Ansible
一、Ansible基礎
一臺Centos7做管理端，兩臺Centos6和一臺Centos7做客戶端
1、安裝ansible
查看ansible包信息：
[root@master1 ~]# yum info ansible
Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
* base: mirrors.aliyun.com
* extras: mirrors.aliyun.com
* updates: mirrors.aliyun.com
Available Packages
Name : ansible
Arch : noarch
Version : 2.2.0.0
Release : 4.el7
Size : 4.6 M
Repo : ali-epel
Summary : SSH-based configuration management, deployment, and task execution
: system
URL : http://ansible.com
License : GPLv3+
Description :
: Ansible is a radically simple model-driven configuration
: management, multi-node deployment, and remote task execution
: system. Ansible works over SSH and does not require any software
: or daemons to be installed on remote nodes. Extension modules can
: be written in any language and are transferred to managed machines
: automatically.
安裝ansible
[root@master1 ~]# yum install -y ansible
主機密鑰管理
1、管理端生成密鑰
[root@master1 ~]# ssh-keygen -t rsa -P ''
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
f0:23:5c:97:84:b5:39:c7:2f:da:00:2a:37:4c:34:28 [email protected]
The key's randomart image is:
+--[ RSA 2048]----+
| .o oo |
| E .. ... = |
| . o o * o |
| + = o o . |
| . B S . . . |
| o o . + . |
| . . |
| |
| |
+-----------------+
[root@master1 ~]#
2、在管理端利用剛纔的公鑰生成登陸客戶端的密鑰
[root@master1 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected]
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[root@master1 ~]#
[root@master1 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected]
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[root@master1 ~]#
[root@master1 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected]
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[root@master1 ~]#
自己的也複製一份
[root@master1 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected]
The authenticity of host '10.201.106.131 (10.201.106.131)' can't be established.
ECDSA key fingerprint is 5e:5d:4d:d2:3f:73:fb:5c:c4:26:c7:c4:85:10:c9:75.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
[root@master1 ~]#
3、管理端測試是否可以免密碼登陸客戶端
[root@master1 ~]# ssh 10.201.106.132 'hostname'
master2.com
[root@master1 ~]# ssh 10.201.106.21 'hostname'
node1.com
[root@master1 ~]# ssh 10.201.106.22 'hostname'
node2.com
[root@master1 ~]#
4、查看ansible模塊
ansible-doc -l
顯示模塊具體用法：
[root@master1 ~]# ansible-doc -s command
5、定義主機清單
[root@master1 ~]# cd /etc/ansible/
[root@master1 ansible]# ls
ansible.cfg hosts roles
[root@master1 ansible]# cp hosts{,.backup}
[root@master1 ansible]# ls
ansible.cfg hosts hosts.backup roles
[root@master1 ansible]# vim hosts
# This is the default ansible 'hosts' file.
#
# It should live in /etc/ansible/hosts
#
# - Comments begin with the '#' character
# - Blank lines are ignored
# - Groups of hosts are delimited by [header] elements
# - You can enter hostnames or ip addresses
# - A hostname/ip can be a member of multiple groups
# Ex 1: Ungrouped hosts, specify before any group headers.
## green.example.com
## blue.example.com
## 192.168.100.1
## 192.168.100.10
# - Comments begin with the '#' character
# - Blank lines are ignored
# - Groups of hosts are delimited by [header] elements
# - You can enter hostnames or ip addresses
# - A hostname/ip can be a member of multiple groups
[websrvs]
10.201.106.132
10.201.106.21
[dbsrvs]
10.201.106.22
6、ansible遠程執行命令
[root@master1 ansible]# ansible 10.201.106.132 -m command -a 'ifconfig'
10.201.106.132 | SUCCESS | rc=0 >>
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.201.106.132 netmask 255.255.255.0 broadcast 10.201.106.255
inet6 fe80::20c:29ff:fed3:7101 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:d3:71:01 txqueuelen 1000 (Ethernet)
RX packets 203231 bytes 24669855 (23.5 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 183141 bytes 15032655 (14.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 4088 bytes 381233 (372.2 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4088 bytes 381233 (372.2 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@master1 ansible]#
6.1 所有主機都運行命令
[root@master1 ansible]# ansible all -m command -a 'hostname'
10.201.106.132 | SUCCESS | rc=0 >>
master2.com
10.201.106.22 | SUCCESS | rc=0 >>
node2.com
10.201.106.21 | SUCCESS | rc=0 >>
node1.com
[root@master1 ansible]#
6.2 默認是command模塊
[root@master1 ansible]# ansible all -a 'hostname'
10.201.106.21 | SUCCESS | rc=0 >>
node1.com
10.201.106.132 | SUCCESS | rc=0 >>
master2.com
10.201.106.22 | SUCCESS | rc=0 >>
node2.com
[root@master1 ansible]#
ps：小技巧
[root@master1 ansible]# for i in 131 132 21 21;do ssh 10.201.106.$i 'date';done
Wed Jan 18 15:17:14 CST 2017
Wed Jan 18 09:16:27 CST 2017
Sat Jul 30 20:49:22 CST 2016
Sat Jul 30 20:49:22 CST 2016
[root@master1 ansible]#
查看模塊使用方法：
[root@master1 ~]# ansible-doc -s command
- name: Executes a command on a remote node
action: command
chdir # cd into this directory before running the command
creates # a filename or (since 2.0) glob pattern, when it
already exists,
this step will
*not* be run.
executable # change the shell used to execute the command.
