标签：入门教程 ansible 192.168 cat nfs1 state Ansible nfs

1、环境准备

1.1、准备主机

这里使用3台主机做为演示

# IP地址：192.168.10.15 【控制机】
hostnamectl set-hostname ansible-control

# IP地址：192.168.10.14
hostnamectl set-hostname nfs1

# IP地址：192.168.10.13
hostnamectl set-hostname web1

1.2、时间同步服务端

# 安装软件包
yum install chrony -y

# 修改如下配置
vi /etc/chrony.conf 
makestep 10 -1
allow
local stratum 10

systemctl enable chronyd
systemctl start chronyd

# 带星表示同步成功
chronyc sources -v

# 查看是否同步成功
[root@k8s-master ~]# timedatectl 
      Local time: Tue 2023-01-03 13:40:23 CST
  Universal time: Tue 2023-01-03 05:40:23 UTC
        RTC time: Tue 2023-01-03 05:40:23
       Time zone: Asia/Shanghai (CST, +0800)
     NTP enabled: yes
NTP synchronized: yes
 RTC in local TZ: no
      DST active: n/a

1.3、安装python

1.3.1、下载软件

https://www.python.org/ftp/python/3.10.10/Python-3.10.10.tgz

1.3.2、安装依赖包

yum install gcc gcc-c++ glibc-devel glibc zlib-devel zlib sqlite-devel readline-devel bzip2-devel libffi-devel -y

1.3.3、安装openssl-3.0.8【根据python版本选择】

# 下载openssl
wget --no-check-certificate https://www.openssl.org/source/openssl-3.0.8.tar.gz

# 安装perl和所需要的模板块
yum install perl perl-CPAN -y

# 进入perl环境
perl -MCPAN -e shell

# 往perl安装此模板
cpan[1]> install IPC/Cmd.pm


# 解压安装
tar xvf openssl-3.0.8.tar.gz && cd openssl-3.0.8 &&  ./config --prefix=/usr/local/openssl-3.0.8 && make && make install

1.3.4、安装openssl-1.1.1【此python版本使用这教程】

# 下载openssl
wget --no-check-certificate https://www.openssl.org/source/openssl-1.1.1t.tar.gz 

# 安装perl和所需要的模板块
yum install perl

# 解压安装
wget --no-check-certificate https://www.openssl.org/source/openssl-1.1.1t.tar.gz && ./config --prefix=/usr/local/openssl-1.1.1 && make && make install

# 创建软链接，方便管理
ln -s /usr/local/openssl-1.1.1 /usr/local/openssl

# 增加动态链接库
echo " /usr/local/openssl/lib" >>/etc/ld.so.conf
ldconfig -v

# 更换openssl
mv /usr/bin/openssl /usr/bin/openssl.old
ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl

1.3.5、安装Python软件

tar xvf Python-3.10.10.tgz && cd Python-3.10.10 && ./configure --prefix=/usr/local/Python-3.10.10 --with-openssl=/usr/local/openssl  && make && make install

注意事项：
    Python2 在编译安装时，可以通过参数 --enable-unicode=ucs2 或 --enable-unicode=ucs4，分别用于指定使用2个字节，4个字节表示一个unicode字符。
    Python3 无需进行选择，默认使用ucs4。

# 查看当前Python中表示unicode字符串时占用的空间
import sys
print(sys.maxunicode)
#如果值是 65535 ,表示使用ucs4标准，即：2个字节表示
#如果值是 1114111 ,表示使用ucs4标准，即：4个字节表示

1.3.6、配置Python动态链接库

cat >/etc/ld.so.conf.d/Python-3.10.10.conf <<'EOF'
/usr/local/Python-3.10.10/lib/
EOF
ldconfig

1.3.7、配置环境变量

ln -s /usr/local/Python-3.10.10/bin/python3 /usr/bin/python3
ln -s /usr/local/Python-3.10.10/bin/pip3 /usr/bin/pip3

1.4、安装ansible

1.4.1、安装

# 创建副本
python3 -m venv ansible-env

# 加载该环境
source ansible-env/bin/activate

# 安装ansible
python3 -m pip install --upgrade pip
python3 -m pip install ansible

# 检查安装的版本
[root@ansible-control bin]# pip list
Package Version
------------ -------
ansible 7.2.0
ansible-core 2.14.2
cffi 1.15.1
cryptography 39.0.1
Jinja2 3.1.2
MarkupSafe 2.1.2
packaging 23.0
pip 23.0.1
pycparser 2.21
PyYAML 6.0
resolvelib 0.8.1

1.4.2、创建配置目录、配置主机组

# 创建配置文件目录
mkdir /etc/ansible/

# 使用密码登陆
cat > /etc/ansible/hosts << 'EOF'
[web1]
192.168.10.13 ansible_ssh_user=root ansible_ssh_pass='root1234'
[nfs1]
192.168.10.14 ansible_ssh_user=root ansible_ssh_pass='root1234'
EOF

1.4.3、检查是否加载配置成功

(ansible-env) [root@ansible-control ~]# ansible all --list-hosts
  hosts (2):
    192.168.10.13
    192.168.10.14

1.4.4、ping所有主机是否是通

yum install sshpass -y

 (ansible-env) [root@ansible-control ~]# ansible all -m ping
192.168.10.14 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
192.168.10.13 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

1.4.5、ansible常用命令参数

[root@ansible-control ~]# ansible --version
ansible [core 2.14.2]
  # 配置文件位置
  config file = /etc/ansible/ansible.cfg
  # 模板搜索位置
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Python-3.10.10/ansible-env/lib/python3.10/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/Python-3.10.10/ansible-env/bin/ansible
  python version = 3.10.10 (main, Feb 19 2023, 21:10:13) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)] (/usr/local/Python-3.10.10/ansible-env/bin/python3)
  jinja version = 3.1.2
  libyaml = True


