RHCE练习题目【已完结】

第一题、安装和配置ansible

按照下方所述，在控制节点workstation.lab.example.com 上安装和配置 Ansible：
安装所需的软件包
创建名为/home/student/ansible/inventory的静态清单文件, 以满足以下需求:
servera是dev主机组的成员
serverb是test主机组的成员
serverc和serverd是prod主机组的成员
bastion是balancers主机组的成员
prod组是webservers主机组的成员
创建名为/home/student/ansible/ansible.cfg的配置文件, 以满足以下要求:
主机清单文件为/home/student/ansible/inventory
playbook中使用的角色的位置包括/home/student/ansible/roles
因student执行命令时需要输入密码, 会导致ansible执行失败, 因此先添加sudoers规则(考试中不需要修
改)

环境准备

[root@foundation0 ~] rht-vmctl start all
Starting bastion.
Starting workstation.
Starting servera.
Starting serverb.
Starting serverc.
Starting serverd.
[root@foundation0 ~] ssh student@workstation
Activate the web console with: systemctl enable --now cockpit.socket

Last login: Sun Jul 24 11:19:37 2022 from 172.25.250.250
[student@workstation ~]$ lab intro-install start

Setting up the environment for the exercise:

 · Configuring control node packages...........................  SUCCESS

[student@workstation ~]$

[root@workstation ~] scp /etc/sudoers.d/devops root@bastion:/etc/sudoers.d/
devops                                                                                       100%   31     7.8KB/s   00:00    
[root@workstation ~] scp /etc/sudoers.d/devops root@serverc:/etc/sudoers.d/
Warning: Permanently added 'serverc,172.25.250.12' (ECDSA) to the list of known hosts.
devops                                                                                       100%   31    13.4KB/s   00:00    
[root@workstation ~] scp /etc/sudoers.d/devops root@serverd:/etc/sudoers.d/
Warning: Permanently added 'serverd,172.25.250.13' (ECDSA) to the list of known hosts.
devops

[root@workstation ~] for i in server{a..d} bastion
> do
> ssh root@$i "rm -rf /etc/yum.repos.d/*"
> ssh root@$i "useradd natasha"
> done

在workstation上安装

[student@workstation ~]$ sudo yum install ansible -y

#检查是否正确安装，回显绿色的主机信息，证明安装成功
[student@workstation ~]$ ansible -m setup localhost

mkdir ansile/roles -p
cd ansible
[student@workstation ansible]$ cat ansible.cfg 
[defaults]
inventory = inventory
remote_user = devops
roles_path = ./roles
host_key_checking = false
ask_pass = false

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False
[student@workstation ansible]$

编写主机清单

[student@workstation ansible]$ cat inventory 
[dev]
servera

[test]
serverb

[prod]
server[c:d]

[balancers]
bastion

[webservers:children]
prod
[student@workstation ansible]$

检查可用性

[student@workstation ansible]$ ansible all -a id
serverd | CHANGED | rc=0 >>
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

serverc | CHANGED | rc=0 >>
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

serverb | CHANGED | rc=0 >>
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

servera | CHANGED | rc=0 >>
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

bastion | CHANGED | rc=0 >>
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[student@workstation ansible]$ 

第二题、创建和运行ansible临时命令

作为系统管理员, 您需要在受管节点上安装软件.
请按照下方所述, 创建一个名为/home/student/ansible/adhoc.sh的shell脚本, 该脚本将使用Ansible临
时命令在各个受管节点上安装yum存储库:
存储库1:
存储库的名称为 rh294_BASE
描述为rh294 base software
基础URL为
http://content.example.com/rhel8.0/x86_64/dvd/BaseOS
GPG签名检查为启用状态
GPG密钥URL为
http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
存储库为开启状态
存储库2:
存储库的名称为 rh294_STREAM
描述为 rh294 stream software
基础URL为
http://content.example.com/rhel8.0/x86_64/dvd/AppStream
GPG签名检查为启用状态
GPG密钥URL为
http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
存储库为开启状态

[student@workstation ansible]$ cat adhoc.sh 
#! /bin/bash
ansible all -m yum_repository -a "name=rh294_BASE
description='rhce base software'
file=rhel_dvd
baseurl=http://content.example.com/rhel8.0/x86_64/dvd/BaseOS
gpgcheck=yes
gpgkey=http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
enabled=yes"

ansible all -m yum_repository -a "name=rh294_STREAM
description='rh294 stream software'
file=rhel_dvd
baseurl=http://content.example.com/rhel8.0/x86_64/dvd/AppStream
gpgcheck=yes
gpgkey=http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
enabled=yes"
[student@workstation ansible]$

