ansible

absible 简介

absible是一款自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。ansible是基于模块工作，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
（1）连接插件connection plugins：负责和被监控端实现通信；
（2）host inventory ： 指定操作的主机，是一个配置文件里面定义监控的主机；
（3）各种模块核心模块、command模块、自定义模块；
（4）借助于插件完成记录日志邮件等功能；
（5）playbook：剧本执行多个任务时，非必须可以让节点一次运行多个任务
ansible 架构图：

ansible配置

配置文件	说明
/etc/ansible/ansible.cfg	ansible主配置文件
etc/ansible/hosts	受控主机清单

环境准备： 安装yum 源
关闭防火墙、关闭selinx
服务器 IP：192.168.169.10
受控主机 IP：192.168.169.30
此处省略，详细配置请翻阅前面的文档

安装ansible

[root@localhost ~]# yum install -y ansible ansible-doc
[root@localhost ~]# ansible --version    //查看ansible版本
ansible 2.6.3              
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]

主配置文件说明 /etc/ansible/ansible.cfg

#inventory      = /etc/ansible/hosts     主机清单存放位置
#library        = /usr/share/my_modules/   ansible 默认搜寻模块的位置
#module_utils   = /usr/share/my_module_utils/  
#remote_tmp     = ~/.ansible/tmp
#local_tmp      = ~/.ansible/tmp
#plugin_filters_cfg = /etc/ansible/plugin_filters.yml
#forks          = 5      与主机通信时的默认并行数，默认为5
#poll_interval  = 15
#sudo_user      = root    sudo使用的默认用户，默认是root
#ask_sudo_pass = True      
#ask_pass      = True     控制ansible playbook是否会自动弹出密码
#transport      = smart
#remote_port    = 22      远程ssh端口，默认是22
#module_lang    = C       模块和系统之间通信的计算机语言，默认是C语言
#module_set_locale = False

主机清单配置 /etc/ansible/hosts
定义主机组，名字可自定义，最好是见名知意

[root@localhost ~]# vim /etc/ansible/hosts 
.....
## [webservers]             自定义的主机也可以在里面       
## alpha.example.org
## beta.example.org
## 192.168.1.100
## 192.168.1.110
.....
自定义一个组，添加自己加入组的IP地址或者主机名
[web]
192.168.169.30
localhost ansible_connection=local                            

在使用ansible 之前必须要先做 ssh 免密码登录 ，否则会提示输入密码
在服务器端做openssh 免密码操作

[root@localhost ~]# ssh-keygen  -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
/root/.ssh/id_rsa already exists.
Overwrite (y/n)? y
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
.....此处省略

[root@localhost ~]# ssh-copy-id [email protected]      //此处是受控主机IP
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.

ansible 常用模块详解

ansible 常用的模块有：ping、yum、template、copy、user、group、service、raw、command、shell、script

ansible raw 、command 、shell 的区别：
shell 模块调用的/bin/sh指令执行
1.command 模块不是调用的shell的指令，所以没有bash’的环境变量
2.raw很多地方和shell类似，更多的地方建议使用shell和command模块。
3.但是如果是使用老版本python，需要用到raw，又或者是客户端是路由器，因为没有安装python模块，那就需要使用raw模块了

ansible 常用的模块之ping

ping模块用于检查指定节点机器是否连通，用法简单，不涉及参数，主机如果在线，则回复pong

[root@localhost ~]# ansible all -m ping
192.168.169.30 | SUCCESS => {
    "changed": false, 
    "ping": "pong"
}

ansible常用模块之command

command 模块用于在远程主机上执行命令，ansible默认就是使用command模块。
command 模块有一个缺陷就是不能使用管道符和重定向功能
查看受控主机的/opt目录内容

[root@localhost ~]# ansible 192.168.169.30 -a 'ls /opt'
192.168.169.30 | SUCCESS | rc=0 >>
all-20180907.sql    //有一个文件
data                //有一个data目录

在受控主机的/opt 目录下新建一个文件chens

[root@localhost ~]# ansible  192.168.169.30  -a 'touch /opt/chens'
 [WARNING]: Consider using the file module with state=touch rather than running touch.  If you need to use
command because file is insufficient you can add warn=False to this command task or set
command_warnings=False in ansible.cfg to get rid of this message.

