1.ansible简介
ansible是一款自动化运维工具，基于Python开发，集合了众多运维工具（puppet,cfengine,chef,func,fabric）的优点，实现了批量系统配置，批量 程序部署，批量运行命令等功能。
ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
（1）连接插件connection plugins：负责和被监控端实现通信；
（2）host inventory:指定操作的主机，是一个配置文件里面定义监控的主机；
（3）各种模块核心模块，command模块，自定义模块；
（4）借助于插件完成记录日志邮件等功能；
（5）playbook: 剧本执行多个任务时，非必须可以让节点一次性运行多个任务。
2.ansible架构图：
3.ansible配置
配置文件 说明
/etc/ansible/ansible.cfg ansible主配置文件
/etc/ansible/hosts 受控主机清单
受控主机清单配置方式：
分组配置
ip配置
域名配置
通配符配置
ansible通过ssh来控制远程主机，所以要配置ssh互信，否则将会提示你输入密码。
4.ansible常用模块使用详解
ansible常用模块有：
ping
yum
template
copy
user
group
service
raw
command
shell
script
ansible常用模块raw,command,shell的区别：
shell模块调用的/bin/sh指令执行
command模块不是调用的shell的指令，所有没有bash的环境变量
raw很多地方和 shell类似，更多的地方建议使用shell和command模块。但是如果是使用老版本python，需要用到raw,又或者是客户端是路由器，因为没有安装python模块，那就需要使用raw模块了
5.环境说明：
| 服务器 | IP |
|---|---|
| ansible服务器 | 192.168.209.12 |
| 受控服务器 | 192.168.209.13 |
//添加受控主机
[root@lanzhiyong ~]# vim /etc/ansible/hosts
【lanzhiyong】
192.168.209.13
//互信秘钥
[root@lanzhiyong ~]# ssh-keygen -t rsa
[root@lanzhiyong ~]# ssh-copy-id 192.168.209.136.ansible安装
//配置yum源
[root@lanzhiyong ~]# cd /etc/yum.repos.d/
[root@lanzhiyong yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo
[root@lanzhiyong yum.repos.d]# sed -i 's/\$releasever/7/g' /etc/yum.repos.d/163.repo
[root@lanzhiyong yum.repos.d]# sed -i 's/^enabled=.*/enabled=1/g' /etc/yum.repos.d/163.repo
[root@lanzhiyong ~]# yum -y install epel-release
[root@lanzhiyong ~]# yum -y install ansible ansible-doc
[root@lanzhiyong ~]# ansible --version
ansible 2.6.3
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/us r/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, May 3 2017, 07:55:04) [GCC 4.8.5 201506
23 (Red Hat 4.8.5-14)]7.ansible如何获取帮助
ansible通过ansible-doc命令来获取帮助信息，可以使用此命令的-s选项来获取指定模块的帮助信息。
//查询ping模块的帮助文档
[root@lanzhiyong ~]# ansible-doc -s ping
- name: Try to connect to host, verify a usable python and return `pong' on success
ping:
data: # Data to return for the `ping' return value. If this
parameter is set to
`crash', the module will
cause an
exception.8.ansible常用模块之ping
ping模块用于检查指定节点机器是否连通，用法很简单，不涉及参数，主机如果在线。则回复pong
[root@lanzhiyong ~]# ansible lanzhiyong -m ping
192.168.209.13 | SUCCESS => {
"changed": false,
"ping": "pong"
}9.ansible常用模块之command
command模块用于在远程主机上执行命令，ansible默认就是使用command模块。
command模块有一个缺陷就是不能使用管道符合重定向功能。
//查看受控主机的/tmp目录内容
[root@lanzhiyong ~]# ansible lanzhiyong -a 'ls /tmp'
192.168.209.13 | SUCCESS | rc=0 >>
ansible_oUl4es
bad-blocks.txt
crontab.c055Bo
file1
systemd-private-8499d6b3f392482c9040befd22b10899-vgauthd.service-7NpBZS
systemd-private-8499d6b3f392482c9040befd22b10899-vmtoolsd.service-E69SWb
//在受控主机的/tmp目录下新建一个文件test
[root@lanzhiyong ~]# ansible lanzhiyong -a 'touch /tmp/test'
[WARNING]: Consider using the file module with state=touch rather than running touch. If you
need to use command because file is insufficient you can add warn=False to this command task or
set command_warnings=False in ansible.cfg to get rid of this message.
