红帽认证笔记

1.安装和配置Ansible

sudo yum-config-manager --add-repo=http://content.example.com/rhel8.0/x86_64/ucfupdates/

inventory

node1
node2
node3
node4
node5

[dev]
node1

[test]
node2

[prod]
node3
node4

[balancers]
node5

[webservers:children]
prod

ansible.cfg

[defaults]
inventory = /home/greg/ansible/inventory
remote_user = greg
ask_pass = false
roles_path = /home/greg/ansible/roles

[privilege_escalation]
become=yes
become_method=sudo
become_user=root
become_ask_pass=False

记得创建roles目录

mkdir /home/greg/ansible/roles

2.创建和运行Ansible临时命令

adhoc.sh

#!/bin/bash

ansible all -m yum_repository -a 'name="EX294_BASE" description="EX294 base software" baseurl="http://repo.domainx.example.com/BaseOS" gpgcheck=yes gpgkey="http://repo.domainx.example.com/RPM-GPG-KEY-redhat-release"'
ansible all -m yum_repository -a 'name="EX294_STREAM" description="EX294 stream software" baseurl="http://repo.domainx.example.com/AppStream" gpgcheck=yes gpgkey="http://repo.domainx.example.com/RPM-GPG-KEY-redhat-release"'

3.安装软件包

packages.yml

---
- name: install pkg
  hosts: dev,test,prod
  tasks:
    - name: use yum module install pkg
      yum:
        name:
          - php
          - mariadb
        state: latest

- name: install pkg
  hosts: dev
  tasks:
    - name: install rpm tools
      yum:
        name: "@RPM Development Tools"
        state: latest

    - name: update all version
      yum:
        name: "*"
        state: latest

adhoc使用shell模块检查现象

ansible all -m shell -a 'rpm -qa | grep php'
ansible dev,test,prod -m shell -a 'rpm -qa | grep mariadb'
ansible dev,test,prod -m shell -a 'yum group list'

4.使用RHEL系统角色

第一步，查询系统role的安装包并安装

 yum list | grep role

sudo yum -y install rhel-system-roles

第二步，查询安装包的路径

#查询安装的roles路径
[greg@control ansible]$ rpm -qa | grep role
rhel-system-roles-1.0-5.el8.noarch
[greg@control ansible]$ rpm -ql rhel-system-roles

第三步，将系统role的安装路径配置到ansible.cfg中

roles_path = /home/greg/ansible/roles:/usr/share/ansible/roles/

4.查看系统role里本题需要使用的变量
vim /usr/share/ansible/roles/linux-system-roles.timesync/tasks/main.yml


5.timesync.yml:

---
- name: use system role
  hosts: all
  vars:
    timesync_ntp_servers:
            - hostname: 172.25.254.254
              iburst: yes
  roles:
    - rhel-system-roles.timesync

playbook运行之前检查所有主机的NTP的状况

运行playbook之后

selinux.yml

---
- name: set selinux
  hosts: all
  vars:
        selinux_policy: targeted
        selinux_state: enforcing
  roles:
        - rhel-system-roles.selinux

5.使用Ansible Galaxy安装角色

requirements.yml

- src: http://rhgls.domainx.example.com/materials/haproxy.tar
  name: balancer

- src: http://rhgls.domainx.example.com/materials/phpinfo.tar
  name: phpinfo

将requirements.yml复制一份到roles目录里

cp /home/greg/ansible/requirements.yml /home/greg/ansible/roles/

执行命令安装

ansible-galaxy install -r ./requirements.yml

查看安装的role

ansible-galaxy --list

6.创建一个web role

1.初始化role

ansible-galaxy init apache

2.安装httpd包，并启动httpd服务，设置服务下次开机启动
启动防火墙服务，设置防火墙服务下次开机启动，放行web流量

vim /home/greg/ansible/roles/apache/tasks/main.yml

---
- name: install pkg
  yum:
    name: httpd
    state: latest

- name: set httpd service
  service:
    name: httpd
    state: started
    enabled: yes

- name: set firewall service
  service:
    name: firewalld
    state: started
    enabled: yes

- name: set firewall to allow http traffic
  firewalld:
    service: http
    immediate: yes
    permanent: yes
    state: enabled

- name: set web content
  template:
    src: index.html.j2
    dest: /var/www/html/index.html

3.创建版模
vim /home/greg/ansible/roles/apache/templates/index.html.j2

Welcome to {{ ansible_fqdn }} on {{ ansible_default_ipv4['address'] }}

4.apache.yml

---
- name: use apache role
  hosts: webservers
  roles:
    - apache

curl node3
Welcome to node3.domainx.example.com on 172.25.250.11
curl node4
Welcome to node4.domainx.example.com on 172.25.250.12

7.从Ansible galaxy中使用角色

role.yml

---
- name: use haproxy role
  hosts: balancers
  roles:
    - balancer

- name: use phpinfo role
  hosts: webservers
  roles:
    - phpinfo

放开node5的防火墙

 sudo firewall-cmd --list-all
 sudo firewall-cmd --add-port=80/tcp
 sudo firewall-cmd --add-port=80/tcp --per

8.创建和使用逻辑卷

创建之前

---
- name: create lv
  hosts: all
  tasks:
    - block:
        - name: use lv module crate lv
          lvol:
            vg: research
            lv: data
            size: 1500

        - name: create a ext4
          filesystem:
            fstype: ext4
            dev: /dev/research/data

      rescue:
        - name: output some info
          debug:
            msg: Could not create logical volume of that size
          when: ansible_lvm.vgs.research is defined

        - name: use module create lv 800
          lvol:
            vg: research
            lv: data
            size: 800
          when: ansible_lvm.vgs.research is defined