Should be an
absolute path to
the executable.
free_form= # the command module takes a free form command to
run. There is no
parameter actually
named 'free form'.
See the examples!
removes # a filename or (since 2.0) glob pattern, when it
does not exist,
this step will
*not* be run.
warn # if command warnings are on in ansible.cfg, do not
warn about this
particular line if
set to no/false.
全部執行命令：
[root@master1 ~]# ansible all -a 'uptime'
10.201.106.132 | SUCCESS | rc=0 >>
11:58:33 up 2 days, 14:08, 3 users, load average: 0.00, 0.01, 0.05
10.201.106.21 | SUCCESS | rc=0 >>
11:58:33 up 2 days, 18:18, 3 users, load average: 0.00, 0.00, 0.00
10.201.106.131 | SUCCESS | rc=0 >>
11:58:34 up 2 days, 20:07, 4 users, load average: 0.45, 0.14, 0.08
10.201.106.22 | SUCCESS | rc=0 >>
03:05:05 up 12:47, 3 users, load average: 0.00, 0.00, 0.00
[root@master1 ~]#
7、小例子
7.1 使用ansible將ftp的文件取下來
[root@master1 ~]# ansible websrvs -a 'wget -O /tmp/1.jpg ftp://10.201.106.131/1.jpg'
10.201.106.132 | SUCCESS | rc=0 >>
--2017-01-21 13:14:53-- ftp://10.201.106.131/1.jpg
=> ‘/tmp/1.jpg’
Connecting to 10.201.106.131:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE 1.jpg ... 8264
==> PASV ... done. ==> RETR 1.jpg ... done.
Length: 8264 (8.1K) (unauthoritative)
0K ........ 100% 58.5M=0s
2017-01-21 13:14:53 (58.5 MB/s) - ‘/tmp/1.jpg’ saved [8264]
10.201.106.21 | SUCCESS | rc=0 >>
--2017-01-21 13:14:54-- ftp://10.201.106.131/1.jpg
=> “/tmp/1.jpg”
Connecting to 10.201.106.131:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD not needed.
==> SIZE 1.jpg ... 8264
==> PASV ... done. ==> RETR 1.jpg ... done.
Length: 8264 (8.1K) (unauthoritative)
0K ........ 100% 237M=0s
2017-01-21 13:14:54 (237 MB/s) - “/tmp/1.jpg” saved [8264]
[root@master1 ~]#
7.2 創建用戶，狀態指明存在的
[root@master1 ~]# ansible websrvs -m user -a "name=hacluster state=present"
10.201.106.132 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 1000,
"home": "/home/hacluster",
"name": "hacluster",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 1000
}
10.201.106.21 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 500,
"home": "/home/hacluster",
"name": "hacluster",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 500
}
[root@master1 ~]#
[root@master2 ~]# id hacluster
uid=1000(hacluster) gid=1000(hacluster) groups=1000(hacluster)
[root@node1 ~]# id hacluster
uid=500(hacluster) gid=500(hacluster) groups=500(hacluster)
7.3 刪除用戶
[root@master1 ~]# ansible websrvs -m user -a "name=hacluster state=absent"
10.201.106.132 | SUCCESS => {
"changed": true,
"force": false,
"name": "hacluster",
"remove": false,
"state": "absent"
}
10.201.106.21 | SUCCESS => {
"changed": true,
"force": false,
"name": "hacluster",
"remove": false,
"state": "absent"
}
[root@master1 ~]#
[root@master2 ~]# id hacluster
id: hacluster: no such user
[root@node1 ~]# id hacluster
id: hacluster: No such user
7.4 創建系統用戶
[root@master1 ~]# ansible websrvs -m user -a "name=hacluster state=present system=yes"
10.201.106.21 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 498,
"home": "/home/hacluster",
"name": "hacluster",
"shell": "/bin/bash",
"state": "present",
"stderr": "useradd: warning: the home directory already exists.\nNot copying any file from skel directory into it.\n",
"system": true,
"uid": 498
}
10.201.106.132 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 990,
"home": "/home/hacluster",
"name": "hacluster",
"shell": "/bin/bash",
"state": "present",
"stderr": "useradd: warning: the home directory already exists.\nNot copying any file from skel directory into it.\n",
"system": true,
"uid": 992
}
[root@master1 ~]#
8、組應用
8.1 group用法
[root@master1 ~]# ansible-doc -s group
- name: Add or remove groups
action: group
gid # Optional `GID' to set for the group.
name= # Name of the group to manage.
state # Whether the group should be present or not on the
remote host.
system # If `yes', indicates that the group created is a
system group.