第三题、使用剧本安装软件包

创建一个名为 /home/student/ansible/packages.yml的 playbook：
将 php 和 mariadb 软件包安装到 dev、test 和 prod 主机组中的主机上
将 RPM Development Tools 软件包组安装到 dev主机组中的主机上
将 dev 主机组中主机上的所有软件包更新为最新版本

设置tab键，方便编写ymal文件

[student@workstation ansible]$ cat ~/.vimrc 
autocmd FileType yaml setlocal ai ts=2 sw=2 et
[student@workstation ansible]$

编写安装相关软件包的剧本

[student@workstation ansible]$ cat packages.yml 
---
- name: install pkgs
  hosts: dev,test,prod
  tasks:
    - name: install php and mariadb
      yum:
        name:
          - php
          - mariadb
          - mariadb-server
        state: present
- name: install group pkgs
  hosts: dev
  tasks:
    - name: install Development Tools
      yum: 
        name: "@RPM Development Tools"
        state: present
    - name: update installed pkgs
      yum:
        name: "*"
        state: latest
        update_only: true
[student@workstation ansible]$

检查剧本是否有语法错误，执行剧本

[student@workstation ansible]$ ansible-playbook --syntax-check packages.yml 

playbook: packages.yml
[student@workstation ansible]$ 
[student@workstation ansible]$ ansible-playbook packages.yml

第四题、使用RHEL系统脚色

第一问、配置时间同步

安装 RHEL 系统角色软件包，并创建符合以下条件的playbook
/home/student/ansible/timesync.yml：
在所有受管节点上运行使用 timesync 角色
配置该角色，以使用当前有效的 NTP 提供商
配置该角色，以使用时间服务器 classroom.example.com
配置该角色，以启用 iburst 参数

[student@workstation ansible]$ yum -y install rhel-system-roles
[student@workstation ansible]$ ls
adhoc.sh  ansible.cfg  inventory  packages.yml  roles  timesync.yml
[student@workstation ansible]$ cp -r /usr/share/ansible/roles/rhel-system-roles.timesync/ roles/timesync/

编写剧本

[student@workstation ansible]$ cat timesync.yml 
---
- name: set time sync
  hosts: all
  roles:
    - timesync
  vars:
    timesync_ntp_servers:
      - hostname: classroom.example.com
        iburst: yes
[student@workstation ansible]$
[student@workstation ansible]$ ansible-playbook --syntax-check timesync.yml 

playbook: timesync.yml
[student@workstation ansible]$ ansible-playbook timesync.yml 

验证是否同步

[student@workstation ansible]$ ansible all -a "chronyc sources -v"
serverc | CHANGED | rc=0 >>
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* classroom.example.com         8   6    17     8  -5796ns[  -69us] +/-  355us

serverd | CHANGED | rc=0 >>
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* classroom.example.com         8   6    17     9   +641ns[  +43us] +/-  430us

servera | CHANGED | rc=0 >>
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* classroom.example.com         8   6    17     9   +760ns[  -42us] +/-  624us

bastion | CHANGED | rc=0 >>
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* classroom.example.com         8   6    17     9  -3282ns[  -64us] +/- 1160us

serverb | CHANGED | rc=0 >>
210 Number of sources = 1

  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
 / .- Source state '*' = current synced, '+' = combined , '-' = not combined,
| /   '?' = unreachable, 'x' = time may be in error, '~' = time too variable.
||                                                 .- xxxx [ yyyy ] +/- zzzz
||      Reachability register (octal) -.           |  xxxx = adjusted offset,
||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
||                                \     |          |  zzzz = estimated error.
||                                 |    |           \
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* classroom.example.com         8   6    17     9   +611ns[  +41us] +/-  731us

[student@workstation ansible]$

第二问、配置selinux

安装 RHEL 系统角色软件包，并创建符合以下条件的playbook
/home/student/ansible/selinux.yml：
在所有受管节点上运行
使用selinux角色
将该角色配置为以强制执行状态使用SELinux

拉取角色

[student@workstation ansible]$ cp -r /usr/share/ansible/roles/rhel-system-roles.selinux/ roles/selinux
[student@workstation ansible]$ ls roles/selinux/
COPYING  library  meta  README.html  README.md  semaphore  tasks  tests  vars
[student@workstation ansible]$

