Ansible gcp_compute_instance模块无法为VM实例分配外部IP

核心问题1：网络接口配置缩进错误 #

在gcp_compute_instance模块中，access_configs被错误嵌套在subnetwork字典内部，导致GCP无法识别公网IP的配置规则。正确的层级应该是access_configs与subnetwork同级，同属于network_interfaces的子项。

核心问题2：预留IP变量引用错误 #

nat_ip字段需要传入的是预留IP的地址字符串，而非register返回的整个address对象。必须使用{{ address.address }}来提取实际的IP值。

修复后的完整代码 #

- name: Create Disk
  gcp_compute_disk:
    name: "{{app_name}}-disk"
    size_gb: 50
    source_image: "{{source_image}}"
    zone: "{{ gcp_zone }}"
    project: web-project
    auth_kind: "{{ gcp_cred_kind }}"
    state: present
  register: disk

- name: Reserve IP Address
  gcp_compute_address:
    name: "{{app_name}}-address"
    region: "{{region}}"
    project: vpc-project
    auth_kind: "{{ gcp_cred_kind }}"
    state: present
  register: address

- name: Create VM Instance
  gcp_compute_instance:
    name: "{{app_name}}-vm"
    machine_type: "{{instance_type}}"
    disks:
    - auto_delete: true
      boot: true
      source: "{{disk}}"
    network_interfaces:
    - subnetwork: "{{subnetwork}}"
      access_configs:
      - name: External NAT
        nat_ip: "{{ address.address }}"
        type: ONE_TO_ONE_NAT
    zone: "{{ gcp_zone }}"
    project: web-project
    auth_kind: "{{ gcp_cred_kind }}"
    state: present
  register: instance

额外验证项 #

• 确认subnetwork变量传入的是正确的共享VPC子网selfLink，格式示例：projects/vpc-project/regions/us-west1/subnetworks/your-subnet
• 检查web-project是否具备使用vpc-project中预留IP的权限：在vpc-project的IAM配置里，为web-project的服务账号添加Compute Network User角色
• 确保预留IP的区域（us-west1）与VM所在可用区（us-west1-b）属于同一区域

内容的提问来源于stack exchange，提问作者captain_booboo