Ansible with subelements referencing a dict

Bear with me, please. I've never had to do something this complex with Ansible and I'm really struggling to piece it together.

To sum it up, I already have a dict and a task to deploy our employee's SSH accounts and public keys to our servers. I would like to re-use this dict to also deploy certain employee keys to certain website user accounts. An example probably explains better than I can.

employee_ssh_users:
  user1: 'user1key'
  user2: 'user2key'
  user3: 'user3key'
  user4: 'user4key'

- name: Add employee SSH users
  user: 
    name: "{{ item.key }}"
    state: present
  with_dict: "{{ employee_ssh_users }}"

- name: Add employee public keys to employee accounts
  authorized_key:
    user: "{{ item.key }}"
    state: present
    key: "{{ item.value }}"
  with_dict: "{{ employee_ssh_users }}"

The above configuration and tasks work fine for adding our employees and their keys to the servers. Now, I want to re-use these keys so that I can add certain employees to certain other users without having to copy and paste the employee's keys. Here is what I'm trying to do:

website_keys:
  - name: site1
    authorized:
      - user1
      - user3
  - name: site2
    authorized:
      - user1
      - user2

- name: Add employee public keys to website accounts
  authorized_key:
    user: "{{ item.0.name }}"
    key: "{{ hostvars[inventory_hostname]['employee_ssh_users'][' + item.1 '] }}"
  with_subelements:
    - "{{ website_keys }}"
    - authorized

Basically, I can't figure out exactly what I need to do to interpolate the subelement into the key variable, if it's even possible at all.

回答1:

It's quite simple:

- name: Add employee public keys to website accounts
  authorized_key:
    user: "{{ item.0.name }}"
    key: "{{ employee_ssh_users[item.1] }}"
  with_subelements:
    - "{{ website_keys }}"
    - authorized

You can query employee_ssh_users by name and use item.1 without quotes, as it is a variable itself.

回答2:

What if it's possible for the authorized key to be absent? How do you check to execute the command only when authorized is available?