192.168.209.13 | SUCCESS | rc=0 >>
//command模块不支持管道符，不支持重定向
[root@lanzhiyong ~]# ansible lanzhiyong -a 'echo "I Love china" > /tmp/test'
192.168.209.13 | SUCCESS | rc=0 >>
I Love china > /tmp/test
[root@lanzhiyong ~]# ansible lanzhiyong -a 'cat /tmp/test'
192.168.209.13 | SUCCESS | rc=0 >>
[root@lanzhiyong ~]# ansible lanzhiyong -a 'ps -ef|grep ssh'
192.168.209.13 | FAILED | rc=1 >>
error: unsupported SysV option
Usage:
ps [options]
Try 'ps --help '
or 'ps --help '
for additional help text.
For more details see ps(1).non-zero return code 10.ansible常用模块之raw
raw模块用于在远程主机上执行命令，其支持管道符与重定向
//支持重定向
[root@lanzhiyong ~]# ansible lanzhiyong -m raw -a 'echo "I Love china" > /tmp/test'
192.168.209.13 | SUCCESS | rc=0 >>
Shared connection to 192.168.209.13 closed.
[root@lanzhiyong ~]# ansible lanzhiyong -a 'cat /tmp/test'
192.168.209.13 | SUCCESS | rc=0 >>
I Love china
//支持管道符
[root@lanzhiyong ~]# ansible lanzhiyong -m raw -a 'ps -ef|grep ssh'
192.168.209.13 | SUCCESS | rc=0 >>
root 3287 1 0 07:54 ? 00:00:00 /usr/sbin/sshd -D
root 7688 3287 0 14:07 ? 00:00:00 sshd: root@pts/1
root 8461 3287 23 16:40 ? 00:00:00 sshd: root@pts/0
root 8464 8461 0 16:40 pts/0 00:00:00 bash -c ps -ef|grep ssh
root 8476 8464 0 16:40 pts/0 00:00:00 grep ssh
Shared connection to 192.168.209.13 closed.11.ansible常用模块之shell
shell模块用于在受控上执行受控机上的脚本，亦可直接在受控机上执行命令
shell模块亦支持管道与重定向
//查看受控机上的脚本
[root@lan ~]# mkdir /scripts
[root@lan ~]# vim /scripts/test.sh
#!/bin/bash
for i in $(seq 10);do
echo $i
done
[root@lan ~]# ll /scripts/
总用量 4
-rw-r--r--. 1 root root 49 9月 10 16:53 test.sh
//使用shell模块在ansible主服务器上执行受控服务器上 的脚本
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a '/bin/bash /scripts/test.sh'
192.168.209.13 | SUCCESS | rc=0 >>
1
2
3
4
5
6
7
8
9
1012.ansible常用模块之script
script模块用于在受控机上执行ansible主控机上的脚本
[root@lanzhiyong ~]# mkdir /scripts
[root@lanzhiyong ~]# vim /scripts/lan.sh
#!/bin/bash
for i in $(cat /etc/passwd);do
echo $i
echo '---------------'
done
[root@lanzhiyong ~]# ansible lanzhiyong -m script -a '/scripts/lan.sh &> /tmp/lan'
192.168.209.13 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.209.13 closed.\r\n",
"stderr_lines": [
"Shared connection to 192.168.209.13 closed."
