五十五.ansible概述、ansible基础、ad-hoc、批量配置管理

1.环境准备（自动化工具，批量操作）

6台 2cpu,1.5G以上内存，20G硬盘，1网卡

1.1 基础环境准备

1）启动6台虚拟机,ansible.sh

2）真机配置yum仓库

]# tar -xf ansible_soft.tar.xz

]# cd ansible_soft/

soft]# mkdir /var/ftp/ansible

soft]# cp * /var/ftp/ansible

soft]# createrepo /var/ftp/ansible

3）修改主机名（容易区分，6台机器都需要修改）这里以ansible主机为例子

]# echo ansible > /etc/hostname

]# hostname ansible

4）配置ip（6台机器都需要配置），这里以ansible主机为例子

]# vim /etc/sysconfig/network-scripts/ifcfg-eth0

# Generated by dracut initrd

DEVICE="eth0"

ONBOOT="yes"

IPV6INIT="no"

IPV4_FAILURE_FATAL="no"

NM_CONTROLLED="no"

TYPE="Ethernet"

BOOTPROTO="static"

IPADDR=192.168.1.51

PREFIX=24

GATEWAY=192.168.1.254

]# systemctl restart network

[root@localhost ~]# ifconfig

...inet 192.168.1.51...

5）配置yum客户端，在管理节点ansible上面配置

ansible ~]# vim /etc/yum.repos.d/local.repo

[local_repo]

name=CentOS-$releasever - Base

baseurl="ftp://192.168.1.254/system"

enabled=1

gpgcheck=1

[local]

name=local

baseurl="ftp://192.168.1.254/ansible"

enabled=1

gpgcheck=0

ansible ~]# yum clean all

ansible ~]# yum repolist

ansible ~]# yum -y install ansible

ansible ~]# ansible --version

ansible 2.4.2.0 //显示版本说明安装成功

6）请在6台主机上面配置/etc/hosts，这里以ansible主机为例子

ansible]# cat /etc/hosts

192.168.1.51 ansible

192.168.1.52 web1

192.168.1.53 web2

192.168.1.54 db1

192.168.1.55 db2

192.168.1.56 cache

2. 主机定义与分组

熟悉ansible配置文件

定义主机，分组和子组练习

自定义文件，多配置路径练习

2.1 ansible.cfg配置文件

ansible]# cd /etc/ansible/

ansible ansible]# ls

ansible.cfg hosts roles

ansible ansible]# vim ansible.cfg

//指定分组文件路径，主机的分组文件hosts

14 inventory = /etc/ansible/hosts

//ssh首次连接的时候，需要取消输入yes

61 host_key_checking = False

[selinux] //组名称，selinux的相关选项在这个下面配置

...

[colors] //组名称，colors的相关选项在这个下面配置

...

2.2 定义主机，分组和子组练习

1）静态主机的定义

ansible]# vim /etc/ansible/hosts

[web]

web1

web2

[db]

db[1:2]

[other]

cache

//1:2为db1到db2两台主机，1:20为db1到db20多台主机

ansible]# ansible web --list-host //显示web组的主机

hosts (2):

web1

web2

ansible]# ansible db --list-host

hosts (2):

db1

db2

ansible]# ansible other --list-host

hosts (1):

cache

[ansible]# ansible all --list-host //显示所有组的主机

hosts (5):

web1

web2

cache

db1

db2

2）直接测试

-m(module) ping(模块）

ansible]# ansible cache -m ping

//测试是否可以连接，若失败颜色为红色

cache | UNREACHABLE! => {

"changed": false,

"msg": "Failed to connect to the host via ssh: ssh: Could not resolve hostname cache: Name or service not known\r\n",

"unreachable": true

}

3）修改后测试

ansible]# vim /etc/ansible/hosts

[other]

cache ansible_ssh_user="root" ansible_ssh_pass="123456"

//cache虚拟机的用户名和密码

ansible]# ansible other -m ping //测试成功，颜色为绿色

cache | SUCCESS => {

"changed": false,

"ping": "pong"

