Ansible自动化运维工具

Ansible自动化运维工具

1.Ansible的简介

1.1 什么是ansible

Ansible是一款自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能

1.2 ansible的特点

• 部署简单，只需在主控端部署 Ansible 环境，被控端无需做任何操作
• 默认使用 SSH（Secure Shell）协议对设备进行管理
• 主从集中化管理
• 配置简单、功能强大、扩展性强
• 支持 API 及自定义模块，可通过 Python 轻松扩展
• 通过 Playbooks 来定制强大的配置、状态管理
• 对云计算平台、大数据都有很好的支持
• 提供一个功能强大、操作性强的 Web 管理界面和 REST API 接口 ---- AWX 平台

2. ansible的架构

• Ansible：Ansible核心程序
• HostInventory：记录由Ansible管理的主机信息，包括端口、密码、ip等
• Playbooks：“剧本”YAML格式文件，多个任务定义在一个文件中，定义主机需要调用哪些模块来完成的功能
• CoreModules：核心模块，主要操作是通过调用核心模块来完成管理任务
• CustomModules：自定义模块，完成核心模块无法完成的功能，支持多种语言
• ConnectionPlugins：连接插件，Ansible和Host通信使用

3.ansible执行流程

简单理解就是Ansible在运行时，首先读取ansible.cfg中的配置，根据规则获取Inventory中的管理主机列表，并行的在这些主机中执行配置的任务，最后等待执行返回的结果

4.安装ansible

控制主机：192.168.72.131
被控主机：192.168.72.132

4.1 控制主机

//安装epel源
[root@localhost ~]# yum -y install epel-release
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
警告：加载 '/etc/yum.repos.d/CentOS-Base.repo' 失败，跳过。
上次元数据过期检查：0:41:11 前，执行于 2021年07月13日 星期二 03时39分51秒。
软件包 epel-release-8-11.el8.noarch 已安装。
依赖关系解决。
无需任何处理。
完毕！


//安装ansible
[root@localhost yum.repos.d]# yum -y install ansible
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
警告：加载 '/etc/yum.repos.d/CentOS-Base.repo' 失败，跳过。
Extra Packages for Enterprise Linux Modular 8 - x86_  38 kB/s | 663 kB     00:17    
Extra Packages for Enterprise Linux 8 - x86_64       655 kB/s |  10 MB     00:15    
上次元数据过期检查：0:00:07 前，执行于 2021年07月13日 星期二 03时39分51秒。
依赖关系解决。
......
已升级:
  platform-python-pip-9.0.3-19.el8.noarch                                            
  platform-python-setuptools-39.2.0-6.el8.noarch                                     

已安装:
  ansible-2.9.23-1.el8.noarch                                                        
  libsodium-1.0.18-2.el8.x86_64                                                      
  python3-babel-2.5.1-5.el8.noarch                                                   
  python3-bcrypt-3.1.6-2.el8.1.x86_64                                                
  python3-jinja2-2.10.1-2.el8_0.noarch                                               
  python3-jmespath-0.9.0-11.el8.noarch                                               
  python3-markupsafe-0.23-19.el8.x86_64                                              
  python3-paramiko-2.4.3-1.el8.noarch                                                
  python3-pip-9.0.3-19.el8.noarch                                                    
  python3-pyasn1-0.3.7-6.el8.noarch                                                  
  python3-pynacl-1.3.0-5.el8.x86_64                                                  
  python3-pytz-2017.2-9.el8.noarch                                                   
  python3-pyyaml-3.12-12.el8.x86_64                                                  
  python3-setuptools-39.2.0-6.el8.noarch                                             
  python36-3.6.8-2.module_el8.4.0+790+083e3d81.x86_64                                
  sshpass-1.06-9.el8.x86_64                                                          

完毕！

4.2 被控主机

//安装网络源
[root@localhost ~]# wget -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-8.repo


//安装epel源
[root@localhost yum.repos.d]# yum -y install epel-release
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
警告：加载 '/etc/yum.repos.d/CentOS-Base.repo' 失败，跳过。
CentOS-8 - Base - mirrors.aliyun.com                 1.1 MB/s | 3.6 MB     00:03    
CentOS-8 - Extras - mirrors.aliyun.com                16 kB/s | 9.8 kB     00:00   
......
  验证    : epel-release-8-11.el8.noarch                                         1/1 
Installed products updated.