],
"stdout": "",
"stdout_lines": []
}
//查看受控机上的/tmp/lan文件是否存在
[root@lanzhiyong ~]# ansible lanzhiyong -a 'cat /tmp/lan'
192.168.209.13 | SUCCESS | rc=0 >>
root:x:0:0:root:/root:/bin/bash
---------------
bin:x:1:1:bin:/bin:/sbin/nologin
---------------
daemon:x:2:2:daemon:/sbin:/sbin/nologin
---------------
adm:x:3:4:adm:/var/adm:/sbin/nologin
---------------
………………此处省略13.ansible常用模块之template
template模块用于生成一个模块，并可将其传输至远程主机上
//下载一个163的yum源文件并开启此源
[root@lanzhiyong ~]# cd /etc/yum.repos.d/
[root@lanzhiyong yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo
[root@lanzhiyong yum.repos.d]# sed -i 's/\$releasever/7/g' /etc/yum.repos.d/163.repo
[root@lanzhiyong yum.repos.d]# sed -i 's/^enabled=.*/enabled=1/g' /etc/yum.repos.d/163.repo
//将设置好的163源传到受控主机
[root@lanzhiyong ~]# ansible lanzhiyong -m template -a 'src=/etc/yum.repos.d/163.repo dest=/etc/yum.repos.d/163.repo'
//查看受控机上是否有163源
[root@lan ~]# ls /etc/yum.repos.d/
163.repo lanzhiyong.repo14.ansible常用模块之yum
yum模块用于在指定节点机器上通过yum管理软件，其支持的参数主要有两个
name:要管理的包名
state：要进行的操作
state常用的值：
latest:安装软件
installed:安装软件
present:安装软件
removed:卸载软件
absent:卸载软件
若想使用yum来管理软件，请确保受控机上的yum源无异常。
//在受控机上查询看vsftpd软件是否安装
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'rpm -qa|grep vsftpd'
[WARNING]: Consider using the yum, dnf or zypper module rather than running rpm. If you need
to use command because yum, dnf or zypper is insufficient you can add warn=False to this
command task or set command_warnings=False in ansible.cfg to get rid of this message.
192.168.209.13 | FAILED | rc=1 >>
non-zero return code
//在ansible主机上使用yum模块在受控机上安装vsftpd
[root@lanzhiyong ~]# ansible lanzhiyong -m yum -a 'name=vsftpd state=present'
192.168.209.13 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
//查看受控机是否安装了vsftpd
[root@lan ~]# rpm -qa|grep vsftpd
vsftpd-3.0.2-22.el7.x86_6415.ansible常用模块之copy
copy模块用于复制文件之远程受控机
[root@lanzhiyong ~]# ls /etc/ansible/scripts/
a.sh
[root@lanzhiyong ~]# ansible lanzhiyong -m copy -a 'src=/etc/ansible/scripts/a.sh dest=/scripts/'
192.168.209.13 | SUCCESS => {
"changed": false,
"checksum": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
"dest": "/scripts/a.sh",
"gid": 0,
"group": "root",
"mode": "0644",
"owner": "root",
"path": "/scripts/a.sh",
"secontext": "system_u:object_r:default_t:s0",
"size": 0,
"state": "file",
"uid": 0
}
//查看受控机是否复制过去了
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'ls /scripts'
192.168.209.13 | SUCCESS | rc=0 >>
a.sh
test.sh16.ansible常用模块之group
group模块用于在受控机上添加或删除组
//在受控机上添加系统组，其gid为306，组名为mysql
[root@lanzhiyong ~]# ansible lanzhiyong -m group -a 'name=mysql system=yes gid=306 state=present'
192.168.209.13 | SUCCESS => {
"changed": false,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
[root@lanzhiyong ~]# ansible lanzhiyong -a 'grep mysql /etc/group'
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:306:
//删除受控机上的mysql组
[root@lanzhiyong ~]# ansible lanzhiyong -m group -a 'name=mysql state=absent'
192.168.209.13 | SUCCESS => {
"changed": false,
"name": "mysql",
"state": "absent"
}
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'grep mysql /etc/group'
192.168.209.13 | FAILED | rc=1 >>
non-zero return code 17.ansible常用模块之user