        - name: create a ext4
          filesystem:
            fstype: ext4
            dev: /dev/research/data
          when: ansible_lvm.vgs.research is defined

        - name: output some info
          debug:
            msg: Volume group does not exist
          when: ansible_lvm.vgs.research is undefined

创建后

9.生成主机文件

wget http://rhgls.domainx.example.com/materials/hosts.j2

hosts.j2模板

127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
{% for host in groups['all'] %}
{{ hostvars[host]['ansible_default_ipv4']['address'] }} {{ hostvars[host]['ansible_fqdn'] }} {{ hostvars[host]['ansible_hostname'] }}
{% endfor %}

hosts.yml

---
- name: crate a host file
  hosts: all
  tasks:
    - name: template a host file
      template:
        src: hosts.j2
        dest: /etc/myhosts
      when: '"dev" in group_names'

检查现象

ansible all -a 'cat /etc/myhosts'

10.修改文件内容

issue.yml

---
- name: modify file content
  hosts: all
  tasks:
    - name: modify content
      copy:
        content: Development
        dest: /etc/issue
      when: '"dev" in group_names'

    - name: modify content
      copy:
        content: Test
        dest: /etc/issue
      when: '"test" in group_names'

    - name: modify content
      copy:
        content: Production
        dest: /etc/issue
      when: '"prod" in group_names'

检查现象

ansible all -a 'cat /etc/issue'

11.创建web内容目录

webcontent.yml

---
- name: create web content
  hosts: dev
  tasks:
    - name: create directory
      file:
        path: /webdev
        state: directory
        group: webdev
        mode: "2775"
        setype: "httpd_sys_content_t"

    - name: create a soft link
      file:
        src: /webdev
        dest: /var/www/html/webdev
        state: link

    - name: set web content
      copy:
        content: Development
        dest: /webdev/index.html
        setype: "httpd_sys_content_t"

    - name: start httpd service
      service:
        name: httpd
        state: started
        enabled: yes

    - name: set firewall rule to allow http traffic
      firewalld:
        service: http
        permanent: yes
        immediate: yes
        state: enabled

检查现象

curl http://node1.domainx.example.com/webdev/

12.生成硬件报告

hwreport.yml

---
- name: create hardware report
  hosts: all
  vars:
    hardware:
      - hw_name: HOST
        hw_info: "{{ ansible_hostname }}"
      - hw_name: MEMORY
        hw_info: "{{ ansible_memtotal_mb }}"
      - hw_name: BIOS
        hw_info: "{{ ansible_bios_version }}"
      - hw_name: DISK_SIZE_VDA
        hw_info: "{{ ansible_devices['vda']['size'] | default('NONE') }}"
      - hw_name: DISK_SIZE_VDB
        hw_info: "{{ ansible_devices['vdb']['size'] | default('NONE') }}"

  tasks:
    - name: get hw report from url
      get_url:
        url: http://rhgls.domainx.example.com/materials/hwreport.empty
        dest: /root/hwreport.txt

    - name: set hw report content
      lineinfile:
        path: /root/hwreport.txt
        regexp: "^{{ item['hw_name'] }}="
        line: "{{ item['hw_name'] }}={{ item['hw_info'] }}"
      loop: "{{ hardware }}"

检查现象

ansible all -a 'cat /root/hwreport.txt'

13.使用Ansible Vault

locker.yml

pw_developer: Imadev
pw_manager: Imamgr

ansible-vault encrypt --vault-id=./secret.txt locker.yml

ansible-vault view --vault-id=./secret.txt locker.yml

14.创建批量添加用户role

wget http://rhgls.domainx.example.com/materials/user_list.yml

users.yml

---
- name: create user on dev and test
  hosts: dev,test
  vars_files:
    - locker.yml
    - user_list.yml
  tasks:
    - name: create group
      group:
        name: devops
    - name: create user
      user:
        name: "{{ item['name'] }}"
        password: "{{ pw_developer | password_hash('sha512','mysecretsalt') }}"
        expires: "{{ item['password_expire_MAX'] }}"
        groups: devops
      loop: "{{ users }}"
      when: item.job == 'developer'

- name: create user on prod
  hosts: prod
  vars_files:
    - locker.yml
    - user_list.yml
  tasks:
    - name: create group
      group:
        name: opsmgr
    - name: create user
      user:
        name: "{{ item['name'] }}"
        password: "{{ pw_manager | password_hash('sha512','mysecretsalt') }}"
        expires: "{{ item['password_expire_MAX'] }}"
        uid: 6666
        groups: opsmgr
      loop: "{{ users }}"
      when: item.job == 'manager'

ansible-playbook --vault-id=./secret.txt users.yml

15. 重新设置Ansible Vault密码

wget http://rhgls.domainx.example.com/materials/salaries.yml

ansible-vault rekey salaries.yml

检查是否解密成功

ansible-vault view salaries.yml

[greg@control ansible]$ ansible-vault rekey salaries.yml 
Vault password: 
New Vault password: 
Confirm New Vault password: 
Rekey successful
[greg@control ansible]$ ansible-vault view salaries.yml 
Vault password: 
Your salaries is 1 million per month
[greg@control ansible]$

16 创建定时任务

cron.yml

---
- name: set cron
  hosts: all
  tasks:
    - name: use crond module create task
      user:
        name: natasha

    - name: set cron
      cron:
        user: natasha
        minute: "*/2"
        job: logger "EX294 in progress"

这个环境里并没有创建natasha的用户，要自己创建下

检查现象

ansible all -a 'crontab -l -u natasha'

echo "rhce11uid15620842" > ~/wait-grade