[root@master1 ~]#
9、 cron
9.1 cron用法
[root@master1 ~]# ansible-doc -s cron
9.2 時間同步
[root@master1 ~]# ansible all -m cron -a 'name="sync time from ntpserver" minute="*/10" job="/sbin/ntpdate s2g.time.edu.cn &> /dev/null"'
10.201.106.132 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"sync time from ntpserver"
]
}
10.201.106.21 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"sync time from ntpserver"
]
}
10.201.106.22 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"sync time from ntpserver"
]
}
10.201.106.131 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"sync time from ntpserver"
]
}
[root@master1 ~]#
客戶端驗證：
[root@master2 ~]# crontab -l
#Ansible: sync time from ntpserver
*/10 * * * * /sbin/ntpdate s2g.time.edu.cn &> /dev/null
[root@master2 ~]#
[root@node1 ~]# crontab -l
#Ansible: sync time from ntpserver
*/10 * * * * /sbin/ntpdate s2g.time.edu.cn &> /dev/null
[root@node1 ~]#
9.3 刪除任務
[root@master1 ~]# ansible all -m cron -a 'name="sync time from ntpserver" state=absent'
10.201.106.22 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
10.201.106.132 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
10.201.106.21 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
10.201.106.131 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
[root@master1 ~]#
10、copy模塊
10.1 copy用法
[root@master1 ~]# ansible-doc -s copy
10.2 複製測試
[root@master1 ~]# ansible websrvs -m copy -a 'src=/etc/fstab dest=/tmp/fstab.tmp mode=600'
10.201.106.132 | SUCCESS => {
"changed": true,
"checksum": "8dc726fea0db155cf25dd06350dcc27670dda2d1",
"dest": "/tmp/fstab.tmp",
"gid": 0,
"group": "root",
"md5sum": "a9bb2b1d8f792d1288494cac92e988c7",
"mode": "0600",
"owner": "root",
"size": 1065,
"src": "/root/.ansible/tmp/ansible-tmp-1484991089.51-151633412060056/source",
"state": "file",
"uid": 0
}
10.201.106.21 | SUCCESS => {
"changed": true,
"checksum": "8dc726fea0db155cf25dd06350dcc27670dda2d1",
"dest": "/tmp/fstab.tmp",
"gid": 0,
"group": "root",
"md5sum": "a9bb2b1d8f792d1288494cac92e988c7",
"mode": "0600",
"owner": "root",
"size": 1065,
"src": "/root/.ansible/tmp/ansible-tmp-1484991089.39-59396856122690/source",
"state": "file",
"uid": 0
}
[root@master1 ~]#
[root@master2 ~]# ll /tmp/
total 16
-rw-r--r-- 1 root root 8264 Jan 21 13:14 1.jpg
-rw------- 1 root root 1065 Jan 21 17:31 fstab.tmp
[root@node1 ~]# ll /tmp/
total 32
-rw-r--r-- 1 root root 8264 Jan 21 13:14 1.jpg
-rw------- 1 root root 1065 Jan 21 17:31 fstab.tmp
11、file模塊
11.1 創建目錄
[root@master1 ~]# ansible all -m file -a 'path=/tmp/testdir state=directory'
10.201.106.132 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "0755",
"owner": "root",
"path": "/tmp/testdir",
"size": 6,
"state": "directory",
"uid": 0
}
10.201.106.22 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "0755",
"owner": "root",
"path": "/tmp/testdir",
"size": 4096,
"state": "directory",
"uid": 0
}
10.201.106.21 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "0755",
"owner": "root",
"path": "/tmp/testdir",
"size": 4096,
"state": "directory",
"uid": 0
}
10.201.106.131 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "0755",
"owner": "root",
"path": "/tmp/testdir",
"size": 6,
"state": "directory",
"uid": 0
}
[root@master1 ~]#
11.2 創建鏈接文件（可加 force=yes強制創建文件）
[root@master1 ~]# ansible websrvs -m file -a 'path=/tmp/fstab.symlink state=link src=/tmp/fstab.tmp'
10.201.106.21 | SUCCESS => {
"changed": true,
"dest": "/tmp/fstab.symlink",
"gid": 0,
"group": "root",
"mode": "0777",
"owner": "root",
"size": 14,
"src": "/tmp/fstab.tmp",
"state": "link",
"uid": 0
}
10.201.106.132 | SUCCESS => {
"changed": true,
"dest": "/tmp/fstab.symlink",