192.168.169.30 | SUCCESS | rc=0 >>      //创建成功

** command 模块不支持管道和重定向**

[root@localhost ~]# ansible 192.168.169.30 -a "echo 'helld word'> /opt/chens"
192.168.169.30 | SUCCESS | rc=0 >>
helld word> /opt/chens

[root@localhost ~]# ansible 192.168.169.30 -a 'cat /opt/chens'
192.168.169.30 | SUCCESS | rc=0 >>
                            //没有内容表示不支持

ansible 常用的模块之raw

raw 模块用于在远程主机上执行命令，其支持管道符与重定向
//支持重定向

[root@localhost ~]# ansible 192.168.169.30 -m raw -a 'echo "hello word">/opt/chens'
192.168.169.30 | SUCCESS | rc=0 >>
Shared connection to 192.168.169.30 closed.


[root@localhost ~]# ansible 192.168.169.30 -m raw -a 'cat /opt/chens'
192.168.169.30 | SUCCESS | rc=0 >>
hello word
Shared connection to 192.168.169.30 closed.

ansible常用的模块之shell

shell模块用于在受控主机上执行受控主机上的脚本，也可以直接在受控主机上执行命令，shell模块支持管道与重定向
查看受控主机上的脚本

[root@localhost chens]# ls
chen.sh

[root@localhost ~]# ansible 192.168.169.30 -m shell -a '/bin/bash /root/chens/chen.sh'
192.168.169.30 | SUCCESS | rc=0 >>
1
2
3
4
5
6
7
8
9
10

ansible 常用的模块之script

script模块用于在受控主机上执行主控机的脚本
在主控机上的脚本

[root@localhost opt]# ls
chens.sh

[root@localhost opt]# ansible 192.168.169.30 -m script -a '/opt/chens.sh &>/opt/1.txt'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "rc": 0, 
    "stderr": "Shared connection to 192.168.169.30 closed.\r\n", 
    "stderr_lines": [
        "Shared connection to 192.168.169.30 closed."
    ], 
    "stdout": "", 
    "stdout_lines": []
}

查看受控机上 1.txt 文件内容

[root@localhost opt]# ansible 192.168.169.30 -m shell -a 'cat /opt/1.txt'
192.168.169.30 | SUCCESS | rc=0 >>
1
2
3
4
5
6
7
8
9
10

ansible 常用的模块之template

template 模块用于生成一个模块，并可将其传输至远程主机上
下载一个163的yum源文件并开启此源

[root@ansible yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo
[root@localhost ~]# sed -i 's/\$releasever/7/g' /etc/yum.repos.d/163.repo 
[root@localhost ~]# sed -i 's/^enabled=.*/enabled=1/g' /etc/yum.repos.d/163.repo

将设置好的163源传到受控主机

[root@localhost ~]# ansible 192.168.169.30 -m template -a 'src=/etc/yum.repos.d/163.repo   dest=/etc/yum.repos.d/163.repo'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "checksum": "60b8868e0599489038710c45025fc11cbccf35f2", 
    "dest": "/etc/yum.repos.d/163.repo", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "5a3e688854d9ceccf327b953dab55b21", 
    "mode": "0644", 
    "owner": "root", 
    "secontext": "system_u:object_r:system_conf_t:s0", 
    "size": 1462, 
    "src": "/root/.ansible/tmp/ansible-tmp-1536590504.21-254921175936221/source", 
    "state": "file", 
    "uid": 0
}

