Ansible 通过playbook根据主机运行不同的任务

我是ansible的新手，如果这是一个明显的问题，请温柔一点。我有一本手册，用于在安装后对CentOS系统进行初始配置/强化。我有3个不同的服务器组，它们的配置方式基本相同，配置文件只有几处不同。特别是，每组服务器需要获得自己独特的iptables配置。如何使用一个剧本将iptables1发送到主机组1，iptables2发送到主机组2，iptables3发送到主机组3，并且仍然在每台服务器上运行所有其他任务

---
 - name: Initial OS configuration
   hosts: all
   remote_user: myuser
   sudo: yes
   tasks:
    - name: Deploy sshd_config
      copy: src=/opt/ansible/files/sshd_config dest=/etc/ssh/sshd_config owner=root group=root mode=600
      register: sshd

    - name: Restart sshd service
      service: name=sshd state=restarted
      when: sshd.changed

    # HELP HERE
    - name: Deploy iptables
      copy: src=/opt/ansible/files/iptables1 dest=/etc/sysconfig/iptables owner=root group=root mode=600
      register: iptables

    - name: Restart iptables service
      service: name=iptables state=restarted
      when: iptables.changed

    - name: Set bash history timestamp
      copy: src=/opt/ansible/files/history.sh dest=/etc/profile.d/history.sh mode=644 owner=root group=root

    - name: Install screen
      yum: name=screen state=latest

---

一种方法是在库存中使用变量：

[group1:vars]
iptable_path=/opt/ansible/files/iptables1

[group2:vars]
iptable_path=/opt/ansible/files/iptables2

[group3:vars]
iptable_path=/opt/ansible/files/iptables3

然后，在剧本中：

...
- name: Deploy iptables
  copy: src={{ iptable_path }} dest=/etc/sysconfig/iptables owner=root group=root mode=600
  register: iptables
...

---

下面是我使用0xFC的“组名称”建议得出的结论：

---
 - name: Initial OS configuration
   hosts: all
   remote_user: myuser
   sudo: yes
   tasks:

    ...

    - name: Deploy iptables to group1
      copy: src=/opt/ansible/files/iptables1 dest=/etc/sysconfig/iptables owner=root group=root mode=600
      register: iptables
      when: "'group1' in group_names"

    - name: Deploy iptables to group2
      copy: src=/opt/ansible/files/iptables2 dest=/etc/sysconfig/iptables owner=root group=root mode=600
      register: iptables
      when: "'group2' in group_names"

    - name: Deploy iptables to group3
      copy: src=/opt/ansible/files/iptables3 dest=/etc/sysconfig/iptables owner=root group=root mode=600
      register: iptables
      when: "'group3' in group_names"

    - name: Restart iptables service
      service: name=iptables state=restarted
      when: iptables.changed

    ...

---

有没有办法从ansible变量访问组名？似乎没有变量引用“当前”组。最接近的是“组名称”，列出当前主机所属的所有组。谢谢你的贡献，我一直在找这个。