"gid": 0,
"group": "root",
"mode": "0777",
"owner": "root",
"size": 14,
"src": "/tmp/fstab.tmp",
"state": "link",
"uid": 0
}
[root@master1 ~]#
[root@master2 ~]# ll /tmp/
total 16
-rw-r--r-- 1 root root 8264 Jan 21 13:14 1.jpg
lrwxrwxrwx 1 root root 14 Jan 21 19:40 fstab.symlink -> /tmp/fstab.tmp
[root@node1 ~]# ll /tmp/
total 36
-rw-r--r-- 1 root root 8264 Jan 21 13:14 1.jpg
lrwxrwxrwx 1 root root 14 Jan 21 19:40 fstab.symlink -> /tmp/fstab.tmp
12、ping模塊
12.1 測試所有節點網絡聯通性
[root@master1 ~]# ansible all -m ping
10.201.106.22 | SUCCESS => {
"changed": false,
"ping": "pong"
}
10.201.106.132 | SUCCESS => {
"changed": false,
"ping": "pong"
}
10.201.106.21 | SUCCESS => {
"changed": false,
"ping": "pong"
}
10.201.106.131 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@master1 ~]#
13、yum 模塊
14.1 安裝vsftpd
[root@master1 ~]# ansible websrvs -m yum -a 'name=vsftpd state=latest'
10.201.106.132 | SUCCESS => {
"changed": false,
"msg": "",
"rc": 0,
"results": [
"All packages providing vsftpd are up to date",
""
]
}
10.201.106.21 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, security\nSetting up Install Process\nLoading mirror speeds from cached hostfile\nResolving Dependencies\n--> Running transaction check\n---> Package vsftpd.x86_64 0:2.2.2-21.el6 will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n vsftpd x86_64 2.2.2-21.el6 ali 155 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package(s)\n\nTotal download size: 155 k\nInstalled size: 340 k\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Installing : vsftpd-2.2.2-21.el6.x86_64 1/1 \n\r Verifying : vsftpd-2.2.2-21.el6.x86_64 1/1 \n\nInstalled:\n vsftpd.x86_64 0:2.2.2-21.el6 \n\nComplete!\n"
]
}
[root@master1 ~]#
14.2 更新最新的nginx
[root@master1 ~]# ansible websrvs -m yum -a 'name=nginx state=latest'
15、server
15.1 啓動nginx服務
[root@master1 ~]# ansible websrvs -m service -a 'name=nginx state=started enabled=yes'
10.201.106.22 | SUCCESS => {
"changed": true,
"enabled": true,
"name": "nginx",
"state": "started"
}
15.2 關閉服務並禁止開機啓動
[root@master1 ~]# ansible websrvs -m service -a 'name=nginx state=stopped enabled=no'
16、shell
16.0 用命令模塊創建用戶並改密碼
創建用戶
[root@master1 ~]# ansible websrvs -m user -a 'name=centos state=present'
設置密碼
[root@master1 ~]# ansible websrvs -m shell -a 'echo centos | passwd --stdin centos'
10.201.106.22 | SUCCESS | rc=0 >>
Changing password for user centos.
passwd: all authentication tokens updated successfully.
10.201.106.21 | SUCCESS | rc=0 >>
Changing password for user centos.
passwd: all authentication tokens updated successfully.
10.201.106.132 | SUCCESS | rc=0 >>
Changing password for user centos.
passwd: all authentication tokens updated successfully.
17、script模塊
17.1 編寫腳本
[root@master1 ~]# vim /tmp/test.sh
#!/bin/bash
#
echo "$(hostname) ansible is good." > /tmp/ansible.txt
17.2 將本地腳本傳到客戶端運行，然後腳本自動刪除
[root@master1 ~]# ansible websrvs -m script -a '/tmp/test.sh'
10.201.106.132 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 10.201.106.132 closed.\r\n",
"stdout": "",
"stdout_lines": []
}
10.201.106.22 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 10.201.106.22 closed.\r\n",
"stdout": "",
"stdout_lines": []
}
10.201.106.21 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 10.201.106.21 closed.\r\n",
"stdout": "",
"stdout_lines": []
}
[root@master1 ~]#
[root@master2 ~]# cat /tmp/ansible.txt
master2.com ansible is good.
[root@master2 ~]#
[root@node1 ~]# cat /tmp/ansible.txt
node1.com ansible is good.
[root@node1 ~]#
[root@node2 ~]# cat /tmp/ansible.txt
node2.com ansible is good.
[root@node2 ~]#
18、setup
18.1 收集系統軟件硬件信息
[root@master1 ~]# ansible websrvs -m setup
