C106367EFB `
          -Credential H123Ansible `
          -Force
    parameters:
      username: "{{ username }}"
  become: yes
  become_method: runas
  become_user: Administrator

或者用win_shell简化写法：

- name: Configure WinRM Certificate Authentication via inline script
  ansible.windows.win_shell: |
    $targetUsername = "{{ username }}"
    New-Item -Path WSMan:\localhost\ClientCertificate `
        -Subject "$targetUsername@localhost" `
        -URI * `
        -Issuer D2D38EE665F0AE3C106367EFB `
        -Credential H123Ansible `
        -Force
  become: yes
  become_method: runas
  become_user: Administrator

4. 变量传递验证

如果不确定变量是否正确渲染，可以先添加debug任务确认：

- name: Debug username variable
  ansible.windows.win_debug:
    msg: "Username value is: {{ username }}"

内容的提问来源于stack exchange，提问作者Tiru