Linux —— ansible自动化运维（四）
目录
管理变量和事实
实验
总结
实施任务控制
编写循环
条件任务语法
when支持使用列表描述条件
组合循环和有条件任务
编写循环和条件任务
实施处理程序
管理变量和事实
实验
使用基本身份认证的httpd
- 基本信息配置
cd /mnt/
mkdir westos
cd westos/
vim ansible.cfg ## 书写ansible.cfg文件
###
[defaults]
inventory = ./inventory
###
vim inventory
###
[web]
servera.dsd.com
###- 书写playbook
vim playbook.yml
###
---
- name: Webserver Vars
hosts: web
vars:
firewall_pkg: firewalld
firewall_srv: firewalld
web_pkg: httpd
web_srv: httpd
ssl_pkg: mod_ssl
httpdconf_src: files/httpd.conf
httpdconf_dest: /etc/httpd/conf/httpd.conf
secrets_dir: /etc/httpd/secrets
secrets_src: files/htpasswd
secrets_dest: "{{ secrets_dir }}/htpasswd"
web_root: /var/www/html
tasks:
- name: Install packages
yum:
name:
- "{{ firewall_pkg }}"
- "{{ web_pkg }}"
- "{{ ssl_pkg }}"
- name: Configure Service
copy:
src: "{{ httpdconf_src }}"
dest: "{{ httpdconf_dest }}"
owner: root
group: root
mode: 0644
- name: Create Secrets Directory
file:
path: "{{ secrets_dir }}"
state: directory
owner: apache
group: apache
mode: 0500
- name: Create htpasswd
copy:
src: "{{ secrets_src }}"
dest: "{{ secrets_dest }}"
owner: apache
group: apache
mode: 0400
- name: Create index.html
copy:
content: "{{ ansible_facts['fqdn'] }} ({{ ansible_facts['all_ipv4_addresses'] }})"
dest: "{{ web_root }}/index.html"
- name: Configure firewalld service
service:
name: "{{ firewall_srv }}"
state: started
enabled: true
- name: Firewalld permit https
firewalld:
service: https
state: enabled
immediate: true
permanent: true
- name: Configure apache service
service:
name: "{{ web_srv }}"
state: started
enabled: true
- name: Test Apache
hosts: localhost
become: no
vars:
- web_user: admin
vars_files:
- vars/secret.yml
tasks:
- name: Connect Apache with Auth
uri:
url: https://servera.dsd.com
validate_certs: no
force_basic_auth: yes
user: "{{ web_user }}"
password: "{{ web_pass }}" ## 定义访问apache的用户密码
return_content: yes
register: auth_test
- debug:
var: auth_test.content
...
###检测playbook语法是否有问题
- 创建加密文件
mkdir vars
ansible-vault create vars/secret.yml ## 创建加密文件,设置密码为redhat
###
web_pass:redhat
###
- 创建files目录
## workstation主机中
mkdir files
## servera主机中
scp httpd.conf [email protected]:/mnt/westos/files
htpasswd -cm htpasswd admin
scp htpasswd [email protected]:/mnt/westos/files
## workstation主机中
vim httpd.conf
###
AuthUserFile /etc/httpd/secrets/htpasswd
AuthType basic
AuthName "Welcome to westos!"
Require user admin
Require valid-user
### 
- 语法检测并运行
ansible-playbook --syntax-check --vault-id @prompt playbook.yml ## 检测playbook.yml
ansible-playbook --vault-id @prompt playbook.yml ## 运行
总结
- 变量能够让playbook复用
- 可以给清单中的主机和主机组定义变量
- 可以使用事实和外部文件定义变量，也可以在命令行中
- register关键字可以用于捕获命令输出
- ansible vault
- ansible事实是从受管主机自动检测到的变量
实施任务控制
编写循环
- 不用循环
---
- name: test
hosts: web
tasks:
- name: apache is running
service:
name: httpd
state: started
- name: vsftpd is running
service:
name: vsftpd
state: started
...- 使用循环
---
- name: test
hosts: web
tasks:
- name: apache and vsftpd is running
service:
name: "{{ item }}" # 循环变量item
state: started
loop:
- httpd
- vsftpd
...
- 将变量放入列表
---
- name: test
hosts: web
vars:
web_service:
- httpd
- vsftpd
tasks:
- name: apache and vsftpd is running
service:
name: "{{ item }}" # 循环变量item
state: started
loop: "{{ web_service }}"
...
- 循环散列或字典列表
---
- name: User Test
user:
name: "{{ item.name }}"
state: present
groups: "{{ item.groups }}"
loop:
- name: westos
groups: westos
- name: redhat
groups: root
...早些版本的循环，使用的是with_
vars:
data:
- user1
- user2
- user3
tasks:
- name: "with_items"
debug:
msg: "{{ item }}"
with_items: "{{ data }}"- register和loop同时使用
---
- name: loop register test
gather_facts: no
hosts: localhost
tasks:
- name: loop echo task
shell: "echo This is my item: {{ item }}"
loop:
- one
- two
register: echo_results ## 注册变量
- name: Show echo results variable
debug:
var: echo_results ## 显示变量结果
...