编写剧本

[student@workstation ansible]$ vim selinux.yml
[student@workstation ansible]$ cat selinux.yml 
---
- name: use system roles to configure selinux
  hosts: all
  roles:
    - role: selinux
  vars:
    selinux_policy: targeted
    selinux_state: enforcing
[student@workstation ansible]$

检查语法，执行剧本

[student@workstation ansible]$ ansible-playbook --syntax-check selinux.yml 

playbook: selinux.yml
[student@workstation ansible]$ ansible-playbook selinux.yml 

第五题、使用Ansible Galaxy安装角色

使用 Ansible Galaxy 和要求文件 /home/student/ansible/roles/requirements.yml，从以下 URL
下载角色并安装到 /home/student/ansible/roles：
http://content.example.com/haproxy.tar.gz 此 角 色 的 名 称 应 当 为 balancer
http://content.example.com/phpinfo.tar.gz 此角色的名称应当为 phpinfo

编写剧本

[student@workstation ansible]$ vim roles/requirements.yml
[student@workstation ansible]$ cat roles/requirements.yml
---
- name: balancer
  src: http://content.example.com/haproxy.tar.gz

- name: phpinfo
  src: http://content.example.com/phpinfo.tar.gz
[student@workstation ansible]$ 

执行剧本

[student@workstation ansible]$ ansible-galaxy install -r roles/requirements.yml -p roles/
- downloading role from http://content.example.com/haproxy.tar.gz
- extracting balancer to /home/student/ansible/roles/balancer
- balancer was installed successfully
- downloading role from http://content.example.com/phpinfo.tar.gz
- extracting phpinfo to /home/student/ansible/roles/phpinfo
- phpinfo was installed successfully
[student@workstation ansible]$ 

验证

[student@workstation ansible]$ pwd
/home/student/ansible
[student@workstation ansible]$ ls roles/
balancer  phpinfo  requirements.yml  selinux  timesync

第六题、创建和使用角色

根据下列要求，在 /home/student/ansible/roles中创建名为 apache 的角色：
httpd软件包已安装，设为在系统启动时启用并启动
防火墙已启用并正在运行，并使用允许访问 Web 服务器的规则
模板文件 index.html.j2 已存在，用于创建具有以下输出的文件 /var/www/html/index.html:
Welcome to HOSTNAME on IPADDRESS
其中，HOSTNAME 是受管节点的完全限定域名，IPADDRESS 则是受管节点的 IP 地址。
按照下方所述，创建一个使用此角色的 playbook /home/student/ansible/newrole.yml：
该 playbook 在 webservers 主机组中的主机上运行

初始化角色

[student@workstation roles]$ pwd
/home/student/ansible/roles
[student@workstation roles]$
[student@workstation roles]$ ansible-galaxy init apache
- apache was created successfully
[student@workstation roles]$
[student@workstation roles]$ ls
apache  balancer  phpinfo  requirements.yml  selinux  timesync

[student@workstation roles]$ vim apache/tasks/main.yml 
[student@workstation roles]$ cat apache/tasks/main.yml
---
# tasks file for apache
- name: install http
  yum:
    name: httpd
    state: present

- name: config system service
  service:
    name: "{{ item }}"
    state: started
    enabled: yes
  loop:
    - httpd
    - firewalld

- name: firewalld service
  firewalld:
    zone: public
    service: http
    permanent: yes
    immediate: yes
    state: enabled

- name: user templates
  template:
    src: index.html.j2
    dest: /var/www/html/index.html
    owner: apache
    group: apache
    mode: '0644'
[student@workstation roles]$ 

[student@workstation roles]$ vim apache/templates/index.html.j2
[student@workstation roles]$ cat apache/templates/index.html.j2
Welcome to {{ ansible_facts.fqdn }} on {{ ansible_facts.default_ipv4.address }}
[student@workstation roles]$
[student@workstation roles]$ vim ../newrole.yml
[student@workstation roles]$ cat ../newrole.yml
---
- name: use http role
  hosts: webservers
  roles:
    - apache
[student@workstation roles]$

执行剧本

[student@workstation ansible]$ pwd
/home/student/ansible
[student@workstation ansible]$ 
[student@workstation ansible]$ ansible-playbook newrole.yml