user 模块用于管理受控机的用户账号
//在受控机上添加一个系统用户，用户名为mysql，uid为306，设置其shell为/sbin/nologin，无家目录
[root@lanzhiyong ~]# ansible lanzhiyong -m user -a 'name=mysql uid=306 system=yes create_home=no shell=/sbin/nologin state=present'
192.168.209.13 | SUCCESS => {
"changed": true,
"comment": "",
"create_home": false,
"group": 306,
"home": "/home/mysql",
"name": "mysql",
"shell": "/sbin/nologin",
"state": "present",
"system": true,
"uid": 306
}
[root@lanzhiyong ~]# ansible lanzhiyong -m shell-a 'grep mysql /etc/passwd'
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:306:306::/home/mysql:/sbin/nologin
//修改mysql用户uid为386
[root@lanzhiyong ~]# ansible lanzhiyong -m user -a 'name=mysql uid=386'
192.168.209.13 | SUCCESS => {
"append": false,
"changed": true,
"comment": "",
"group": 306,
"home": "/home/mysql",
"move_home": false,
"name": "mysql",
"shell": "/sbin/nologin",
"state": "present",
"uid": 386
}
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'grep mysql /etc/passwd'
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:386:306::/home/mysql:/sbin/nologin
//删除受控机上的mysql用户
[root@lanzhiyong ~]# ansible lanzhiyong -m user -a 'name=mysql state=absent'
192.168.209.13 | SUCCESS => {
"changed": true,
"force": false,
"name": "mysql",
"remove": false,
"state": "absent"
}
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'grep mysql /etc/passwd'
192.168.209.13 | FAILED | rc=1 >>
non-zero return code18.ansible常用模块之service
service 模块用于管理受控机上的服务
//查看受控机上的vsftpd服务是否启动
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'systemctl is-active vsftpd'
192.168.209.13 | FAILED | rc=3 >>
unknownnon-zero return code
//启动受控机上的vsftpd服务
[root@lanzhiyong ~]# ansible lanzhiyong -m service -a 'name=vsftpd state=started'
192.168.209.13 | SUCCESS => {
"changed": true,
"name": "vsftpd",
"state": "started",
"status": {
"ActiveEnterTimestampMonotonic": "0",
……此处省略
//查看受控机上的vsftpd服务是否启动
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'systemctl is-active vsftpd'
192.168.209.13 | SUCCESS | rc=0 >>
active
//查看受控机上的vsftpd服务是否开机自动启动
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'systemctl is-enabled vsftpd'
192.168.209.13 | SUCCESS | rc=0 >>
enabled
//设置受控机上的vsftpd服务开机自动启动
[root@lanzhiyong ~]# ansible lanzhiyong -m service -a 'name=vsftpd enabled=yes'
192.168.209.13 | SUCCESS => {
"changed": false,
"enabled": true,
"name": "vsftpd",
"status": {
"ActiveEnterTimestamp": "一 2018-09-10 19:43:22 CST",
//停止受控机上的vsftpd服务
[root@lanzhiyong ~]# ansible lanzhiyong -m service -a 'name=vsftpd state=stopped'
192.168.209.13 | SUCCESS => {
"changed": true,
"name": "vsftpd",
"state": "stopped",
"status": {
"ActiveEnterTimestamp": "一 2018-09-10 19:43:22 CST",
//查看是否停止vsftpd服务
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'systemctl is-active vsftpd'
192.168.209.13 | FAILED | rc=3 >>
inactivenon-zero return code
[root@lanzhiyong ~]# ansible lanzhiyong -m shell -a 'ss -antl'
192.168.209.13 | SUCCESS | rc=0 >>
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:111 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 64 *:40154 *:*
LISTEN 0 64 *:2049 *:*
LISTEN 0 128 :::111 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 64 :::2049 :::*