什么是ansible?
ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。
ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
- 连接插件connection plugins：负责和被监控端实现通信；
- host inventory：指定操作的主机，是一个配置文件里面定义监控的主机；
- 各种模块核心模块、command模块、自定义模块；
- 借助于插件完成记录日志邮件等功能；
- playbook：剧本执行多个任务时，非必需可以让节点一次性运行多个任务。
安装ansible
ansible只需在一台主机上安装即可，不需在客户端主机安装ansible，其它节点ansible会通过ssh协议进行通讯。
安装ansible
[root@192 ~]# yum -y install ansible
配置ansible
ansible配置文件有多个，查找顺序如下:
1. 环境变量ANSIBLE_CONFIG所指向的位置
2. 工作空间当前目录下的ansible.cfg
3. HOME目录下的配置文件:~/.ansible.cfg
4. /etc/ansible/ansible.cfg
ansible常见配置参数:
inventory=~/ansible_hosts：表示主机清单inventory文件的位置。
forks=5：并发连接数，默认为5。
sudo_user=root：设置默认执行命令的用户。
remote_port=22：指定连接被管节点的管理端口，默认为22端口。建议修改，能够更加安全。
host_key_checking=False：设置是否检查SSH主机的密钥，值为True/False。关闭后第一次连接不会提示配置实例。
timeout=60：设置SSH连接的超时时间，单位为秒。
log_path=/var/log/ansible.log：指定一个存储Ansible日志的文件（默认不记录日志）。
inventory文件
Ansible可同时操作属于一个组的多台主机，是通过inventory文件配置来实现的，组与主机的关系也是由inventory来定义的。默认inventory文件路径为/etc/ansible/hosts，我们也可以通过Ansible的配置文件来指定inventory文件位置。除默认文件外，可以同时使用多个inventory文件，也可以从动态源或云上拉取inventory配置信息。
inventory配置主机列表示例:
[root@192 ~]# vim ansible_hosts
192.168.237.201
[database]
192.168.237.202 ansible_ssh_user=root
[tomcat]
192.168.237.203 ansible_ssh_user=root
ansible ping测试主机连接情况
未授权访问的情况下直接ping
[root@ansible_controller ~]# ansible all -m ping
The authenticity of host '192.168.237.201 (192.168.237.201)' can't be established.
ECDSA key fingerprint is SHA256:bpxlCrtv14dMu1VcNEz3FsEDZnIgMcbevbFJeBgisuE.
ECDSA key fingerprint is MD5:70:c2:86:39:d1:eb:69:62:f8:b2:8c:4f:ed:55:72:41.
Are you sure you want to continue connecting (yes/no)? The authenticity of host '192.168.237.203 (192.168.237.203)' can't be established.
ECDSA key fingerprint is SHA256:bpxlCrtv14dMu1VcNEz3FsEDZnIgMcbevbFJeBgisuE.
ECDSA key fingerprint is MD5:70:c2:86:39:d1:eb:69:62:f8:b2:8c:4f:ed:55:72:41.
Are you sure you want to continue connecting (yes/no)? The authenticity of host '192.168.237.202 (192.168.237.202)' can't be established.
ECDSA key fingerprint is SHA256:bpxlCrtv14dMu1VcNEz3FsEDZnIgMcbevbFJeBgisuE.
ECDSA key fingerprint is MD5:70:c2:86:39:d1:eb:69:62:f8:b2:8c:4f:ed:55:72:41.
Are you sure you want to continue connecting (yes/no)? yes
192.168.237.201 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Warning: Permanently added '192.168.237.201' (ECDSA) to the list of known hosts.\r\nPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password).\r\n",
"unreachable": true
}
192.168.237.203 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Could not create directory '/root/.ssh'.\r\nHost key verification failed.\r\n",
"unreachable": true
}
192.168.237.202 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Could not create directory '/root/.ssh'.\r\nHost key verification failed.\r\n",
"unreachable": true
}
使用密码执行ping命令
[root@ansible_controller ~]# ansible all -m ping --ask-pass
SSH password:
192.168.237.202 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.237.201 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.237.203 | SUCCESS => {
"changed": false,
"ping": "pong"
}
配置免密登录
#在ansible主机上生成密钥
[root@ansible_controller ~]# ssh-keygen -t rsa -f /root/.ssh/id_rsa -N ''
#将私钥拷贝到客户端主机
[root@ansible_controller ~]# ssh-copy-id 192.168.237.201
[root@ansible_controller ~]# ssh-copy-id 192.168.237.202
[root@ansible_controller ~]# ssh-copy-id 192.168.237.203
#测试免密登录，并退出
[root@ansible_controller ~]# ssh 192.168.237.201
Last login: Fri Mar 13 23:04:44 2020 from 192.168.237.200
[root@ansible_follower1 ~]# exit
logout
Connection to 192.168.237.201 closed.
免密码登录情况下测试主机连接情况
[root@ansible_controller ~]# ansible all -m ping
192.168.237.203 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.237.202 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.237.201 | SUCCESS => {
"changed": false,
"ping": "pong"
}
测试主机分组网络连接情况
[root@ansible_controller ~]# ansible database -m ping
192.168.237.202 | SUCCESS => {
"changed": false,
"ping": "pong"
}
ansible cron时钟同步
时钟服务器:
- 阿里云时钟源(国内):time1.aliyun.com
- 微软时钟源(国外): time.windows.com
# 命令格式
[root@ansible_controller ~]# ansible 主机清单中的ip或分组名称 -m 模块 -a "参数"
#尝试同步时间到控制节点
[root@ansible_controller ~]# ntpdate time1.aliyun.com
#查看客户端主机定时任务列表
[root@ansible_follower1 ~]# crontab -l
#ansible controller上分发定时时钟同步任务(每小时执行一次)
[root@ansible_controller ~]# ansible 192.168.237.201 -m cron -a 'name="time sync" job="ntpdate time1.aliyun.com" minute=0 hour=*/1'
#检验定时任务是否分发成功
[root@ansible_follower1 ~]# crontab -l
#Ansible: time sync
0 */1 * * * ntpdate time1.aliyun.com
ansible 复制文件到服务器
[root@ansible_controller ~]# ansible 192.168.237.201 -m copy -a "src=/etc/hosts dest=/etc/hosts"