已安装:
  epel-release-8-11.el8.noarch                                                       

完毕！

// 安装ansible
[root@localhost ~]# yum -y install ansible
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
警告：加载 '/etc/yum.repos.d/CentOS-Base.repo' 失败，跳过。
Extra Packages for Enterprise Linux Modular 8 - x86_ 118 kB/s | 663 kB     00:05 
......

已升级:
  platform-python-pip-9.0.3-19.el8.noarch                                            
  platform-python-setuptools-39.2.0-6.el8.noarch                                     

已安装:
  ansible-2.9.23-1.el8.noarch                                                        
  libsodium-1.0.18-2.el8.x86_64                                                      
  python3-babel-2.5.1-5.el8.noarch                                                   
  python3-bcrypt-3.1.6-2.el8.1.x86_64                                                
  python3-jinja2-2.10.1-2.el8_0.noarch                                               
  python3-jmespath-0.9.0-11.el8.noarch                                               
  python3-markupsafe-0.23-19.el8.x86_64                                              
  python3-paramiko-2.4.3-1.el8.noarch                                                
  python3-pip-9.0.3-19.el8.noarch                                                    
  python3-pyasn1-0.3.7-6.el8.noarch                                                  
  python3-pynacl-1.3.0-5.el8.x86_64                                                  
  python3-pytz-2017.2-9.el8.noarch                                                   
  python3-pyyaml-3.12-12.el8.x86_64                                                  
  python3-setuptools-39.2.0-6.el8.noarch                                             
  python36-3.6.8-2.module_el8.4.0+790+083e3d81.x86_64                                
  sshpass-1.06-9.el8.x86_64                                                          

完毕！

5.部署ansible

5.1 构建ansible清单

//使用静态清单指定受管主机
[root@localhost ansible]# vim ansible.cfg 
[defaults]
inventory = ./inventory
[root@localhost ansible]# touch inventory
[root@localhost ansible]# ls
ansible.cfg  hosts  inventory  roles
[root@localhost ansible]# 


//添加受管主机
[root@localhost ansible]# vim inventory 
192.168.72.132

[webservers]
192.168.72.100


//使用命令列出默认清单文件中所有受管主机
[root@localhost ansible]# ansible all --list-hosts
  hosts (2):
    192.168.72.132
    192.168.72.100
[root@localhost ansible]# 


//使用以下命令列出不属于任何组的受管主机
[root@localhost ansible]# ansible ungrouped --list-hosts
  hosts (1):
    192.168.72.132


//使用以下命令列出属于某组的受管主机
[root@localhost ansible]# ansible webservers --list-hosts
  hosts (1):
    192.168.72.100


//添加用户 密码
[root@localhost ansible]# vim inventory 
[webservers]
192.168.72.132 ansible_user=root ansible_password=1


//ping
[root@localhost ansible]# ansible all -m ping
192.168.72.132 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false,
    "ping": "pong"
}
[root@localhost ansible]# 

// 做ssh 互信
[root@localhost ansible]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:qLrUPsoU94bv3PwfpopFHdgLDSCM3O9rqXC6flYOn1U root@localhost.localdomain
The key's randomart image is:
+---[RSA 3072]----+
| . +. ...        |
|  o o.   =       |
|     .  o +      |
|      .. oEo     |
|  . ... S.o      |
|   +.+o..        |
|  + ==o=.   o    |
| + *++B=   o .   |
| .O*o== +oo..    |
+----[SHA256]-----+
[root@localhost ansible]# 
[root@localhost ansible]# ssh-copy-id root@192.168.72.132
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.72.132's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.


//删除用户和密码 ping主机
[root@localhost ansible]# vim inventory
[webservers]
192.168.72.132

[root@localhost ansible]# ansible all -m ping
192.168.72.132 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false,
    "ping": "pong"
}
[root@localhost ansible]# 


//移动清单文件ping主机需要指定移动到的目录
[root@localhost ansible]# mv inventory /opt/
[root@localhost ansible]# ls /opt/
inventory
[root@localhost ansible]# ansible all -m ping
[WARNING]: Unable to parse /etc/ansible/inventory as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the
implicit localhost does not match 'all'
[root@localhost ansible]# ansible all -i /opt/inventory -m ping
192.168.72.132 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false,
    "ping": "pong"
}
[root@localhost ansible]#