1、Ansible基本簡介：
1 Ansible是什麼？
Ansible是一個適用於成百上千規模的受控節點的配置管理、應用程序部署、內部服務編排等諸多功能於一身的極爲簡單的IT運維自動化工具引擎，基於Python開發。她無需代理，很容易部署，除SSH外沒有其他安全基礎設施/配置要求。她使用了一個非常簡單的語言（YAML），讓你可以編寫自己的自動化作業腳本。
2 Ansible是怎樣工作的？
Ansible連接到受控機，並推送一個稱爲“Modules”的應用程序到受控機上，Ansible然後在受控機上執行這些模塊（默認情況下通過SSH），並在完成時刪除她們。
3 Ansible的優點
1、Playbooks基於YAML，簡單易學
2、基於推送，無需在受控機上安裝任何程序
3、受控機可以成百上千，管理範圍越大成本效能越好
4、內建大量Modules，並可使用“任何語言”開發自定義模塊
ansible是新出現的自動化運維工具，基於Python開發，集合了衆多運維工具（puppet、cfengine、chef、func、fabric）的優點，實現了批量系統配置、批量程序部署、批量運行命令等功能。ansible是基於模塊工作的，本身沒有批量部署的能力。真正具有批量部署的是ansible所運行的模塊，ansible只是提供一種框架。主要包括：
(1)、連接插件connection plugins：負責和被監控端實現通信；
(2)、host inventory：指定操作的主機，是一個配置文件裏面定義監控的主機；
(3)、各種模塊核心模塊、command模塊、自定義模塊；
(4)、藉助於插件完成記錄日誌郵件等功能；
(5)、playbook：劇本執行多個任務時，非必需可以讓節點一次性運行多個任務。
ansible的核心組件：
ansible core
host iventory
core modules
custom modules
playbook (yaml, jinjia2)
connect plugin
特性：
nsible的特性：
基於Python語言實現，由Paramiko, PyYAML和Jinjia2三個關鍵模塊；
部署簡單, agentless
默認使用SSH協議；
(1) 基於密鑰認證；
(2) 在inventory文件中指定賬號和密碼；
主從模式：
master: ansible, ssh client
slave: ssh server
支持自定義模塊：支持各種編程語言
支持Playbook
基於“模塊”完成各種“任務”
2.安裝
先安裝epel源
wget http://mirrors.aliyun.com/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum -y install ansible
配置文件：/etc/ansible/ansible.cfg
Invertory: /etc/ansible/hosts
準備4臺主機初步試用一下：
首先定義其他主機的信息：
[root@localhost ansible]# vim /etc/ansible/hosts [webservs] 192.168.1.100 192.168.1.101 [dbservs] 192.168.1.102
將密鑰發送到要管理的3臺主機上：
ssh-copy-id -i /root/.ssh/id_rsa.pub [email protected]
查看ansible支持的模塊：
[root@localhost ansible]# ansible-doc -l
查看某一個模塊：
[root@localhost ansible]# ansible-doc -s yum
ansible命令應用基礎：
語法: ansible <host-pattern> [-f forks] [-m module_name] [-a args]
-f forks：啓動的併發線程數；
-m module_name: 要使用的模塊；
-a args: 模塊特有的參數；
基本測試一下：
command模塊：
命令模塊，默認
[root@localhost ansible]# ansible 192.168.1.101 -m command -a 'date' 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:34 CST 2016 [root@localhost ansible]# ansible 192.168.1.102 -m command -a 'date' 192.168.1.102 | success | rc=0 >> Mon Jan 11 03:54:39 CST 2016 [root@localhost ansible]# ansible all -m command -a 'date' 192.168.1.102 | success | rc=0 >> Mon Jan 11 03:54:47 CST 2016 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:47 CST 2016 192.168.1.100 | success | rc=0 >> Mon Jan 11 03:54:49 CST 2016 [root@localhost ansible]# ansible webservs -m command -a 'date' 192.168.1.100 | success | rc=0 >> Mon Jan 11 03:54:58 CST 2016 192.168.1.101 | success | rc=0 >> Mon Jan 11 03:54:58 CST 2016 [root@localhost ansible]#
查看下passwd文件：
[root@localhost ansible]# ansible all -m command -a 'tail -2 /etc/passwd' 192.168.1.101 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin 192.168.1.100 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin mogilefs:x:498:498::/home/mogilefs:/bin/bash 192.168.1.102 | success | rc=0 >> ntp:x:38:38::/etc/ntp:/sbin/nologin mogilefs:x:305:305::/home/mogilefs:/bin/bash
cron模塊：
讓被管理節點生成定期自動運維計劃：
讓2臺主機每10分鐘運行一次echo hell
[root@localhost ansible]# ansible webservs -m cron -a 'minute="*/10" job="/bin/echo hell" name="test cron job"'
192.168.1.100 | success >> {
"changed": true,
"jobs": [
"test cron job"
]
}
192.168.1.101 | success >> {
"changed": true,
"jobs": [
"test cron job"
]
}查看是否生成：
[root@localhost ansible]# ansible webservs -a 'crontab -l' 192.168.1.101 | success | rc=0 >> #Ansible: test cron job */10 * * * * /bin/echo hell 192.168.1.100 | success | rc=0 >> #Ansible: test cron job */10 * * * * /bin/echo hell
移除任務：absent
[root@localhost ansible]# ansible webservs -m cron -a 'minute="*/10" job="/bin/echo hell" name="test cron job" state=absent'
創建用戶：user 刪除用戶後面跟上 state=absent
[root@localhost ansible]# ansible all -m user -a 'name="user1"'