# 常用的命令
[root@ansible-control ~]# ansible --help
# 模板参数
#使用的模块参数，模块的具体动作参数
-a MODULE_ARGS, --args MODULE_ARGS
                    The action's options in space separated k=v format: -a
                    'opt1=val1 opt2=val2' or a json string: -a '{"opt1": "val1",
                    "opt2": "val2"}'

#提示输入ssh密码，而不使用基于ssh的密钥认证#模拟执行测试，但不会真的执行
-k, --ask-pass        ask for connection password

# 指定主机清单文件
-i INVENTORY
                    
# 模拟执行测试
-C, --check     don't make any changes; instead, try to predict some of the changes that may occur    

# 模板名字    (default=command)                    
-m MODULE_NAME, --module-name MODULE_NAME
                    
#执行命令的超时
-T TIMEOUT, --timeout TIMEOUT

#显示详细信息
-v, --verbose       包含插件日志 -vvvvvv.
                    正常日志 -vvv
                    debug -vvvv

1.4.6、普通用户需要配置提权的方法

# 普通用户需要配置提权的方法
[root@ansible-control ~]# cat /etc/ansible/ansible.cfg 
[privilege_escalation]
become_ask_pass=False
become_method=sudo
become_user=root

1.4.7、配置子组

[root@ansible-control ~]# cat /etc/ansible/hosts 
[web1]
192.168.10.13

[nfs1]
192.168.10.14

[webnfs:children]
web1
nfs1

2、ansible认证方式

# 关闭key检查
cat >> /etc/ansible/ansible.cfg << 'EOF'
[defaults]
# (boolean) Set this to "False" if you want to avoid host key checking by the underlying tools Ansible uses to connect to the host
host_key_checking=False
EOF

2.1、基于主机密码认证

2.1.2、配置方法

# 旧版本配置
ansible_ssh_user
ansible_ssh_pass
ansible_ssh_port

# 旧版本配置
ansible_user
ansible_password
ansible_port

# 新版兼容旧版的配置，配置如下：

cat >/etc/ansible/hosts <<'EOF' 
[web1]
192.168.10.13 ansible_ssh_user=root ansible_ssh_pass='root1234' ansible_ssh_port=22

[nfs1]
192.168.10.14 ansible_user=root ansible_password='root1234' ansible_port=22
EOF

2.1.2、测试验证

(ansible-env) [root@ansible-control ~]# ansible all -m ping
192.168.10.14 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
192.168.10.13 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

2.2、基于公密钥-免密认证

2.2.1、配置方法

[root@ansible-control ~]# cat /etc/ansible/hosts
[web1]
192.168.10.13

[nfs1]
192.168.10.14

2.2.2、配置免密登陆

# 在ansible控制主机创建的密钥文件
[root@ansible-control ~]# ssh-keygen -t rsa -b 2048

# 将公钥复制到免密登陆的主机节点
[root@ansible-control ~]# ssh-copy-id [email protected]
# 需要输入登陆密码

[root@ansible-control ~]# ssh-copy-id [email protected]
# 需要输入登陆密码

2.2.3、测试验证

(ansible-env) [root@ansible-control ~]# ansible all -m ping
192.168.10.14 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
192.168.10.13 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

3、Ansible查询帮忙

3.1、查询模板使用方法

[root@ansible-control ~]# ansible-doc -s ping
- name: Try to connect to host, verify a usable python and return `pong' on success
  ping:
      data:                  # Data to return for the `ping' return value. If this parameter is set to `crash', the module will cause an exception.

3.2、查询所有模板

[root@ansible-control ~]# ansible-doc -l
amazon.aws.autoscaling_group                                                                    Create or delete AWS AutoScaling Groups (ASGs)                                         
amazon.aws.autoscaling_group_info                                                               Gather information about EC2 Auto Scaling Groups (ASGs) in AWS                         
amazon.aws.aws_az_info                                                                          Gather information about availability zones in AWS   
...

4、模块

4.1、command

此模块是不支持管道符过滤，一般使用shell模块

4.1.1、给远程主机创建文件、查看、删除

# 创建文件
[root@ansible-control ~]# ansible nfs1 -m command -a 'touch /root/test.txt'
192.168.10.14 | CHANGED | rc=0 >>

# 查看是否创建成功
[root@ansible-control ~]# ansible nfs1 -m command -a 'ls -l /root'
192.168.10.14 | CHANGED | rc=0 >>
-rw-r--r-- 1 root root 0 Feb 23 11:46 test.txt

# 删除文件
[root@ansible-control ~]# ansible nfs1 -m command -a 'rm -f /root/test.txt'
192.168.10.14 | CHANGED | rc=0 >>

# 查看是否删除成功
[root@ansible-control ~]# ansible nfs1 -m command -a 'ls -l /root'
192.168.10.14 | CHANGED | rc=0 >>
total 0

4.2、shell

支持复杂语法，如管道符、过滤等

4.2.1、查ens33网卡的子网掩码信息

[root@ansible-control ~]# ansible nfs1 -m shell -a "ifconfig ens33 | grep netmask"
192.168.10.14 | CHANGED | rc=0 >>
        inet 192.168.10.14  netmask 255.255.255.0  broadcast 192.168.10.255

4.3、script

4.3.1、调用nfs1组安装wget脚本

mkdir /opt/script

cat > /opt/script/install_wget.sh <<'EOF'
#!/bin/bash
yum install wget -y
EOF

# 把控制机的脚本，发往被控制主机运行脚本
ansible nfs1 -m script -a '/opt/script/install_wget.sh'

4.4、yum

4.4.1、参数介绍

name=              # rpm名字
state=             # 安装(`present' or `installed', `latest'), 删除 (`absent' or `removed')
enablerepo=        # 指定仓库安装
disablerepo=       # 禁用指定仓库安装
list=              # 查询rpm包信息
download_only=true # 仅下载软件包，不安装
exclude            # 排除安装的包

4.4.2、安装

ansible web1 -m yum -a 'name=wget state=present'

