ansible的原理与初步使用
1、Ansible基本简介：
1 Ansible是什么？
Ansible是一个适用于成百上千规模的受控节点的配置管理、应用程序部署、内部服务编排等诸多功能于一身的极为简单的IT运维自动化工具引擎，基于Python开发。她无需代理，很容易部署，除SSH外没有其他安全基础设施/配置要求。她使用了一个非常简单的语言（YAML），让你可以编写自己的自动化作业脚本。
2 Ansible是怎样工作的？
Ansible连接到受控机，并推送一个称为“Modules”的应用程序到受控机上，Ansible然后在受控机上执行这些模块（默认情况下通过SSH），并在完成时删除她们。
3 Ansible的优点
1、Playbooks基于YAML，简单易学
2、基于推送，无需在受控机上安装任何程序
3、受控机可以成百上千，管理范围越大成本效能越好
4、内建大量Modules，并可使用“任何语言”开发自定义模块
ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
(1)、连接插件connection plugins：负责和被监控端实现通信；
(2)、host inventory：指定操作的主机，是一个配置文件里面定义监控的主机；
(3)、各种模块核心模块、command模块、自定义模块；
(4)、借助于插件完成记录日志邮件等功能；
(5)、playbook：剧本执行多个任务时，非必需可以让节点一次性运行多个任务。
ansible的核心组件：
ansible core
host iventory
core modules
custom modules
playbook (yaml, jinjia2)
connect plugin
特性：
nsible的特性：
基于Python语言实现，由Paramiko, PyYAML和Jinjia2三个关键模块；
部署简单, agentless
默认使用SSH协议；
(1) 基于密钥认证；
(2) 在inventory文件中指定账号和密码；
主从模式：
master: ansible, ssh client
slave: ssh server
支持自定义模块：支持各种编程语言
支持Playbook
基于“模块”完成各种“任务”
2.安装
先安装epel源
wget http://mirrors.aliyun.com/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum -y install ansible
配置文件：/etc/ansible/ansible.cfg
Invertory: /etc/ansible/hosts
准备4台主机初步试用一下：
首先定义其他主机的信息：
[root@localhost ansible]# vim /etc/ansible/hosts [webservs] 192.168.1.100 192.168.1.101 [dbservs] 192.168.1.102
将密钥发送到要管理的3台主机上：
ssh-copy-id -i /root/.ssh/id_rsa.pub [email protected]
查看ansible支持的模块：
[root@localhost ansible]# ansible-doc -l
查看某一个模块：
[root@localhost ansible]# ansible-doc -s yum
ansible命令应用基础：
语法: ansible <host-pattern> [-f forks] [-m module_name] [-a args]
-f forks：启动的并发线程数；
-m module_name: 要使用的模块；
-a args: 模块特有的参数；
基本测试一下：
command模块：
命令模块，默认
[root@localhost ansible]# ansible 192.168.1.101 -m command -a 'date' 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:34 CST 2016 [root@localhost ansible]# ansible 192.168.1.102 -m command -a 'date' 192.168.1.102 | success | rc=0 >> Mon Jan 11 03:54:39 CST 2016 [root@localhost ansible]# ansible all -m command -a 'date' 192.168.1.102 | success | rc=0 >> Mon Jan 11 03:54:47 CST 2016 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:47 CST 2016 192.168.1.100 | success | rc=0 >> Mon Jan 11 03:54:49 CST 2016 [root@localhost ansible]# ansible webservs -m command -a 'date' 192.168.1.100 | success | rc=0 >> Mon Jan 11 03:54:58 CST 2016 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:58 CST 2016 [root@localhost ansible]#
查看下passwd文件：
[root@localhost ansible]# ansible all -m command -a 'tail -2 /etc/passwd' 192.168.1.101 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin 192.168.1.100 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin mogilefs:x:498:498::/home/mogilefs:/bin/bash 192.168.1.102 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin mogilefs:x:305:305::/home/mogilefs:/bin/bash
cron模块：
让被管理节点生成定期自动运维计划：
让2台主机每10分钟运行一次echo hell
[root@localhost ansible]# ansible webservs -m cron -a 'minute="*/10" job="/bin/echo hell" name="test cron job"'
192.168.1.100 | success >> {
"changed": true,
"jobs": [
"test cron job"
]
}
192.168.1.101 | success >> {
"changed": true,
"jobs": [
"test cron job"
]
}
查看是否生成：
[root@localhost ansible]# ansible webservs -a 'crontab -l' 192.168.1.101 | success | rc=0 >> #Ansible: test cron job */10 * * * * /bin/echo hell 192.168.1.100 | success | rc=0 >> #Ansible: test cron job */10 * * * * /bin/echo hell
移除任务：absent
[root@localhost ansible]# ansible webservs -m cron -a 'minute="*/10" job="/bin/echo hell" name="test cron job" state=absent'
创建用户：user 删除用户后面跟上 state=absent
[root@localhost ansible]# ansible all -m user -a 'name="user1"'
192.168.1.102 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 500,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 500
}
192.168.1.100 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 501,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 501
}