第七题、从Ansible Galaxy使用角色

根据下列要求，创建一个名为 /home/student/ansible/roles.yml 的 playbook：
playbook 中包含一个 play，该 play 在 balancers 主机组中的主机上运行并将使用 balancer 角
色。
此角色配置一项服务，以在 webservers 主机组中的主机之间平衡 Web 服务器请求的负载。
浏览到 balancers 主机组中的主机（例如http://bastion.lab.example.com/ ）将生成以下输
出：
Welcome to serverc.example.com on 172.25.1.12
重新加载浏览器将从另一 Web 服务器生成输出：
Welcome to serverd.example.com on 172.25.1.13
playbook 中包含一个 play，该 play 在 webservers主机组中的主机上运行并将使用 phpinfo 角
色。
通过 URL /hello.php 浏览到 webservers 主机组中的主机将生成以下输出：
Hello PHP World from FQDN
其中，FQDN是主机的完全限定名称。
例如，浏览到 http://serverc.lab.example.com/hello.php 会生成以下输出：
Hello PHP World from serverc.example.com
另外还有 PHP 配置的各种详细信息，如安装的PHP 版本等。
同样，浏览到 http://serverd.lab.example.com/hello.php 会生成以下输出：
Hello PHP World from serverd.example.com
另外还有 PHP 配置的各种详细信息，如安装的PHP 版本等。

环境配置【考试不用】

[student@workstation ansible]$ ssh root@bastion
[root@bastion ~]# systemctl stop httpd
[root@bastion ~]# systemctl disable httpd
Removed /etc/systemd/system/multi-user.target.wants/httpd.service.
[root@bastion ~]# exit
logout
Connection to bastion closed.
[student@workstation ansible]$

编写剧本

[student@workstation ansible]$ vim roles.yml
[student@workstation ansible]$ cat roles.yml
- name: gather all need vars
  hosts: all

- name: deploy haproxy
  hosts: balancers
  roles:
    - balancer

- name: deploy basic php env on webwerver
  hosts: webservers
  roles:
    - phpinfo
[student@workstation ansible]$ 

执行剧本

[student@workstation ansible]$ ansible-playbook --syntax-check roles.yml 

playbook: roles.yml
[student@workstation ansible]$ ansible-playbook roles.yml

访问，考试时，hello.php用浏览器访问验证

[student@workstation ansible]$ curl bastion
Welcome to serverc.lab.example.com on 172.25.250.12
[student@workstation ansible]$ curl bastion
Welcome to serverd.lab.example.com on 172.25.250.13
[student@workstation ansible]$ curl serverc/hello.php
Hello PHP World form serverc.lab.example.com
[student@workstation ansible]$ curl serverd/hello.php
Hello PHP World form serverd.lab.example.com

第八题、创建和使用逻辑卷

第一问

创建一个名为/home/student/ansible/lv.yml 的playbook，它将在所有受管节点上运行以执行下列任
务：
创建符合以下要求的逻辑卷： (lvol)
逻辑卷创建在 research
卷组中逻辑卷名称为 data
逻辑卷大小为 1500MiB
使用 ext4 文件系统格式化逻辑卷 (filesystem)
如果 无法创建 请求的逻辑卷大小，应显示错误消息 (debug)
Could not create logical volume of that size，并且应改为使用大小 800MiB。
如果卷组research 不存在 ，应显示错误消息 (debug)
Volume group does not exist。不要以任何方式挂载逻辑卷。

因为虚拟机只有一块盘，做完题要还原磁盘才能做第二问。下载还原磁盘的剧本【考试环境不用这个操作】

[student@workstation ansible]$ wget http://content.example.com/lv_pre.yml
--2023-06-04 19:54:09--  http://content.example.com/lv_pre.yml
Resolving content.example.com (content.example.com)... 172.25.254.254
Connecting to content.example.com (content.example.com)|172.25.254.254|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 623
Saving to: ‘lv_pre.yml’

lv_pre.yml                      100%[======================================================>]     623  --.-KB/s    in 0s      

2023-06-04 19:54:09 (41.2 MB/s) - ‘lv_pre.yml’ saved [623/623]

