ansible 自动化配置管理

1什么是ansible

可以通过一个命令行完成一系列操作。

2ansible基础架构、控制端、被控端、链接协议

image.png

1.控制端通过主机清单（inventory）定义单个主机或将多个主机第一为逻辑上的一个组，这样我们就可以对不同的主机或不同的主机组做不同的操作
2.两种操作方式：
AD-Hoc 单条命令
playbook剧本
3.运行的不是shell命令，是由Python开发的模块（module）把模块推到被控端，
4.为保持安全可靠性，我们采用ssh协议
5.被控端在本地解析运行

ansible AD-Hoc单条命令

image.png

1.command

ansible webservers -a "ps axu|grep nginx" -i hosts  #不支持管道(简单命令)

2.shell

ansible webservers -m shell -a "ps axu|grep nginx" i hosts  #支持管道

3.yum

state:    
present         安装    
absent          卸载    
latest          最新 
enablerepo      指定使用按个仓库 
disablerepo     排除使用哪个仓库
1.安装最新的httpd服务 
[root@manager project1]# ansible webservers -m yum -a "name=httpd state=latest disablerepo=webtaticphp" -i hosts
2.移除httpd服务 
[root@manager project1]# ansible webservers -m yum -a "name=httpd state=absent disablerepo=webtaticphp" -i hosts
3.安装httpd指定从按个仓库安装 
- name: install the latest version of Apache from the testing repo 
[root@manager project1]# ansible webservers -m yum -a "name=httpd state=latest enablerepo=testing" -i hosts
4.通过URL方式进行安装
[root@manager project1]# ansible webservers -m yum -a "name=https://mirrors.aliyun.com/zabbix/zabbix/3.0/ rhel/7/x86_64/zabbix-agent-3.0.0-1.el7.x86_64.rpm state=present disablerepo=webtatic-php" -i hosts
- name: install nginx rpm from a local file  (软件包 必须在被控端主机) 
[root@manager project1]# ansible webservers -m yum -a "name=/root/zabbix-agent-4.0.0-2.el7.x86_64.rpm  state=present disablerepo=webtatic-php" -i hosts

4.copy

src     #本地路径,可以是相对,可以是绝对 
dest    #目标位置 
owner   #属主 
group   #属组 
mode    #权限 
backup  #备份
[root@manager project1]# ansible webservers -m copy -a "src=./file/ansible.oldxu.com.conf dest=/etc/nginx/conf.d/ansible.oldxu.com.conf owner=root group=root mode=644" -i hosts 
[root@manager project1]# ansible webservers -m copy -a "src=./file/ansible.oldxu.com.conf dest=/etc/nginx/conf.d/ansible.oldxu.com.conf owner=root group=root mode=644 backup=yes" -i hosts

5.service|systemd

state    
started         启动    
stopped         停止    
restarted       重启    
reloaded        重载 
enabled         是否开机自启    yes      是       no       否
[root@manager project1]# ansible webservers -m systemd -a "name=nginx state=restarted enabled=yes" -i hosts

6.file

创建 /code/ansible
path            路径 
state    
touch           创建文件    
directory       创建目录 
owner           属主 
group           属组 
mode            权限
准备站点 
[root@manager project1]# ansible webservers -m file -a "path=/code/ansible state=directory mode=755 owner=www group=www" -i hosts
准备站点代码
[root@manager project1]# ansible webservers -m copy -a "src=./file/index.html dest=/code/ansible/index.html owner=www group=www mode=644" -i hosts

7.user group

group   整数int   小数 flot  dasdsa str    真|假   bool 
[root@manager project1]# ansible webservers -m group -a  "name=www gid=666 state=present" -i hosts 
user name            名称 
uid             uid 
group           组名或gid 
create_home     是否创建家目录 
system          是否作为系统组 
shell           指定登录shell 
state    
present    absent remove groups append password

程序使用    www    666 666 /sbin/nologin    /home  -->无
[root@manager project1]# ansible webservers -m user -a "name=www uid=666 group=666 create_home=no shell=/sbin/nologin state=present" -i hosts
正常用户    oldxu  1000 1000 /bin/bash   /home/oldxu 
[root@manager project1]# ansible webservers -m user -a "name=oldxu" -i hosts
移除oldxu用户,并删除家目录所有内容. 
[root@manager project1]# ansible webservers -m user -a "name=oldxu state=absent remove=yes" -i hosts
创建 other用户.有两个附加组root bin,创建家目录,指定登录 shell,设定密码123
生成一个密码 
ansible all -i localhost, -m debug -a "msg={{ '123' | password_hash('sha512', 'mysecretsalt') }}"
[root@manager project1]# ansible webservers -m user -a 'name=other groups='root,bin' create_home=yes shell=/bin/bash password="$6$mysecretsalt$gIIYs0Xgc7sSQkH.zKaz8/Afa MomYzR1QZYtccwmJcUt8VpLq4D055UCCX4MlwgePOP80ZRwhppv BF72RIAVi/"' -i hosts

8.mount

提前准备好nfs服务端 
[root@web01 ~]# showmount -e 172.16.1.31 
Export list for 172.16.1.31: 
/data/zrlog 172.16.1.0/24 
/data/zh    172.16.1.0/24 
/data/edu   172.16.1.0/24
/data/blog  172.16.1.0/24
用管理端操作被控端,让被控端挂载nfs存储数据 
present     写入/etc/fstab 
absent      卸载/etc/fstab
mounted     临时挂载 
unmounted   卸载当前挂载
挂载过程中,如果目录不存在,则会创建该目录 
[root@manager project1]# ansible webservers -m mount -a "src=172.16.1.31:/data/zrlog path=/test_zrlog fstype=nfs opts=defaults state=mounted" -i hosts
[root@manager project1]# ansible webservers -m mount -a "src=172.16.1.31:/data/zrlog path=/test_zrlog fstype=nfs opts=defaults state=unmounted" -i hosts

9.cron

minute      分 
hour        时 
day         日 
month       月 
week        周 
job   
创建定时任务      
[root@manager project1]# ansible webservers -m cron -a 'name=test_job minute=00 hour=02 job="/bin/bash /server/scripts/client_to_data_server.sh &>/dev/null"' -i hosts
[root@manager project1]# ansible webservers -m cron -a 'name=test  job="/bin/bash /server/scripts/test.sh &>/dev/null"' -i hosts
删除上个定时任务
[root@manager project1]#  ansible webservers -m cron -a 'name=test  job="/bin/bash /server/scripts/test.sh &>/dev/null" state=absent' -i hosts

10.firewalld

[root@manager project1]# ansible webservers -m systemd -a "name=firewalld state=started" -i hosts
针对服务 
[root@manager project1]# ansible webservers -m firewalld -a "service=http state=enabled" -i hosts
针对端口 
[root@manager project1]# ansible webservers -m firewalld -a "port=9999/tcp state=enabled" -i hosts
针对source来源
针对rule

11.selinux

[root@manager project1]# ansible webservers -m selinux -a "state=disabled" -i hosts