4.4.3、安装rpm包

ansible web1 -m yum -a 'name=https://repo.zabbix.com/zabbix/6.2/rhel/7/x86_64/zabbix-agent2-6.2.1-1.el7.x86_64.rpm state=installed'

4.4.4、更新

ansible web1 -m yum -a 'name=wget state=latest'

4.4.5、删除

ansible web1 -m yum -a 'name=wget state=removed'

4.4.6、查询

ansible web1 -m yum -a 'list=wget'

4.4.7、指定仓库安装

ansible web1 -m yum -a 'name=epel-release state=installed'
ansible web1 -m yum -a "list=ansible enablerepo=epel"

4.5、copy

4.5.1、参数介绍

src     # 推送数据的源文件信息
dest    # 推送数据的目标路径
backup  # 对推送传输过去的文件，进行备份
content # 直接批量在被管理端文件中添加内容
group   # 将本地文件推送到远端,指定文件属组信息
owner   # 将本地文件推送到远端，指定文件属主信息
mode    # 将本地文件推送到远端，指定文件权限信息

4.5.2、复制文件

ansible nfs1 -m copy -a "src=/etc/hosts dest=/tmp/test.txt"

4.5.3、复制文件并且备份

# 如果文件内容变化则，备份文件
ansible nfs1 -m copy -a "src=/etc/hosts dest=/tmp/test.txt backup=yes"

4.5.4、content内容写入硬盘

ansible nfs1 -m copy -a "content=hello dest=/tmp/test.txt"

4.5.5、复制文件并且设置权限

 ansible nfs1 -m copy -a "src=/etc/hosts dest=/tmp/test.txt owner=nobody group=nobody mode=600"

4.6、file

4.6.1、参数介绍

path    # 文件路径
state   # 删除"absent"、目录"directory"、文件"file"、硬链接"hard"、软链接"link"、创建文件"touch"
owner   # 所属者
recurse # 递归操作 state=directory
group   # 组
mode    # 权

4.6.2、创建目录

ansible nfs1 -m file -a "path=/tmp/1/2/3 state=directory"

4.6.3、创建文件

ansible nfs1 -m file -a "path=/tmp/touch.txt state=touch"

4.6.4、创建目录并且修改权限

# 注意：如目录存在，则只修改权限

# 只修改目录权限，不会修改目录里面文件的权限
ansible nfs1 -m file -a "path=/tmp/nfs/ state=directory owner=nobody"

# 目录权限以及目录所有文件的权限
ansible nfs1 -m file -a "path=/tmp/nfs/ state=directory owner=nobody recurse=true"

4.7、get_url

4.7.1、参数介绍

作用：下载HTTP, HTTPS, FTP的文件

url      # 下载地址
dest     # 保存的位置
checksum # md5校验

4.7.2、下载文件

ansible nfs1 -m get_url -a "url=https://repo.zabbix.com/zabbix/6.2/rhel/7/x86_64/zabbix-release-6.2-3.el7.noarch.rpm dest=/tmp validate_certs=false"

4.8、yum_repository

4.8.1、参数介绍

作用：配置yum仓库
name          # yum源名字
baseurl       # yum的地址
file          # 指定yum配置文件的路径和名称。
enable yes/no # 是否开启yum源
state         # absent(删除)/present(安装，默认)

4.8.2、给控制主机配置zabbix源

ansible nfs1 -m yum_repository -a 'name=zabbix description="php repo" baseurl=http://repo.zabbix.com/zabbix/3.2/rhel/7/x86_64/ enabled=yes state=present'

4.9、service

4.9.1、参数介绍

作用：管理服务的启动与停止，开机自启动

name          # 服务名字
state
    started   # 启动服务
    stopped   # 停止服务
    restarted # 重启服务
    reloaded  # 重新加载服务
enabled       # 开机自启动

4.9.2、启动&开启开机自启动

ansible nfs1 -m service -a 'name=crond state=started enabled=yes

4.9.3、停止&关闭开机自启动

ansible nfs1 -m service -a 'name=crond state=stopped enabled=no'

4.9.4、重启

ansible nfs1 -m service -a 'name=crond state=restarted'

4.9.5、重新加载

ansible nfs1 -m service -a 'name=crond state=reloaded'

4.10、group

4.10.1、参数介绍

作用：创建系统的组

name # 指定创建的组名
gid # 指定组的gid
state
absent # 删除远端的主机的组
present # 创建远端的主机的组

4.10.2、创建组

ansible nfs1 -m group -a 'name=nfs gid=1200'

4.11、user

4.11.1、参数介绍

创建用户

uid         # 指定用户ID
group       # 指定用户组的名称
groups      # 指定用户组的名移，可以指定多个
password    # 用户的密码（记得单引号括起来)
shell       # 指定用户的登陆shell
create_home # 是否创建家目录

4.11.2、创建nfs用户指定组并且不创建家目录

ansible nfs1 -m user -a 'name=nfs uid=1200 group=1200 shell=/sbin/nologin create_home=no'

4.11.3、删除nfs用户

ansible nfs1 -m user -a 'name=nfs state=absent'

4.11.4、创建用户并且生成密钥对

ansible nfs1 -m user -a 'name=nfs uid=1200 group=nfs generate_ssh_key=yes ssh_key_bits=2048 ssh_key_file=.ssh/id_rsa'

4.11.5、创建用户并且设置密码

# 设置密码
[root@ansible-control ~]# ansible localhost -m debug -a "msg={{ '123456' | password_hash('md5','salt') }}"
[DEPRECATION WARNING]: Encryption using the Python crypt module is deprecated. The Python crypt module is deprecated and will be removed from Python 3.13. Install 
the passlib library for continued encryption functionality. This feature will be removed in version 2.17. Deprecation warnings can be disabled by setting 
deprecation_warnings=False in ansible.cfg.
localhost | SUCCESS => {
    "msg": "$1$salt$638tR8bROOvPnPklDQ9Vf/"
}