[student@workstation ansible]$
[student@workstation ansible]$ ansible-playbook lv_pre.yml 
[student@workstation ansible]$ ansible all -a 'vgs'
serverd | CHANGED | rc=0 >>
  VG       #PV #LV #SN Attr   VSize    VFree   
  research   1   0   0 wz--n- 1020.00m 1020.00m

serverc | CHANGED | rc=0 >>
  VG       #PV #LV #SN Attr   VSize    VFree   
  research   1   0   0 wz--n- 1020.00m 1020.00m

serverb | CHANGED | rc=0 >>
  VG       #PV #LV #SN Attr   VSize  VFree 
  research   1   0   0 wz--n- <2.00g <2.00g

servera | CHANGED | rc=0 >>
  VG       #PV #LV #SN Attr   VSize  VFree 
  research   1   0   0 wz--n- <2.00g <2.00g

bastion | CHANGED | rc=0 >>


[student@workstation ansible]$ 

编写剧本创建逻辑卷

[student@workstation ansible]$ vim lv.yml 
[student@workstation ansible]$ cat lv.yml
---
- name: create lvm
  hosts: all
  tasks:
    - name: create a lvm
      block:
        - name: create 1500M ;v
          lvol:
            vg: research
            lv: data
            size: 1500m
      
      rescue:
        - name: sorry lvm too big
          debug:
            msg: "Could not create logical volume with that size"

        - name: create 800m lv
          lvol: 
            vg: research
            lv: data
            size: 800m

      always:
        - name: make demand fs
          filesystem:
            dev: /dev/research/data
            fstype: ext4
          when: "'research' in ansible_facts.lvm.vgs"

        - name: show other debug info
          debug:
            msg: "Volume group does not exist"
          when: "'research' not in ansible_facts.lvm.vgs"
[student@workstation ansible]$ 

检查语法，执行剧本

[student@workstation ansible]$ ansible-playbook --syntax-check lv.yml 

playbook: lv.yml
[student@workstation ansible]$ ansible-playbook lv.yml

验证

第二问

创建一个名为/home/matthew/ansible/partition.yml 的playbook，它将在所有受管节点上运行以执行
下列任务：
创建符合以下要求的主分区：
分区创建在vdb上
分区大小为 1500MiB
使用 ext4 文件系统格式化逻辑卷
挂载到 /newpart
如果 无法创建 请求的分区大小，应显示错误消息
Could not create partition of that size，并且应改为使用大小 800MiB。
如果块设备 vdb 不存在 ，应显示错误消息
Disk does not exist。

下载并执行环境准备剧本【考试时不用】

[student@workstation ansible]$ wget http://content.example.com/part_pre.yml
--2023-06-04 21:20:12--  http://content.example.com/part_pre.yml
Resolving content.example.com (content.example.com)... 172.25.254.254
Connecting to content.example.com (content.example.com)|172.25.254.254|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 386
Saving to: ‘part_pre.yml’

part_pre.yml                    100%[======================================================>]     386  --.-KB/s    in 0s      

2023-06-04 21:20:12 (33.8 MB/s) - ‘part_pre.yml’ saved [386/386]

[student@workstation ansible]$ 
[student@workstation ansible]$ vim  part_pre.yml
[student@workstation ansible]$ ansible-playbook part_pre.yml

编写剧本

[student@workstation ansible]$ vim partition.yml
[student@workstation ansible]$ cat partition.yml
---
- name: create partition with a proper size
  hosts: all
  tasks:
    - name: show if vdb exits
      debug:
        msg: "Disk does not exits "
      when: "ansible_facts.devices.vdb is not defined"
      failed_when: "ansible_facts.devices.vdb is not defined"

    - name: create a partition
      block:
        - name: create 1500m partiton
          parted:
            device: /dev/vdb
            number: 1
            state: present
            part_start: 1MiB
            part_end: 1500MiB

      rescue:
        - name: show debug info1
          debug:
            msg: "Could not create partion of that size"

        - name: create 800m partition
          parted:
            device: /dev/vdb
            number: 1
            state: present
            part_start: 1MiB
            part_end: 800MiB

      always:
        - name: create fs
          filesystem: 
            dev: /dev/vdb1
            fstype: ext4
            force: true
          when: ansible_facts.devices.vdb

        - name: mount fs
          mount:
            path: /newpart
            src: /dev/vdb1
            state: mounted
            fstype: ext4
          when: ansible_facts.devices.vdb
[student@workstation ansible]$ 

检查语法，执行

[student@workstation ansible]$ ansible-playbook --syntax-check partition.yml 

playbook: partition.yml
[student@workstation ansible]$ ansible-playbook partition.yml

验证

第九题、生成主机文件

将一个初始模板文件从 http://content.example.com/hosts.j2 下载到/home/student/ansible
完成该模板，以便用它生成以下文件：针对每个清单主机包含一行内容，其格式与 /etc/hosts 相
同
创建名为 /home/student/ansible/hosts.yml 的playbook，它将使用此模板在 dev 主机组中的
主机上生成文件 /etc/myhosts。
该 playbook 运行后，dev 主机组中主机上的文件/etc/myhosts 应针对每个受管主机包含一行内
容：
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.24.1.6 servera.lab1.example.com servera
172.24.1.7 serverb.lab1.example.com serverb
172.24.1.8 serverc.lab1.example.com serverc
172.24.1.9 serverd.lab1.example.com serverd
172.24.1.10 bastion.lab1.example.com bastion
注：清单主机名称的显示顺序不重要。