}

ansible]# vim /etc/ansible/hosts

[web]

web1

web2

[web:vars] //web组:变量(vars不改)，web组的多台机器共用一个用户名和密码

ansible_ssh_user="root"

ansible_ssh_pass="123456"

ansible]# ansible web -m ping

web2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

2.3 定义子组（集合）

ansible]# vim /etc/ansible/hosts

//指定子分组(app可改:children不改)，web，db是提前分好的组

[app:children]

web

[app:vars]（vars 集合内所有成员的公共属性）

ansible_ssh_user="root"

ansible_ssh_pass="123456"

ansible]# ansible app --list-host //查看

hosts (4):

web1

web2

db1

db2

ansible]# ansible app -m ping //测试

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

web2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

2.4 多路径练习

自定义的ansible文件只在当前路径生效

1）多路径

ansible ~]# mkdir aaa

ansible ~]# cd aaa/

aaa]# vim myhost

[app1]

web1

db1

[app2]

web2

db2

[app:children]

app1

app2

[other]

cache

[app:vars]

ansible_ssh_user="root"

ansible_ssh_pass="123456"

aaa]# touch ansible.cfg

aaa]# grep -Ev "^#|^$" /etc/ansible/ansible.cfg

[defaults]

roles_path = /etc/ansible/roles:/usr/share/ansible/roles

host_key_checking = False

[inventory]

[privilege_escalation]

[paramiko_connection]

[ssh_connection]

[persistent_connection]

[accelerate]

[selinux]

[colors]

[diff]

aaa]# vim ansible.cfg

[defaults]

inventory = myhost

host_key_checking = False

2）测试结果

aaa]# ansible app1 -m ping

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

aaa]# ansible app -m ping

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

web2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

aaa]# ansible app --list-host

hosts (4):

web1

db1

web2

db2

aaa]# cd

ansible ~]# ansible app1 --list-host //切换到别的目录，测试失败

[WARNING]: Could not match supplied host pattern, ignoring: app1

[WARNING]: No hosts matched, nothing to do

hosts (0):

3.动态主机

3.1 脚本输出主机列表

ansible ~]# cd aaa

aaa]# ls

ansible.cfg myhost

aaa]# vim host.py

#!/usr/bin/python (这行也要!)

import json

hostlist = {} //定义主机列表

hostlist["bb"] = ["192.168.1.52", "192.168.1.53"]

hostlist["192.168.1.54"] = {

"ansible_ssh_user":"root","ansible_ssh_pass":"pwd"

}

hostlist["aa"] = {

"hosts" : ["192.168.1.55", "192.168.1.56"],

"vars" : {

"ansible_ssh_user":"root","ansible_ssh_pass":"pwd"

}

print(json.dumps(hostlist))

aaa]# chmod 755 ./host.py

2) 脚本输出样例（这样写输出的结果有些乱）

aaa]# ./host.py

{"aa": {"hosts": ["192.168.1.55", "192.168.1.56"], "vars": {"ansible_ssh_user": "root", "ansible_ssh_pass": "a"}}, "192.168.1.54": {"ansible_ssh_user": "root", "ansible_ssh_pass": "a"}, "bb": ["192.168.1.52", "192.168.1.53"]}

3) 可以用shell脚本输出

aaa]# vim my.sh

#!/bin/bash

echo '

{ "aa": {

"hosts":

["192.168.1.55", "192.168.1.56"],

"vars": {

"ansible_ssh_user": "root",

"ansible_ssh_pass": "123456"}

aaa]# chmod 755 my.sh

aaa]# ./my.sh

{ "aa": {

"hosts":

["192.168.1.55", "192.168.1.56"],

"vars": {

"ansible_ssh_user": "root",

"ansible_ssh_pass": "123456"}

}

aaa]# vim ansible.cfg

[defaults]

inventory = my.sh

host_key_checking = False

aaa]# ansible aa -m ping

192.168.1.55 | SUCCESS => {

"changed": false,

"ping": "pong"

}

192.168.1.56 | SUCCESS => {

"changed": false,

"ping": "pong"

}

3.2 批量执行

1）查看负载

aaa]# cd /etc/ansible

ansible]# ansible app -m command -a 'uptime'

web2 | SUCCESS | rc=0 >>

19:55:36 up 4:02, 2 users, load average: 0.00, 0.01, 0.01

db1 | SUCCESS | rc=0 >>

19:55:36 up 4:01, 2 users, load average: 0.00, 0.01, 0.02

web1 | SUCCESS | rc=0 >>

19:55:36 up 4:02, 2 users, load average: 0.00, 0.01, 0.01

db2 | SUCCESS | rc=0 >>

19:55:36 up 4:01, 2 users, load average: 0.00, 0.01, 0.03

2）查看时间

ansible]# ansible app -m command -a 'date +%F\ %T'

web1 | SUCCESS | rc=0 >>

2019-02-26 19:56:12

db1 | SUCCESS | rc=0 >>

2019-02-26 19:56:12

db2 | SUCCESS | rc=0 >>

2019-02-26 19:56:12

web2 | SUCCESS | rc=0 >>

2019-02-26 19:56:12

4.批量部署证书文件

创建一对密钥

给所有主机部署密钥

4.1 批量部署证书文件，给所有主机部署密钥

1）创建密钥

ansible]# cd /root/.ssh/

.ssh]# vim /etc/ansible/hosts

[web]

web1

web2

[db]

db[1:2]