查看受控主机上是否有163源

[root@localhost ~]# ansible 192.168.169.30 -m raw  -a 'ls /etc/yum.repos.d/163.repo'
192.168.169.30 | SUCCESS | rc=0 >>
/etc/yum.repos.d/163.repo             //存在
Shared connection to 192.168.169.30 closed.

ansible 常用模块之yum
yum模块用于在指定的节点机器上通过yum管理软件，其支持的参数主要有两个

• name：要管理的包名
• state ：要进行的操作

state 常用的值 :
latest : 安装软件
Installed：安装软件
present：安装软件
removed：卸载软件
absent：卸载软件

若想使用yum 来管理软件，请确保受控机上的yum源无异常
在ansible 主机上使用yum 模块在受控主机上安装vsftpd

[root@localhost ~]# 
[root@localhost ~]# ansible 192.168.169.30 -m yum -a 'name=vsftpd state=present'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "msg": "", 
    "rc": 0, 
    "results": [
        "Loaded plugins: fastestmirror\nLoading mirror speeds from cached hostfile\n * epel: mirrors.aliyun.com\nResolving Dependencies\n--> Running transaction check\n---> Package vsftpd.x86_64 0:3.0.2-22.el7 will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package          Arch             Version                 Repository      Size\n================================================================================\nInstalling:\n vsftpd           x86_64           3.0.2-22.el7            base           169 k\n\nTransaction Summary\n================================================================================\nInstall  1 Package\n\nTotal download size: 169 k\nInstalled size: 348 k\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n  Installing : vsftpd-3.0.2-22.el7.x86_64                                   1/1 \n  Verifying  : vsftpd-3.0.2-22.el7.x86_64                                   1/1 \n\nInstalled:\n  vsftpd.x86_64 0:3.0.2-22.el7                                                  \n\nComplete!\n"
    ]
}

查看受控机上是否安装了vsftpd

[root@localhost ~]# ansible 192.168.169.30 -m raw -a 'rpm -qa|grep vsftpd'
192.168.169.30 | SUCCESS | rc=0 >>
vsftpd-3.0.2-22.el7.x86_64             //已经安装完成
Shared connection to 192.168.169.30 closed.

ansible 常用模块之copy

cope模块用于复制文件至远程受控机

[root@localhost opt]# ls
chens.sh

[root@localhost opt]# ansible 192.168.169.30 -m copy -a 'src=/opt/chens.sh   dest=/opt/cs.sh'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "checksum": "07114c9220f95ac72694c96d50dbdb7b746531a9", 
    "dest": "/opt/cs.sh", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "0d4a455ae2476f1049d84874d8ffca60", 
    "mode": "0644", 
    "owner": "root", 
    "secontext": "system_u:object_r:usr_t:s0", 
    "size": 53, 
    "src": "/root/.ansible/tmp/ansible-tmp-1536591818.2-191526557384118/source", 
    "state": "file", 
    "uid": 0
}

ansible 常用模块之group

group模块用于在受控机上添加或删除组

在受控机上添加一个系统组，gid为300，组名为mysql
[root@localhost ~]# ansible 192.168.169.30 -m group -a 'name=mysql gid=300 state=present'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "gid": 300, 
    "name": "mysql", 
    "state": "present", 
    "system": false
}

[root@localhost ~]# ansible 192.168.169.30 -m raw -a 'grep mysql /etc/group'
192.168.169.30 | SUCCESS | rc=0 >>
mysql:x:300:           //存在
Shared connection to 192.168.169.30 closed.