1、下载模板文件

[student@workstation ansible]$ wget http://content.example.com/host.j2
--2023-06-06 19:51:35--  http://content.example.com/host.j2
Resolving content.example.com (content.example.com)... 172.25.254.254
Connecting to content.example.com (content.example.com)|172.25.254.254|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 152
Saving to: ‘host.j2’

host.j2                         100%[======================================================>]     152  --.-KB/s    in 0s      

2023-06-06 19:51:35 (16.0 MB/s) - ‘host.j2’ saved [152/152]

[student@workstation ansible]$ 

修改模板文件

[student@workstation ansible]$ vim host.j2 
[student@workstation ansible]$ cat host.j2
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 
{% for host in groups.all %}
{{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }} {{ hostvars[host]['ansible_facts']['fqdn'] }} {{ hostvars[host]['ansible_facts']['hostname'] }}
{% endfor %}
[student@workstation ansible]$ 

编写剧本

[student@workstation ansible]$ vim hosts.yml
[student@workstation ansible]$ cat hosts.yml
---
- name: gather all facts
  hosts: all

- name:
  hosts: dev
  tasks:
    - name: deploy hosts file
      template:
        src: host.j2
        dest: /etc/myhosts
[student@workstation ansible]$

执行剧本

验证

第十题、修改文件内容

按照下方所述，创建一个名为 /home/student/ansible/issue.yml 的 playbook： 该 playbook 将在
所有清单主机上运行
该 playbook 会将 /etc/issue 的内容替换为下方所示的一行文本：
在 dev 主机组中的主机上，这行文本显示为：Development
在 test 主机组中的主机上，这行文本显示为：Test
在 prod 主机组中的主机上，这行文本显示为：Production

解法一【官方】

[student@workstation ansible]$ vim issue.yml
[student@workstation ansible]$ cat issue.yml
---
- name: modify issue file
  hosts: all
  tasks:
    - name: use jinjia2 in copy module
      copy:
        content: |
          {% if 'dev' in group_names %}
          Development
          {% elif 'test' in group_names %}
          Test
          {% elif 'prod' in group_names %}
          Production
          {% endif %}
        dest: /etc/issue
[student@workstation ansible]$ 

执行剧本

验证

第十一题、创建web内容目录

按照下方所述，创建一个名为 /home/student/ansible/webcontent.yml 的 playbook：
该 playbook 在 dev 主机组中的受管节点上运行
创建符合下列要求的目录 /webdev：
所有者为 devops 组
具有常规权限：owner=read+write+execute，group=read+write+execute,
other=read+execute
具有特殊权限: set group ID
用符号链接将 /var/www/html/webdev 链接到 /webdev
创建文件 /webdev/index.html，其中包含如下所示的单行文本：Development
在 dev 主机组中主机上浏览此目录（例如 http://servera.lab.example.com/webdev/ 将生成以下输出：
Development

装selinux的一个依赖包

编写剧本

[student@workstation ansible]$ vim webcontent.yml
[student@workstation ansible]$ cat webcontent.yml
---
- name: use syslink to create webdev content
  hosts: dev
  tasks:
    - name: install web
      yum:
        name: httpd
        state: present

    - name: start web
      service:
        name: httpd
        state: started
        enabled: true

    - name: set firewalld     
      firewalld:
        zone: public
        service: http
        permanent: yes
        immediate: yes
        state: enabled

    - name: create dir webdev with 2775
      file:
        path: /webdev
        state: directory
        mode: "2775"
        group: devops
        owner: root
        setype: httpd_sys_content_t

    - name: index page
      copy:
        content: "Devlopment \n"
        dest: /webdev/index.html
        owner: apache
        group: apache
        setype: httpd_sys_content_t

    - name: link webdev to web work dir
      file:
        state: link
        src: /webdev
        dest: /var/www/html/webdev

[student@workstation ansible]$ 

检查语法，执行剧本

[student@workstation ansible]$ ansible-playbook --syntax-check webcontent.yml 

playbook: webcontent.yml
[student@workstation ansible]$ ansible-playbook webcontent.yml