# 创建用户
ansible nfs1 -m user -a 'name=nfs password="$1$salt$638tR8bROOvPnPklDQ9Vf/" shell=/bin/bash create_home=yes shell=/bin/bash'

4.12、cron

4.12.1、参数介绍

name    # 任务名字
state   # [删除 absent, 增加 present]
job     # 命令
minute  # 分钟
hour    # 小时
day     # 每天
month   # 月
weekday # 每周几

disabled # 禁用定时任务

# 安装ntpdate工具，定时同步时间，用于演示
ansible nfs1 -m yum -a 'name=ntpdate state=present'

4.12.2、增加定时任务

ansible nfs1 -m cron -a 'name=time ntpdate sync state=present minute=*/1 job=/usr/sbin/ntpdate ntp5.aliyun.com  2>&1 > /dev/null"

[root@ansible-control ~]# ansible nfs1 -m command -a 'crontab -l'
192.168.10.14 | CHANGED | rc=0 >>
#Ansible: time ntpdate sync
*/1 * * * * /usr/sbin/ntpdate ntp5.aliyun.com  2>&1 > /dev/null

4.12.3、删除定时任务

ansible nfs1 -m cron -a "name='time ntpdate sync' state=absent"

4.12.4、注释定时任务

ansible nfs1 -m cron -a "name='time ntpdate sync' disabled=yes minute=*/1 job='/usr/sbin/ntpdate ntp5.aliyun.com  2>&1 > /dev/null'"

(ansible-env) [root@ansible-control ~]# ansible nfs1 -m command -a 'crontab -l'
192.168.10.14 | CHANGED | rc=0 >>
#Ansible: time ntpdate sync
#*/1 * * * * /usr/sbin/ntpdate ntp5.aliyun.com  2>&1 > /dev/null

4.13、mount

4.13.1、参数介绍

作用：挂载硬盘，支持设置开机自动挂的功能

src       # 挂载哪个硬盘
path      # 挂载路径
fstype    # 文件系统类型

state
present   # 开机挂载,仅将挂载配置写入/etc/fstab
mounted   # 挂载设备，并将配置写入/etc/fstab
unmounted # 卸裁设备，不会清除/etc/fstab写入的配置
absent    # 卸载设备,会清理/etc/fstab写入的配置

4.13.2、挂载nfs的实践

# 安装nfs服务
ansible nfs1 -m yum -a 'name=nfs-utils state=present'

# 创建共享的目录
ansible nfs1 -m file -a 'path=/data state=directory'

# 配置共享的目录
ansible nfs1 -m copy -a 'content="/data 192.168.10.0/24(rw,sync,no_all_squash)" dest=/etc/exports'

# 启动nfs服务【两个命令都是一样作用，选择其一即可】
ansible nfs1 -m systemd -a 'name=nfs state=started enabled=yes'
ansible nfs1 -m service -a 'name=nfs state=started enabled=yes'

# 将nfs挂载至web服务器上
ansible web1 -m mount -a 'src=192.168.10.14:/data path=/data fstype=nfs state=mounted'

# 卸载nfs,不会删除开机自启动
ansible web1 -m mount -a 'src=192.168.10.14:/data path=/data fstype=nfs state=unmounted'

# 完整卸载nfs
ansible web1 -m mount -a 'src=192.168.10.14:/data path=/data fstype=nfs state=absent'

4.14、firewalld

4.14.1、参数介绍

作用：firewalld防火墙的配置

service    # 指定开放或关闭的服务名称
port       # 指定开放或关闭的端口
masquerade # 开启地址伪装
immediate  # 临时生效
permanent  # 是否添加永久生效
state      # 开启或是关闭
zone       # 指定配置某个区域
rich_rule  # 配置富规则
source     # 指定来源IP

4.14.2、放行指定的端口与服务

# 开启firewalld服务
ansible web1 -m systemd -a 'name=firewalld state=started'

# 放行http服务
ansible web1 -m firewalld  -a 'service=http immediate=yes permanent=yes state=enabled'

# 放行8080-8090的端口
ansible web1 -m firewalld -a 'port=8080-8090/tcp immediate=yes permanent=yes state=enabled'

4.15、selinux

4.15.1、开启

ansible web1 -m selinux -a 'state=enforcing'

4.15.2、关闭

ansible web1 -m selinux -a 'state=disabled'

4.16、iptables

4.16.1、安装iptables

# 安装iptables
systemctl disable firewalld
systemctl stop firewalld

yum install iptables-services
systemctl start iptables

4.16.2、放行80端口的配置

[root@ansible-control ~]# ansible web1 -m iptables -a 'action=insert table=filter chain=INPUT protocol=tcp source=192.168.10.0/24  destination_port=80 jump=ACCEPT state=present'
192.168.10.13 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "chain": "INPUT",
    "chain_management": false,
    "changed": true,
    "flush": false,
    "ip_version": "ipv4",
    "rule": "-p tcp -s 192.168.10.0/24 -j ACCEPT --destination-port 80",
    "state": "present",
    "table": "filter"
}

# 增加
state=present

# 删除
state=absent

# 插入规则
action=insert

# 追加规则
action=append

4.14.17、实践安装nginx

# 1、配置nginx yum源
ansible web1 -m yum_repository -a 'name=nginx description="nginx repo" baseurl=http://nginx.org/packages/centos/7/x86_64/ enabled=no gpgkey=https://nginx.org/keys/nginx_signing.key gpgcheck=true state=present'

# 2、安装nginx
ansible web1 -m yum -a 'name=nginx state=present enablerepo=nginx'

# 3、修改html内容 
ansible web1 -m copy -a 'content="hello test nginx" dest=/usr/share/nginx/html/index.html backup=yes'

# 4、启动nginx服务
ansible web1 -m systemd -a 'name=nginx state=started enabled=yes'

# 5、放开80端口
ansible web1 -m iptables -a 'action=insert table=filter chain=INPUT protocol=tcp source=192.168.10.0/24  destination_port=80 jump=ACCEPT state=present'

