在 RHEL7.6 上使用 ansible 2.9 我正在尝试配置单个防火墙区域，其中还包括丰富规则的配置。一切正常，除非我尝试在模板中添加丰富规则。在下面的示例中，我尝试添加允许 VRRP 流量的丰富规则。
Ansible 任务：
- name: Configure firewalld zones
template:
src: zone_template.xml.j2
dest: /etc/firewalld/zones/{{ item.name }}.xml
with_items: "{{ firewalld_zones }}"
notify: reload firewalld
loop_control:
label: "{{ item.name }}"
该变量firewalld_zones在我的 defaults/main.yml 中定义如下：
firewalld_zones:
- name: public
short: "Public"
description: "Public Zone"
port:
- { port: 300, protocol: tcp }
- { port: 300, protocol: udp }
rule:
- protocol:
- value: "vrrp"
- action: accept
我的模板片段zone_template.xml.j2：
<?xml version="1.0" encoding="utf-8"?>
<zone{% if item.target is defined %} target="{{ item.target }}"{% endif %}>
<short>{{ item.short|default(item.name)|upper }}</short>
{% if item.description is defined %}
<description>{{ item.description }}</description>
{% endif %}
{% for tag in item %}
{# Settings which can be used several times #}
{% if tag in ['interface','source','service','port','protocol','icmp-block','forward-port','source-port'] %}
{% for subtag in item[tag] %}
<{{ tag }}{% for name,value in subtag.items() %} {{ name }}="{{ value }}"{% endfor %}/>
{% endfor %}
{# Settings which can be used once #}
{% elif tag in ['icmp-block-inversion','masquerade'] and item[tag] == True %}
<{{ tag }}/>
{% endif %}
{% endfor %}
{% for rule in item.rule|default([]) %}
<rule{% if rule.family is defined %} family="{{ rule.family }}"{% endif %}>
{% for tag in rule %}
{% if tag in ['source','destination','service','port','icmp-block','icmp-type','masquerade','forward-port','protocol'] %}
{% for subtag in rule[tag] %}
{% if subtag in ['action'] %}
<{% for name,value in subtag.items() %}{{ name }}{% endfor %}/>
{% endif %}
<{{ tag }}{% for name,value in subtag.items() %} {{ name }}="{{ value }}"{% endfor %}/>
{% endfor %}
{% endif %}
</rule>
{% endfor %}
{% endfor %}
</zone>
有了这个，我得到：
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>PUBLIC</short>
<description>Public Zone</description>
<port protocol="tcp" port="300"/>
<port protocol="udp" port="300"/>
<rule>
<protocol value="vrrp"/>
<protocol action="accept"/>
</rule>
</zone>
我想要得到的是：
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>PUBLIC</short>
<description>Public Zone</description>
<port protocol="tcp" port="300"/>
<port protocol="udp" port="300"/>
<rule>
<protocol value="vrrp"/>
<accept/>
</rule>
</zone>
我需要改变什么（模板和/或变量）来实现这一点？
谢谢！Ĵ