验证

[student@workstation ansible]$ curl http://servera/webdev
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://servera/webdev/">here</a>.</p>
</body></html>
[student@workstation ansible]$ curl http://servera/webdev/   #以 / 结尾来验证
Devlopment 
[student@workstation ansible]$

第十二题、生成硬件报告

创建一个名为 /home/student/ansible/hwreport.yml的 playbook，它将在所有受管节点上生成含
有以下信息的输出文件 /root/hwreport.txt：
清单主机名称
以 MB 表示的总内存大小
BIOS 版本
磁盘设备 vda 的大小
磁盘设备 vdb 的大小
输出文件中的每一行含有一个 key=value 对。
您的 playbook 应当：
从 http://content.example.com/hwreport.txt 下载文件，并将它保存为/root/hwreport.txt
使用正确的值修改 /root/hwreport.txt
如果硬件项不存在，相关的值应设为 NONE

下载文件，查看需要替换的值

[student@workstation ~]$ wget http://content.example.com/hwreport.txt
--2023-06-08 19:13:18--  http://content.example.com/hwreport.txt
Resolving content.example.com (content.example.com)... 172.25.254.254
Connecting to content.example.com (content.example.com)|172.25.254.254|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 145 [text/plain]
Saving to: ‘hwreport.txt’

hwreport.txt            100%[============================>]     145  --.-KB/s    in 0s      

2023-06-08 19:13:18 (12.8 MB/s) - ‘hwreport.txt’ saved [145/145]

[student@workstation ~]$ cat hwreport.txt 
HOSTNAME='inventoryhostname'
TOTAL_MEM_MB='memory_in_mb'
BIOS_VERSION='BIOS_version'
DISK_VDA_SIZE='disk_vda_size'
DISK_VDB_SIZE='disk_vdb_size'
[student@workstation ~]$ 

编写剧本

[student@workstation ansible]$ cat hwreport.yml
---
- name: download file and modify content
  hosts: all
  tasks:
  - name: download file
    get_url:
      url: http://content.example.com/hwreport.txt
      dest: /root/hwreport.txt

  - name: change hostname
    replace:
      path: /root/hwreport.txt
      regexp: 'inventoryhostname'
      replace: "{{ inventory_hostname }}"

  - name: change mem
    replace:
      path: /root/hwreport.txt
      regexp: 'memory_in_mb'
      replace: "{{ ansible_facts.memtotal_mb }}"
  
  - name: change bios
    replace:
      path: /root/hwreport.txt
      regexp: 'BIOS_version'
      replace: "{{ ansible_facts.bios_version }}"
  
  - name: change vda size
    replace:
      path: /root/hwreport.txt
      regexp: 'disk_vda_size'
      replace: "{{ ansible_facts.devices.vda.size | default('NONE') }}"
  
  - name: change vdb size
    replace:
      path: /root/hwreport.txt
      regexp: 'disk_vdb_size'
      replace: "{{ ansible_facts.devices.vdb.size | default('NONE') }}"
[student@workstation ansible]$ 

执行剧本

验证

第十三题、创建密码库

按照下方所述，创建一个 Ansible 库来存储用户密码：
库名称为 /home/student/ansible/locker.yml
库中含有两个变量，名称如下：
pw_developer，值为 Imadev
pw_manager，值为 Imamgr
用于加密和解密该库的密码为whenyouwishuponastar
密码存储在文件 /home/student/ansible/secret.txt中

[student@workstation ansible]$ vim locker.yml
[student@workstation ansible]$ cat locker.yml
---
pw_developer: Imadev
pw_manager: Imamgr
[student@workstation ansible]$ 

加解密

[student@workstation ansible]$ echo "whenyouwishhuponaster" >> secret.txt
[student@workstation ansible]$ chmod 600 secret.txt 
[student@workstation ansible]$ ansible-vault encrypt --vault-id=secret.txt locker.yml 
Encryption successful
[student@workstation ansible]$ ansible-vault view --vault-id=secret.txt locker.yml 
---
pw_developer: Imadev
pw_manager: Imamgr
[student@workstation ansible]$ 
[student@workstation ansible]$ ansible-vault view locker.yml   #不指定加密文件
Vault password: 
---
pw_developer: Imadev
pw_manager: Imamgr
[student@workstation ansible]$ 