[other]

cache

.ssh]# ansible all -m ping //直接ping会报错

.ssh]# ssh-keygen -t rsa -b 2048 -N '' //创建密钥

2）给所有主机部署密钥

.ssh]# ansible all -m authorized_key -a "user=root exclusive=true manage_dir=true key='$(< /root/.ssh/id_rsa.pub)'" -k

SSH password: //输入密码

.ssh]# ansible all -m ping //成功

web2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

db2 | SUCCESS => {

"changed": false,

"ping": "pong"

}

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

cache | SUCCESS => {

"changed": false,

"ping": "pong"

}

db1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

.ssh]# ssh web1

//不需要输入密码,可以直接登陆

5. 练习模块

练习使用command , shell , raw, script模块

5.1 练习模块

ansible-doc //模块的手册，相当于man

ansible-doc -l //列出所有模块

ansible-doc 模块名 //查看指定模块的帮助信息

1）ping模块

.ssh]# ansible web1 -m ping

web1 | SUCCESS => {

"changed": false,

"ping": "pong"

}

2）command模块

.ssh]# ansible web1 -m command -a 'chdir=/tmp touch f1'

//创建成功

web1 ~]# cd /tmp/

tmp]# ls //在web1上面查看

3）shell模块

.ssh]# ansible web1 -m shell -a 'chdir=/tmp touch f2' //创建成功

[root@web1 ~]# cd /tmp/

[root@web1 tmp]# ls //在web1上面查看

4）raw模块

.ssh]# ansible web1 -m raw -a 'chdir=/tmp touch f3'

//文件可以创建，但无法切换目录，文件在用户家目录下生成/root/

web1 ~]# ls //在web1上面查看

5）script模块

对于太复杂的命令，可以写个脚本，然后用script模块执行

在web1主机上创建zhangsan3用户，修改zhangsan3的密码为123456，设置zhangsan3第一次登陆必须修改密码

用命令写：(必须有zhangsan3这个用户）

.ssh]# ansible web1 -m shell -a 'echo 123456 | passwd --stdin zhangsan3'

.ssh]# ssh -l zhangsan3 web1

zhangsan3@web1's password: //输入zhangsan3的密码

web1 ~]$ whoami

zhangsan3

.ssh]# ansible web1 -m shell -a 'chage -d 0 zhangsan3'

(重置zhangsan3的密码）

.ssh]# ssh -l zhangsan3 web1

用脚本写，script模块执行：

[.ssh]# vim user.sh

#!/bin/bash

useradd zhangsan3

echo 123456 | passwd --stdin zhangsan3

chage -d 0 zhangsan3

echo

.ssh]# ansible web1 -m script -a './user.sh'

web1 | SUCCESS => {

"changed": true,

"rc": 0,

"stderr": "Shared connection to web1 closed.\r\n",

"stdout": "Changing password for user zhangsan3.\r\npasswd: all authentication tokens updated successfully.\r\n\r\n",

"stdout_lines": [

"Changing password for user zhangsan3.",

"passwd: all authentication tokens updated successfully.",

]

}

ansible .ssh]# ssh -l zhangsan3 web1

lisi@web1's password:

You are required to...(更改密码）

6. 模块练习

使用copy模块同步数据

使用lineinfile模块编辑文件

使用replace模块修改文件

6.1 模块练习

1）使用copy模块同步数据

src：要复制到进程主机的文件在本地的地址,可以是绝对路径,也可以是相对路径。如果路径是一个目录,它将递归复制。在这种情况下,如果路径使用"/"来结尾,则只复制目录里的内容,如果没有使用"/"来结尾,则包含目录在内的整个内容全部复制,类似于rsync

dest：必选项。进程主机的绝对路径,如果源文件是一个目录,那么该路径也必须是个目录

backup：在覆盖之前将原文件备份,备份文件包含时间信息。有两个选项:yes|no

force：如果目标主机包含该文件,但内容不同,如果设置为yes,则强制覆盖,如果为no,则只有当目标主机的目标位置不存在该文件时,才复制。默认为yes

.ssh]# ansible all -m shell -a 'cat /etc/resolv.conf'

//查看/etc/resolv.conf

db1 | SUCCESS | rc=0 >>