192.168.1.101 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 500,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 500
}
组管理：group
创建mysql组账户：
[root@localhost ansible]# ansible webservs -m group -a 'name=mysql gid=306 system=yes'
192.168.1.100 | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
192.168.1.101 | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
创建mysql用户并且加入mysql组里：
[root@localhost ansible]# ansible webservs -m user -a 'name=mysql uid=306 system=yes group=mysql'
192.168.1.101 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 306,
"home": "/home/mysql",
"name": "mysql",
"shell": "/bin/bash",
"state": "present",
"system": true,
"uid": 306
}
192.168.1.100 | success >> {
"append": false,
"changed": true,
"comment": "MySQL Server",
"group": 306,
"home": "/var/lib/mysql",
"move_home": false,
"name": "mysql",
"shell": "/bin/bash",
"state": "present",
"uid": 306
}
copy：
src=: 定义本地源文件路径
dest=: 定义远程目标文件路径
content=: 取代src=，表示直接用此处指定的信息生成为目标文件
复制/etc/fstab文件到/tmp目录下：
注意如果开启selint的话需要安装libselinux-python
[root@localhost ansible]# ansible all -m copy -a 'src=/etc/fstab dest=/tmp/fstab.ansible owner=root mode=640'
192.168.1.101 | success >> {
"changed": true,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"md5sum": "ad7f86cff32f69c4ebe056de9663c4c9",
"mode": "0640",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"src": "/root/.ansible/tmp/ansible-tmp-1449182354.52-55405501135097/source",
"state": "file",
"uid": 0
}
192.168.1.102 | success >> {
"changed": true,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"md5sum": "ad7f86cff32f69c4ebe056de9663c4c9",
"mode": "0640",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"src": "/root/.ansible/tmp/ansible-tmp-1449182354.55-90702109372767/source",
"state": "file",
"uid": 0
}
192.168.1.100 | success >> {
"changed": false,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"mode": "0640",
"owner": "root",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 0
}
content:直接生成文件内容：
[root@localhost ansible]# ansible all -m copy -a 'content="hello ansible" dest=/tmp/test.ansible'
192.168.1.102 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.34-155397933435096/source",
"state": "file",
"uid": 0
}
192.168.1.100 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.43-92444335436660/source",
"state": "file",
"uid": 0
}
192.168.1.101 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.38-52532138760213/source",
"state": "file",
"uid": 0
}
file：
将复制的文件的属主，属组改为mysql：
[root@localhost ansible]# ansible all -m file -a 'owner=mysql group=mysql mode=644 path=/tmp/fstab.ansible'
192.168.1.100 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}
192.168.1.101 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}
192.168.1.102 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}
ping模块：
[root@localhost ansible]# ansible all -m ping
192.168.1.100 | success >> {
"changed": false,
"ping": "pong"
}
192.168.1.102 | success >> {
"changed": false,
"ping": "pong"
}
192.168.1.101 | success >> {
"changed": false,
"ping": "pong"
}
service：
管理节点服务的启动状态
[root@localhost ansible]# ansible webservs -m service -a 'enabled=true name=httpd state=started'
192.168.1.101 | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
192.168.1.100 | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
shell：
用到管道复杂命令功能时建议用shell
[root@localhost ansible]# ansible all -m shell -a 'echo 123..com | passwd --stdin user1' 192.168.1.102 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully. 192.168.1.101 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully. 192.168.1.100 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully.
script：将本地脚本复制到远程主机
[root@localhost ansible]# ansible all -m script -a "/tmp/a.sh"
yum：安装程序包 卸载的话 state=absent
[root@localhost ansible]# ansible all -m yum -a "name=zsh"
setup:远程主机的facts
每个被管理节点在接受并运行管理命令之前，会将自己主机相关信息，如操作版本，ip等报告给远程的ansible主机。
[root@localhost ansible]# ansible all -m yum -a "name=zsh"