- 迭代test3.yml的结果
---
- name: loop register test
gather_facts: no
hosts: localhost
tasks:
- name: loop echo task
shell: "echo This is my item: {{ item }}"
loop:
- one
- two
register: echo_results ## 注册变量
- name: Show echo results variable
debug:
msg: "STDOUT from previous task: {{ item.stdout }}"
loop: "{{ echo_result['results']}}"
...
条件任务语法
关键字：when
- 布尔值测试
---
- name: Boolean test
hosts: all
vars:
run_my_task: true ## 只有当变量为true时,才会执行
tasks:
- name: httpd is installed
yum:
name: httpd
when: run_my_task
...测试 my_service 变量是否有值，有值则安装
---
- name: Boolean test
hosts: all
vars:
my_service: httpd
tasks:
- name: "{{ my_service }} is installed"
yum:
name: "{{ my_service }}"
when: my_service is defined
...| 等于(字符串) | A == "B" |
| 等于(数字) | A == 100 |
| 小于 | < |
| 大于 | > |
| 小于等于 | <= |
| 大于等于 | >= |
| 不等于 | != |
| 变量存在 | xxx is defined |
| 变量不存在 | xxx is not defined |
| 布尔值true | 1、true、yes |
| 布尔值false | 0、false、no |
| 第一个变量的值存在，且在第二个变量的列表中 | A in B |
测试多个条件：
| or | 两个条件一个为真即可 |
| and | 两个条件必须都为真 |
when支持使用列表描述条件
when:
- ansible_distribution_version == "8.0"
- ansible_kernel == "4.18.0-80.1.2.el8_0.x86_64"
或者:
when:
( ansible_distribution == "RedHat" and
ansible_distribution_major_version == "8" )
or
( ansible_distribution == "CentOS" and
ansible_distribution_major_version == "7" )组合循环和有条件任务
实验一：
---
- name: keyword
hosts: all
tasks:
- name: install db if enough space
yum:
name: mariadb-server
state: latest
loop: "{{ ansible_mounts }}" ## 这个变量是事实,已知的
when: item.mount == "/" and item.size_available > 300000000
...
实验二：
---
- name: Restart httpd if vsftpd is running
hosts: all
tasks:
- name: Get vsftpd status
command: /usr/bin/systemctl is-active vsftpd ## 判断状态
ignore_errors: yes ## 如果vsftpd没运行或者失败,则忽略
register: result ## 定义变量保存结果
- name: Restart httpd
service:
name: httpd
state: restarted
when: result.rc == 0 ## 退出码为0,则重启httpd
...
编写循环和条件任务
mkdir control-flow
vim ansible.cfg
###
[defaults]
inventory = ./inventory
###
vim inventory
###
[westos1]
servera.lab.example.com
[westos2]
serverb.lab.example.com
###- 编写playbook
---
- name: Mariadbisrunning
hosts: westos1
vars:
mariadb_pkgs:
- mariadb-server
- python3-PyMySQL
tasks:
- name: Mariadb is installed
yum:
name: "{{item}}"
state: present
loop: "{{mariadb_pkgs}}"
- name: Start Mariadb
service:
name: mariadb
state: started
enabled: true
...
- 修改playbook，条件变为受管主机使用redhat操作系统时才执行
---
- name: Mariadb is running
hosts: westos2
vars:
mariadb_pkgs:
- mariadb-server
- python3-PyMySQL
tasks:
- name: Mariadb is installed
yum:
name: "{{item}}"
state: present
loop: "{{ mariadb_pkgs }}"
when:ansible_distribution=="RedHat"
...- 检测westos2组的主机系统
ansible westos2 -m command -a 'cat /etc/redhat-release' -u student --become实施处理程序
处理程序是响应由其他任务出发的通知的任务
- 只有在template任务通知已发生更改时才会触发
---
- name: Test
hosts: webservers
tasks:
- name: Copyt File
template:
src:files/example.conf
dest:/etc/httpd/conf.d/example.conf
notify: #notify语句指出该任务需要触发一个处理程序
- restart apache #程序名
handlers: #表示处理程序任务列表的开头
- name: restart apache #被任务调用的处理程序名称
service: #处理该程序的模块
name: httpd
state: restarted- ansible把notify语句当作数组
mkdir files
vim filse/examplee.conf
###
DocumentRoot/www
ServerNamewww.westos.org
DocumentRoot/bbs
ServerNamebbs.westos.org
### - 编写playbook
---
- name: Test
hosts: webservers
tasks:
- name: CopytFile
template:
src: files/example.conf
dest:/etc/httpd
dest:/etc/httpd/conf.d/example.conf
notify:
- restartapache
- restart mysql
handlers:
- name: restart apache
service:
name:httpd state:restarted -name:restartmysql
service: name:mariadb state:restarted #使用处理程序注意： 、
- 理程序始终按照play的handlers部分指定的顺序运行，不按notify里的
- 处理程序通常在相关play中所有其他任务运行完后运行
- 处理程序名称存在于个play命名空间中（如果两个处理程序同名，只会运行一个）
- 如果多个任务通知处理程序，处理程序也只会运行一次 5.如果包含notify的语句任务没有报告changed结果，则处理程序不会获得通知