5、ansible-playbook

5.1、playbook入门语法介绍

5.1.1、yaml语法的介绍

缩进：YAML使用固定的缩进风格表示层级结构,每个缩进由两个空格组成,不能使用tabs
冒号：以冒号结尾的除外，其他所有冒号后面所有必须有空格。
短横线：表示列表项，使用一个短横杠加一个空格。多个项使用同样的缩进级别作为同一列表。

5.1.2、playbook常用关键字的介绍

host             # 对哪些主机进行操作
remote_user      # 我要使用什么用户执行
tasks            # 具体执行什么任务

5.2、playbook入门示例

5.2.1、查询所有主机名

# 1、Ad-hoc[点对点模板]的语法
ansible all -m command -a 'hostname'

# 2、创建存放playbook的文件目录
mkdir /opt/playbook && cd /opt/playbook

# 3、编写playbook
cat > query_hostname.yaml <<'EOF' 
---
- name: query all hostname
  hosts: all
  remote_user: root

  tasks:
  - name: execute hostname commond
    command: hostname
EOF

# 4、检查playbook语法是否正确
ansible-playbook query_hostname.yaml -C

5.2.2、创建一个文件的示例

# 1、Ad-hoc[点对点模板]的语法
ansible all -m file -a 'name=/tmp/test_all.txt state=touch'

# 2、创建一个文件的playbook
cat > create_file.yaml << 'EOF'
---
- name: touch file
  hosts: all
  remote_user: root
  vars:
    file_name: cyc_test

  tasks:
  - name: exe file mod
    file: name=/tmp/{{file_name}} state=touch
EOF

# 3、执行或调试测试
ansible-playbook create_file.yaml -C
ansible-playbook create_file.yaml

5.3、nfs-playbook实践

5.3.1、安装nfs

# 创建nfs配置文件
cat > exports.0225 <<'EOF'
/data 192.168.10.0/24(rw,sync,no_all_squash)
EOF

# 编写安装nfs的playbook
cat > nfs_install.yaml <<'EOF' 
---
- name: install nfs package
  hosts: nfs1,web1
  remote_user: root

  tasks:
  - name: install nfs server
    yum: name=nfs-utils,rpcbind state=installed

- name: configure nfs server
  hosts: nfs1
  remote_user: root

  tasks:
  - name: configure nfs1
    copy: src=./exports.0225 dest=/etc/exports

  - name: create share directory
    file: path=/data state=directory owner=nfsnobody group=nfsnobody recurse=yes

  - name: start rpcbind server
    systemd: name=rpcbind state=started enabled=yes

  - name: start nfs server
    systemd: name=nfs state=started enabled=yes

- name: mount nfs dir
  hosts: nfs1,web1
  remote_user: root

  tasks:
  - name: mount dir
    mount: src=192.168.10.14:/data path=/mnt/nfs_data fstype=nfs state=mounted
EOF

# 查看是否挂载成功
[root@ansible-control playbook]# ansible all -m command -a 'tail -1 /etc/fstab'
192.168.10.14 | CHANGED | rc=0 >>
192.168.10.14:/data /mnt/nfs_data nfs defaults 0 0
192.168.10.13 | CHANGED | rc=0 >>
192.168.10.14:/data /mnt/nfs_data nfs defaults 0 0

5.3.2、卸载nfs

cat > nfs_uninstall.yaml <<'EOF'
---
- name: unmount nfs dir
  hosts: nfs1,web1
  remote_user: root
  tasks:
  - name: unmount dir
    mount: src=192.168.10.14:/data path=/mnt/nfs_data fstype=nfs state=absent

- name: configure nfs server
  hosts: nfs1
  remote_user: root

  tasks:
  - name: delete exports
    file: path=/etc/exports state=absent

  - name: delete directory
    file: path=/data state=absent

  - name: stop nfs server
    systemd: name=nfs state=stopped enabled=no

  - name: stop rpcbind server
    systemd: name=rpcbind state=stopped enabled=no

- name: uninstall nfs package
  hosts: nfs1,web1
  remote_user: root

  tasks:
  - name: uninstall nfs server
    yum: name=nfs-utils,rpcbind state=absent
EOF

5.3.3、安装nfs【notify、handler】

cat > nfs_notify_install.ymal << 'EOF' 
---
- name: install nfs package
  hosts: nfs1,web1
  remote_user: root
  tasks:
  - name: install nfs server
    yum:
      name: nfs-utils,rpcbind
      state: installed

- name: configure nfs server
  hosts: nfs1
  remote_user: root

  tasks:
  - name: configure nfs1
    copy:
      src: ./exports.0225
      dest: /etc/exports
      backup: yes

  - name: create share directory
    file:
      path: /data
      state: directory
      owner: nfsnobody
      group: nfsnobody
      recurse: yes

  - name: start rpcbind server
    systemd:
      name: rpcbind
      state: started
      enabled: yes

  - name: start nfs server
    systemd:
      name: nfs
      state: started
      enabled: yes

- name: mount nfs dir
  hosts: nfs1,web1
  remote_user: root
  vars:
    umount_path: /opt/nfs_data
    mount_path: /opt/nfs_share
  tasks:
  - name: mount dir
    mount:
      src: 192.168.10.14:/data
      path: "{{mount_path}}"
      fstype: nfs
      state: mounted
    notify:
      - nfs absent
      - nfs mounted

  handlers:
  - name: nfs absent
    mount:
      src: 192.168.10.14:/data
      path: "{{umount_path}}"
      fstype: nfs
      state: absent

  - name: nfs mounted
    mount:
      src: 192.168.10.14:/data
      path: "{{mount_path}}"
      fstype: nfs
      state: mounted
EOF