删除受控机上的mysql组

[root@localhost ~]# ansible 192.168.169.30 -m group  -a 'name=mysql state=absent'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "name": "mysql", 
    "state": "absent"
}

[root@localhost ~]# ansible 192.168.169.30 -m raw -a 'grep mysql /etc/group'

192.168.169.30 | FAILED | rc=1 >>
Shared connection to 192.168.169.30 closed.
non-zero return code         //表示已经删除

ansible 常用模块之user

user模块用于管理受控机上的用户账号
在受控机上添加一个系统用户，用户名为mysql，uid为300，其设置为shell 为/sbin/nologin无家目录

[root@localhost ~]# ansible 192.168.169.30 -m user -a 'name=mysql uid=300 system=yes create_home=no shell=/sbin/nologin state=present'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "comment": "", 
    "create_home": false, 
    "group": 300, 
    "home": "/home/mysql", 
    "name": "mysql", 
    "shell": "/sbin/nologin", 
    "state": "present", 
    "system": true, 
    "uid": 300
}

[root@localhost ~]# ansible 192.168.169.30 -m shell -a 'grep mysql /etc/passwd'
192.168.169.30 | SUCCESS | rc=0 >>
mysql:x:300:300::/home/mysql:/sbin/nologin

修改用户的uid 为310

[root@localhost ~]# ansible 192.168.169.30 -m user -a 'name=mysql uid=310'
192.168.169.30 | SUCCESS => {
    "append": false, 
    "changed": true, 
    "comment": "", 
    "group": 300, 
    "home": "/home/mysql", 
    "move_home": false, 
    "name": "mysql", 
    "shell": "/sbin/nologin", 
    "state": "present", 
    "uid": 310
}

删除受控机上的mysql 用户

[root@localhost ~]# ansible 192.168.169.30 -m user -a 'name=mysql state=absent'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "force": false, 
    "name": "mysql", 
    "remove": false, 
    "state": "absent"
}

ansible 常用的模块之 service

service 模块用于管理受控机上的服务
查看受控机上的vsftpd 服务是否启动

[root@localhost ~]# ansible 192.168.169.30 -m shell -a 'systemctl is-active vsftpd'
192.168.169.30 | FAILED | rc=3 >>
unknownnon-zero return code    //关闭状态

启动受控机上的vsftpd

[root@localhost ~]# ansible 192.168.169.30 -m service -a 'name=vsftpd state=started'
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "name": "vsftpd", 
    "state": "started", 
    "status": {
        "ActiveEnterTimestampMonotonic": "0", 
        "ActiveExitTimestampMonotonic": "0", 
        "ActiveState": "inactive", 
        "After": "network.target systemd-journald.socket basic.target system.slice", 
        "AllowIsolate": "no", 
.....此处省略
}

查看受控机上的vsftpd服务是否以启动

[root@localhost ~]# ansible 192.168.169.30 -m shell -a 'systemctl is-active vsftpd' 
192.168.169.30 | SUCCESS | rc=0 >>
active    //表示服务已经启动

停止受控机上的vsftpd服务

[root@localhost ~]# ansible 192.168.169.30 -m service -a  'name=vsftpd state=stopped' 
192.168.169.30 | SUCCESS => {
    "changed": true, 
    "name": "vsftpd", 
    "state": "stopped", 
    "status": {
        "ActiveEnterTimestamp": "Tue 2018-09-11 01:45:58 CST", 
        "ActiveEnterTimestampMonotonic": "5418338591", 
        "ActiveExitTimestampMonotonic": "0", 
.....此处省略
}

查看vsftpd 状态

[root@localhost ~]# ansible 192.168.169.30 -m shell  -a 'systemctl is-active vsftpd'
192.168.169.30 | FAILED | rc=3 >>
unknownnon-zero return code

ansible 获取帮助信息

ansible-doc-l 获取全部模块信息

[root@localhost ~]# ansible-doc -s ping          //获取指定模块的帮助信息
- name: Try to connect to host, verify a usable python and return `pong' on success
  ping:
      data:                  # Data to return for the `ping' return value. If this parameter is set
                               to `crash', the module will cause an
                               exception.

ansible 命令详解

ansible	命令参数	作用
-----	-a	模块的参数如果执行默认就是command模块，就是命令参数
-----	-k ,–ask-pass	ask for SSH password 登录密码提示输入ssh密码，而不是假设基于密码的验证
-----	-s	用于sudo
-----	-m	执行模块的名字，如果不使用，默认就是command
-----	-v	查看详细信息