第十四题、创建用户账户

从 http://content.example.com/user_list.yml (老版本)下载要创建的用户的列表，并将它保存
到 /home/student/ansible
在本次考试中使用在其他位置创建的密码库 /home/student/ansible/locker.yml，创建名
为/home/student/ansible/users.yml 的playbook，从而按以下所述创建用户帐户：
职位描述为 developer 的用户应当：
在 dev 和 test 主机组中的受管节点上创建
从 pw_developer 变量分配密码
密码有效期限为30天(新增要求)
为用户分配特定的UID（变量文件和题目中均未明确给出具体的UID值）
是附加组 student 的成员
职位描述为 manager 的用户应当：
在 prod 主机组中的受管节点上创建
从 pw_manager 变量分配密码
密码有效期限为30天(新增要求)
为用户分配特定的UID（变量文件和题目中均未明确给出具体的UID值）
是附加组 opsmgr 的成员
密码应采用 SHA512 哈希格式。
您的 playbook 应能够在本次考试中使用在其他位置创建的库密码文件
/home/student/ansible/secret.txt 正常运行。

下载文件

[student@workstation ansible]$ wget http://content.example.com/user_list.yml
--2023-06-08 20:25:11--  http://content.example.com/user_list.yml
Resolving content.example.com (content.example.com)... 172.25.254.254
Connecting to content.example.com (content.example.com)|172.25.254.254|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 107
Saving to: ‘user_list.yml’

user_list.yml           100%[============================>]     107  --.-KB/s    in 0s      

2023-06-08 20:25:11 (6.08 MB/s) - ‘user_list.yml’ saved [107/107]

[student@workstation ansible]$ 

编辑这个文件，考试不用

[student@workstation ansible]$ vim user_list.yml 
[student@workstation ansible]$ cat user_list.yml
users: 
- name: bob 
  job: developer 
  password_max_expire: 30
- name: sally 
  job: manager 
  password_max_expire: 30
- name: fred 
  job: developer 
  password_max_expire: 30
[student@workstation ansible]$ 

编写用户创建的剧本

[student@workstation ansible]$ cat user.yml
---
- name: create dev user
  hosts: dev,test
  vars_files:
    - locker.yml
    - user_list.yml
  tasks:
  - name: create group
    group:
      name: student
      state: present

  - name: create user
    user:
      name: "{{ item.name }}"
      password: "{{ pw_developer | password_hash('sha512') }}"
      groups: student
    loop: "{{ users }}"
    when: item.job == 'developer'

  - name: chane pass vaild date
    command: chage -M "{{ item.password_max_expire }}" "{{ item.name }}"
    loop: "{{ users }}"
    when: item.job == 'developer'


- name: create manager user
  hosts: prod
  vars_files:
    - locker.yml
    - user_list.yml
  tasks:
  - name: create group
    group:
      name: opsmgr
      state: present

  - name: create user
    user:
      name: "{{ item.name }}"
      password: "{{ pw_manager | password_hash('sha512') }}"
      groups: opsmgr
    loop: "{{ users }}"
    when: item.job == 'manager'

  - name: chane pass vaild date
    command: chage -M "{{ item.password_max_expire }}" "{{ item.name }}"
    loop: "{{ users }}"
    when: item.job == 'manager'

[student@workstation ansible]$ 

检查语法，并执行剧本

[student@workstation ansible]$ ansible-playbook --vault-id=secret.txt --syntax-check user.yml 

playbook: user.yml
[student@workstation ansible]$ ansible-playbook --vault-id=secret.txt user.yml 

第十五题 更新Ansible库的密钥

按照下方所述，更新现有 Ansible 库的密钥：
从 http://content.example.com/salaries.yml 下载 Ansible 库到 /home/student/ansible
当前的库密码为 insecure4sure
新的库密码为 bbe2de98389b
库使用新密码保持加密状态

[student@workstation ansible]$ wget
http://content.example.com/files/salaries.yml
[student@workstation ansible]$ ansible-vault rekey salaries.yml
Vault password: insecure4sure
New Vault password: bbe2de98389b
Confirm New Vault password: bbe2de98389b

第十六题 配置cron作业

创建名为/home/student/ansible/cron.yml 的剧本，在所有托管主机上运行为用户natasha创建如下
cron作业：
用户natasha必须配置运行每隔2分钟
执行logger “RH294 in progress” 的cron做作业

[student@workstation ansible]$ vim cron.yml
- name: create cron job for user natasha
  hosts: all
  tasks:
  - name: every 2 minutes
    cron:
      user: natasha
# 注意练习中使用student用户
      job: 'logger "RH294 in progress"'
      minute: "*/2"
      name: natasha
      state: present
[student@workstation ansible]$ ansible-playbook cron.yml