5.4、nginx-playbook实践

5.4.1、安装nginx playbook

cat > www.conf << 'EOF' 
server {
  listen 80;
  server_name ansible.test.com;
  location / {
    root /usr/share/nginx/html;
    index index.html;
  }
}
EOF

cat > nginx_install.yaml << 'EOF'
---
- name: install nginx
  hosts: web1
  remote_user: root
  tasks:
  - name: configure nginx repo
    yum_repository:
      name: nginx
      description: "nginx repo"
      enabled: no
      baseurl: http://nginx.org/packages/centos/7/x86_64/
      gpgkey: https://nginx.org/keys/nginx_signing.key
      gpgcheck: true
      state: present

  - name: install nginx
    yum:
      name: nginx
      state: present
      enablerepo: nginx

  - name: edit index.html
    copy:
      content: "playbook install show"
      dest: /usr/share/nginx/html/index.html
      backup: yes

  - name: config nginx
    copy:
      src: ./www.conf
      dest: /etc/nginx/conf.d/default.conf
      backup: yes

  - name: start nginx service
    systemd:
      name: nginx
      state: started
      enabled: yes

  - name: pass 80 port
    iptables:
      action: insert
      table: filter
      chain: INPUT
      protocol: tcp
      source: 192.168.10.0/24
      destination_port: 80
      jump: ACCEPT
      state: present
EOF

5.4.2、安装nginx playbook【notify、handler】

notify # 监听文件是否变化，变化则执行handlers里面对应的任务
handlers

cat > www.conf << 'EOF' 
server {
  listen 80;
  server_name ansible.test.com;
  location / {
    root /usr/share/nginx/html;
    index index.html;
  }
}
EOF

cat nginx_install.yaml 
---
- name: install nginx
  hosts: web1
  remote_user: root
  tasks:
  - name: configure nginx repo
    yum_repository:
      name: nginx
      description: "nginx repo"
      enabled: no
      baseurl: http://nginx.org/packages/centos/7/x86_64/
      gpgkey: https://nginx.org/keys/nginx_signing.key
      gpgcheck: true
      state: present

  - name: install nginx
    yum:
      name: nginx
      state: present
      enablerepo: nginx

  - name: edit index.html
    copy:
      content: "playbook install show notify"
      dest: /usr/share/nginx/html/index.html
      backup: yes
    notify: Restart Nginx

  - name: config nginx
    copy:
      src: ./www.conf
      dest: /etc/nginx/conf.d/default.conf
      backup: yes
    notify: Restart Nginx

  - name: start nginx service
    systemd:
      name: nginx
      state: started
      enabled: yes

  - name: pass 80 port
    iptables:
      action: insert
      table: filter
      chain: INPUT
      protocol: tcp
      source: 192.168.10.0/24
      destination_port: 80
      jump: ACCEPT
      state: present

  handlers:
    - name: Restart Nginx
      systemd:
        name: nginx
        state: restarted

5.5、ansible变量

5.5.1、ymal文件内定义变量

cat > var_ymal.yaml << 'EOF'
---
- hosts: nfs1,web1
  vars:
    - nc_pkg: nc
    - nmap_pkg: nmap
  tasks:
    - name: Install nc nmap pkg
      yum:
        name:
          - "{{nc_pkg}}"
          - "{{nmap_pkg}}"
        state: present
EOF

5.5.2、外部ymal文件内定义变量

cat > vars.yaml << 'EOF' 
nc_pkg: nc
nmap_pkg: nmap
EOF

cat > var_ymal.yaml << 'EOF' 
---
- hosts: nfs1,web1
  vars_files: ./vars.yaml
  tasks:
    - name: Install nc nmap pkg
      yum:
        name:
          - "{{nc_pkg}}"
          - "{{nmap_pkg}}"
        state: present
EOF

5.5.3、从/etc/ansible/hosts定义变量

cat > /etc/ansible/hosts << 'EOF' 
[web1]
192.168.10.13

[nfs1]
192.168.10.14

[webnfs:children]
web1
nfs1

[webnfs:vars]
nc_pkg=nc
nmap_pkg=nmap
EOF

cat > var_ymal.yaml << 'EOF' 
---
- hosts: nfs1,web1
  tasks:
    - name: Install nc nmap pkg
      yum:
        name:
          - "{{nc_pkg}}"
          - "{{nmap_pkg}}"
        state: present
EOF

5.5.4、按组和主机名定义变量

host_vars  # 文件名就是/etc/ansible/hosts里面定义的主机名
group_vars # 这里的文件名就是/etc/ansible/hosts里面定义的组名

mkdir group_vars
cat > group_vars/webnfs << 'EOF' 
nc_pkg: nc
nmap_pkg: nmap
EOF


cat > /etc/ansible/hosts << 'EOF' 
[web1]
192.168.10.13

[nfs1]
192.168.10.14

[webnfs:children]
web1
nfs1

[webnfs:vars]
nc_pkg=nc
nmap_pkg=nmap
EOF

cat > var_ymal.yaml << 'EOF' 
---
- hosts: nfs1,web1
  tasks:
    - name: Install nc nmap pkg
      yum:
        name:
          - "{{nc_pkg}}"
          - "{{nmap_pkg}}"
        state: present
EOF

5.5.5、注册变量，自定义显示内容

cat > register.yaml <<'EOF'
---
- hosts: all
  tasks:
    - name:
      shell: hostname
      register: run_status
    - name: get run status
      debug:
        msg: "status:{{run_status.rc}} result:{{run_status.stdout}}"
EOF

5.5.6、facts变量

# Facts介绍
Ansible facts是在被管理主机上通过ansible自动采集发现的变量。
facts包含每台特定的主机信息。比如被控端主机的主机名、IP地址、系统版本、CPU数量、内存状态、磁盘状态等。

facts使用场景:
1、通过facts检查CPU，来生成对应的Nginx配置文件。
2、通过facts检查主机名信息，来生成不同的Zabbix配置文件。
3、通过act检索的内存情况来自定义mysql的配置文件。

