• 是否有任何方法可以循环pub文件并同时使用独占选项？*

没有。docs中有一个关于循环和互斥的注解：

**exclusive：**是否从authorized_keys文件中删除所有其他未指定的key。可以在一个key字符串值中指定多个key，用换行符分隔它们。该选项不支持循环，所以如果与_一起使用，它将在循环的每次迭代中是独占的，如果您希望文件中有多个key，则需要将它们全部传递给key，如上所述。

因此，您需要将所有密钥连接起来，并一次性发送所有密钥。
大概是这样的

- name: update SSH keys
  authorized_key:
    user: <user>
    key: "{{ lookup('pipe','cat ../files/pub_keys/*.pub') }}"
    state: present
    exclusive: yes

在生产环境中运行之前请检查此代码！

如果你想避免pipe查找（例如，因为路径不是相对于角色的），你也可以使用file和fileglob查找的组合：

- name: update SSH keys
  authorized_key:
    user: <user>
    key:  "{% for key in lookup('fileglob', 'pub_keys/*.pub').split(',') %}{{ lookup('file', key) ~ '\n'}}{% endfor %}"
    state: present
    exclusive: yes

如果你把你的用户放在一个变量中，你可以使用这个：

---

- hosts: all
  vars_files:
    - roles/users/vars/main.yml
  tasks:
    - name: Allow other users to login to the account
      authorized_key:
        user: user_name
        exclusive: yes
        key: "{{ developers|map(attribute='publish_ssh_key')|join('\n') }}"

roles/users/vars/main.yml看起来像这样：

---

developers:
  - name: user1
    publish_ssh_key: ssh-rsa AAAA...
  - name: user2
    publish_ssh_key: ssh-rsa AAAA...

正如我在另一个答案（Ansible -为多个用户和角色管理多个SSH密钥）中所写的那样，这是我解决这个问题的方法。
我将一个变量中的文件名数组传递给我的user-account角色，然后该角色获取每个文件的内容，将它们附加到一个换行符分隔的字符串中，最后将该值设置为新用户的ssh-key。
.
Playbook文件：

- hosts: aws-node1
  roles:
    - { role: user-account, username: 'developer1', ssh_public_keyfiles: ['peter-sshkey.pub', 'paul-sshkey.pub'] }

.
user-account的角色定义：

- name: add user
  user:
    name: "{{username}}"

- name: lookup ssh pubkeys from keyfiles and create ssh_pubkeys_list
  set_fact:
    ssh_pubkeys_list: "{{ lookup('file', item) }}"
  with_items:
    "{{ssh_public_keyfiles}}"
  register: ssh_pubkeys_results_list

- name: iterate over ssh_pubkeys_list and join into a string
  set_fact:
    ssh_pubkeys_string: "{{ ssh_pubkeys_results_list.results | map(attribute='ansible_facts.ssh_pubkeys_list') | list | join('\n') }}"

- name: update SSH authorized_keys for user {{ username }} with contents of ssh_pubkeys_string
  authorized_key:
    user: "{{ username }}"
    key: "{{ ssh_pubkeys_string }}"
    state: present
    exclusive: yes

与前面的答案相同的基本概念，但只使用变量并从github或gitlab等url中提取密钥。

#Vars
ssh_users:
  - user1
  - user2
ssh_key_urls: "{{ ssh_users | map('regex_replace', '^(.*)$', 'https://key_server/\\1.keys') | list }}"
authorized_keys: "{% for u in ssh_key_urls %}{{ lookup('url', u, split_lines=False) }}\n{% endfor %}"

#task
- name: setup authorized_keys
  authorized_key:
    key: "{{ authorized_keys }}"
    state: present
    exclusive: true

我创建了一个简单的剧本，在那里我需要icewrap用户的特定路径。

---

- name: configure icewarp user with proper keys and sudo rights
  hosts: all
  remote_user: root
# tasks file for iw_ssh_keys
  tasks:

  - name: Check that the /opt/icewarp/.ssh/authorized_keys exists
    stat:
      path: /opt/icewarp/.ssh/authorized_keys
    register: stat_result

  - name: Create the file, if /opt/icewarp/.ssh/authorized_keys doesnt exist already
    file:
       path: /opt/icewarp/.ssh/authorized_keys
       state: touch
       mode: '0600'
    when: not stat_result.stat.exists

  - name: Set authorized_keys, removing all undefined ones
    authorized_key:
      user: icewarp
      key: '{{ item }}'
      state: present
      path: /opt/icewarp/.ssh/authorized_keys 
      exclusive: True
    with_file:
      - ../public_keys/authorized_keys

  - name: change user shell to bash 
    become: yes
    user:
      name: icewarp
      shell: /bin/bash

  - name: Configuring /etc/sudoers.d/icewarp
    community.general.sudoers:
      name: icewarp
      state: present
      user: icewarp
      commands: /usr/bin/journalctl *, /usr/bin/less /var/log/*, /usr/bin/grep * /var/log*