# 查看主机的详细信息
ansible nfs1 -m setup

# 获取采集信息
cat > facts.yaml <<'EOF' 
---
- hosts: nfs1
  tasks:
    - name: show varibales ansible facts
      debug:
        msg:
        -  "IP地址:{{ansible_default_ipv4.address}}"
        -  "CPU物理核数:{{ansible_processor_cores}}"
        -  "总内存:{{ansible_memtotal_mb}}MB"
EOF


# 关闭采集信息
- hosts: nfs1
  gather_facts: no
  tasks:
    ...
    
# filter用法
ansible nfs1 -m setup -a 'filter="ens33"'
ansible nfs1 -m setup -a 'filter="*ens33*"'

5.6、Task控制

5.6.1、when语法介绍

when使用and或or多条件判断的语法
# OR
when: ( ansible_hostname is match("web*") or ansible_hostname is match("nfs*") )

# AND
when: ( ansible_hostname is match("web*") and ansible_hostname is match("nfs*") )
when:
  - ansible_hostname is match("web*")
  - ansible_hostname is match("nfs*")

5.6.2、when实战1-根据不同操作系统安装相同的软件包

# 根据不同操作系统，安装相同的软件包
cat > when_system.yaml << 'EOF' 
---
- hosts: web1
  tasks:
    - name: Centos install httpd
      yum:
        name:
        - httpd
        state: present
      when: ( ansible_distribution == "CentOS" )
    - name: ubuntu install httpd
      yum:
        name:
        - httpd2
        state: present
      when: ( ansible_distribution == "Ubuntu" )
EOF

5.6.3、when实战2-根据判断主机名配置nginx yum源

cat > when_nginx.yaml << 'EOF' 
---
- name: install nginx
  hosts: all
  remote_user: root
  tasks:
  - name: configure nginx repo
    yum_repository:
      name: nginx
      description: "nginx repo"
      enabled: no
      baseurl: http://nginx.org/packages/centos/7/x86_64/
      gpgkey: https://nginx.org/keys/nginx_signing.key
      gpgcheck: true
      state: present
    when: ( ansible_hostname is match("web*") )
EOF

5.6.4、when实战3-判断httpd服务没有开启则重启服务

cat > when_is_active.yaml <<'EOF'
- hosts: web1
  tasks:
    - name: Check Http Server
      command: systemctl is-active httpd
      ignore_errors: yes
      register: check_httpd

    - name: debug outprint
      debug: var=check_httpd

    - name: Httpd Restart
      systemd:
        name: httpd
        state: restarted
      when: ( check_httpd.rc != 0 )
EOF

5.6.5、loop实战1-使用循环启动多个服务【with_items】

cat > 01_loop.yaml <<'EOF'
- hosts: web1
  tasks:
    - name: restart httpd crond sshd server
      service:
        name: "{{ item }}"
        state: restarted
        enabled: yes
      with_items:
        - httpd
        - crond
        - sshd
EOF

5.6.6、loop实战2-使用自定义变量名的方式循环重启服务【vars】

cat > 02_loop_var.yaml <<'EOF'
- hosts: web1
  tasks:
    - name: install wget lrzsz pkg
      yum:
        name: "{{ pkg_name }}"
        state: present
      vars:
        pkg_name:
          - wget
          - lrzsz
EOF

5.6.7、loop实战3-使用字典循环方式创建多个用户【with_items】

cat > 03_create_user_loop.yaml <<'EOF'
- hosts: web1
  tasks:
    - name: create many user
      user:
        name: "{{ item.name }}"
        groups: "{{ item.groups }}"
        state: present
      with_items:
        - { name: 'test01',groups: 2000 }
        - { name: 'test02',groups: 2000 }
EOF

5.6.8、tags实战1-使用标签控制运行流程

# 语法介绍
--list-tags # 查询yaml标签的数量
-t          # 指定运行的标签
--skip-tags # 忽略运行标签

# 标签示例
cat > nfs_tags.yaml << 'EOF' 
- hosts: nfs1
  remote_user: root
  tasks:
    - name: install nfs server
      yum:
        name: nfs-utils
        state: present
      tags:
        - install_nfs
        - install_nfs_server
    - name: server nfs server
      service:
        name: nfs-server
        state: started
        enabled: yes
      tags: start_nfs_server
EOF

5.6.9、include实战1-文件复用

# 作用：实现配置文件分离，方便管理

# 主配置文件
cat > main.yaml << 'EOF' 
- hosts: all
  remote_user: root
  tasks:
    - include_tasks: create_file_01.yaml
    - include_tasks: create_file_02.yaml
EOF

# create_file_01.yaml
cat > create_file_01.yaml <<'EOF' 
- name: create file 01
  file:
    path: /root/file_01.txt
    state: touch
EOF

# create_file_02.yaml
cat > create_file_02.yaml <<'EOF' 
- name: create file 02
  file:
    path: /root/file_02.txt
    state: touch
EOF

5.6.10、ignore_errros实战1-忽略错误

cat > test_ignore_errors.yaml <'EOF'
- hosts: all
  tasks:
    - name: Ignore False
      command: /bin/false
      ignore_errors: yes

    - name: touch new file
      file:
        path: /root/ignore.txt
        state: touch
EOF

5.7、JinJa2-模板

5.7.1、语法

{{ 名称 }} # 变量使用名称
{% for i in EXPR %}...{% endfor %}      # 作为循环表达式
{% if EXPR %}...[% elif %}...{% endif%} # 作为条件判断
{# COMMENT #} # 表示注释

5.7.2、template实战1-替换数据分发到其它节点

# 模板文件
cat > motd.j2 << 'EOF' 
hostname: {{ ansible_hostname }}
total_memory is: {{ ansible_memtotal_mb }} MB
EOF

# 编写playbook
cat > cat jinja2_01.yaml << 'EOF' 
- hosts: web1
  tasks:
    - name: copy template file /etc/motd
      template:
        src: ./motd.j2
        dest: /etc/motd
EOF

# 运行结果
[root@ansible-control jinja2]# ansible web1 -m command -a 'cat /etc/motd'
192.168.10.13 | CHANGED | rc=0 >>
hostname: web1
total_memory is: 1819 MB

5.7.3、template实战2-使用for替换nginx模板

cat > jinja2_nginx.yaml << 'EOF' 
- hosts: web1
  vars:
    - server_name: ansible.test.org
    - http_port: 80
  tasks:
    - name: www.conf
      template:
        src: www.j2
        dest: /etc/nginx/conf.d/www.conf
        backup: yes
EOF

cat > www.j2 << 'EOF' 
upstream {{ server_name }} {
{% for i in range(7,10)  %}
    server 192.168.10.{{i}}:{{http_port}}} weight=1 max_fails=3 fail_timeout=30;
{% endfor %}
}

server {
    listen {{http_port}};
    server_name {{server_name}};
    location / {
        proxy_pass http:://{{server_name}};
        proxy_set_header Host $host;
        proxy_set_header X_Forwarded_For;
    }
}
EOF

5.8、Roles

5.8.1、roles介绍

按目录划分模块

5.8.2、实战1-打印hell

# 创建目录
mkdir base/basic/{tasks,templates,handlers,files,group_vars,user_vars} -p && cd base

# 创建目录
mkdir base/basic/{tasks,templates,handlers,files,group_vars,user_vars} -p && cd base

# 主入口
cat > run.yaml << 'EOF' 
- hosts: all
  roles:
    - role: basic
EOF

# task任务
cat > basic/tasks/main.yaml << 'EOF'
- name: print hello
  debug:
    msg: "Hello Roles"
EOF

# 目录结构

base
│
├── ├── group_vars
│ └── user_vars
│
├── basic
│ ├── files
│ ├── handlers
│ ├── tasks
│ │ └── main.yaml
│ └── templates
└── run.yaml

6、playbook-项目

6.1、基础环境配置

# 入口
cat > run.yaml <<'EOF'
- hosts: all
  roles:
    - role: basic
EOF

# 目录结构
mkdir -p base/basic/{files,tasks,templates,handlers}
mkdir -p base/{group_vars,user_vars}
tree /opt/playbook/base

├── base │ ├── basic │ │ ├── files │ │ ├── handlers │ │ ├── tasks │ │ │ └── main.yaml │ │ └── templates │ ├── group_vars │ │ └── all

cat > basic/tasks/main.yaml << 'EOF'
- name: set base yum repo
  yum_repository:
    name: CentOS-Base
    baseurl: http://mirrors.aliyun.com/centos/7.9.2009/os/x86_64/
    description: "Base repo"
    enabled: yes
    gpgkey: http://mirrors.aliyun.com/centos/RPM-GPG-KEY-CentOS-7
    gpgcheck: true
    state: present

- name: epel yum repo
  yum_repository:
    name: epel
    baseurl: http://mirrors.aliyun.com/epel/7/x86_64/
    description: "epel repo"
    enabled: no
    gpgkey: file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7 
    gpgcheck: false
    state: present

- name: zabbix yum repo
  yum_repository:
    name: zabbix
    baseurl: http://repo.zabbix.com/zabbix/3.2/rhel/7/x86_64/
    description: "zabbix repo"
    enabled: no
    state: present

- name: configure nginx repo
  yum_repository:
    name: nginx
    description: "nginx repo"
    enabled: no
    baseurl: http://nginx.org/packages/centos/7/x86_64/
    gpgkey: https://nginx.org/keys/nginx_signing.key
    gpgcheck: true
    state: present

- name: configure nginx repo
  yum_repository:
    name: php
    description: "php repo"
    enabled: no
    baseurl: https://us-east.repo.webtatic.com/yum/el7/x86_64/
    state: present

- name: install base software
  yum:
    name:
      - tree
      - vim
      - lrzsz
      - unzip
      - psmisc
      - net-tools
      - nc
      - nmap
      - ntpdate
    state: present

- name: stop firewalld
  systemd:
    name: firewalld
    state: stopped
    enabled: no

- name: disable selinux
  selinux:
    state: disabled

- name: groupadd
  group:
    name: www_nginx
    gid: 2000

- name: useradd
  user:
    name: www_nginx
    group: www_nginx
    shell: /sbin/nologin
    create_home: no

- name: config sync time
  cron:
    name: ali sync time
    minute: "*/2"
    job: "/sbin/ntpdate ntp1.aliyum.com &>/dev/null"
EOF

6.2、playbook-nginx安装

# 创建新目录
mkdir -p base/nginx/{files,tasks,templates,handlers}
mkdir -p base/{group_vars,user_vars}

# 复制nginx 配置文件
scp [email protected]:/etc/nginx/nginx.conf /opt/playbook/base/nginx/templates/

# 目前只把下面两个值设置为变量
cat base/nginx/templates/nginx.conf.j2 
...
user {{ user }};
worker_processes {{ ansible_processor_vcpus }};
...

# 设置变量
cat > base/group_vars/all << 'EOF' 
user: www_nginx
EOF

# 运行入口
cat > base/run.yaml <<'EOF' 
- hosts: all
  roles:
    - role: basic
- hosts: web1
  roles:
    - role: nginx
EOF

# 定义运行任务
cat > base/nginx/tasks/main.yaml <<'EOF'
- name: install nginx
  yum:
    name: nginx
    state: present
    enablerepo: "nginx"

- name: copy configure nginx file
  template:
    src: nginx.conf.j2 
    dest: /etc/nginx/nginx.conf
    backup: yes
  notify:
    - restart nginx

- name: start nginx
  systemd:
    name: nginx
    state: started
    enabled: yes 
EOF

# 定义handlers
cat > base/nginx/handlers/main.yaml << 'EOF'
- name: restart nginx
  systemd:
    name: nginx
    state: reloaded
EOF

标签：入门教程,ansible,192.168,cat,nfs1,state,Ansible,nfs
From： https://www.cnblogs.com/ygbh/p/17134252.html

Ansible入门教程