192.168.1.102 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 500,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 500
}
192.168.1.100 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 501,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 501
}
192.168.1.101 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 500,
"home": "/home/user1",
"name": "user1",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 500
}組管理：group
創建mysql組賬戶：
[root@localhost ansible]# ansible webservs -m group -a 'name=mysql gid=306 system=yes'
192.168.1.100 | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
192.168.1.101 | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}創建mysql用戶並且加入mysql組裏：
[root@localhost ansible]# ansible webservs -m user -a 'name=mysql uid=306 system=yes group=mysql'
192.168.1.101 | success >> {
"changed": true,
"comment": "",
"createhome": true,
"group": 306,
"home": "/home/mysql",
"name": "mysql",
"shell": "/bin/bash",
"state": "present",
"system": true,
"uid": 306
}
192.168.1.100 | success >> {
"append": false,
"changed": true,
"comment": "MySQL Server",
"group": 306,
"home": "/var/lib/mysql",
"move_home": false,
"name": "mysql",
"shell": "/bin/bash",
"state": "present",
"uid": 306
}copy：
src=: 定義本地源文件路徑
dest=: 定義遠程目標文件路徑
content=: 取代src=，表示直接用此處指定的信息生成爲目標文件
複製/etc/fstab文件到/tmp目錄下：
注意如果開啓selint的話需要安裝libselinux-python
[root@localhost ansible]# ansible all -m copy -a 'src=/etc/fstab dest=/tmp/fstab.ansible owner=root mode=640'
192.168.1.101 | success >> {
"changed": true,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"md5sum": "ad7f86cff32f69c4ebe056de9663c4c9",
"mode": "0640",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"src": "/root/.ansible/tmp/ansible-tmp-1449182354.52-55405501135097/source",
"state": "file",
"uid": 0
}
192.168.1.102 | success >> {
"changed": true,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"md5sum": "ad7f86cff32f69c4ebe056de9663c4c9",
"mode": "0640",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"src": "/root/.ansible/tmp/ansible-tmp-1449182354.55-90702109372767/source",
"state": "file",
"uid": 0
}
192.168.1.100 | success >> {
"changed": false,
"checksum": "7e5f7c54a01bda71579a35224bbac8016a46c5ae",
"dest": "/tmp/fstab.ansible",
"gid": 0,
"group": "root",
"mode": "0640",
"owner": "root",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 0
}content:直接生成文件內容：
[root@localhost ansible]# ansible all -m copy -a 'content="hello ansible" dest=/tmp/test.ansible'
192.168.1.102 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.34-155397933435096/source",
"state": "file",
"uid": 0
}
192.168.1.100 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.43-92444335436660/source",
"state": "file",
"uid": 0
}
192.168.1.101 | success >> {
"changed": true,
"checksum": "7b320b1dc0c867516cf00728df488daa3532bc1f",
"dest": "/tmp/test.ansible",
"gid": 0,
"group": "root",
"md5sum": "37bc018071eae9a0e879c31b2f9aa554",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 13,
"src": "/root/.ansible/tmp/ansible-tmp-1449182800.38-52532138760213/source",
"state": "file",
"uid": 0
}file：
將複製的文件的屬主，屬組改爲mysql：
[root@localhost ansible]# ansible all -m file -a 'owner=mysql group=mysql mode=644 path=/tmp/fstab.ansible'
192.168.1.100 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}
192.168.1.101 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}
192.168.1.102 | success >> {
"changed": true,
"gid": 306,
"group": "mysql",
"mode": "0644",
"owner": "mysql",
"path": "/tmp/fstab.ansible",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 805,
"state": "file",
"uid": 306
}ping模塊：
[root@localhost ansible]# ansible all -m ping
192.168.1.100 | success >> {
"changed": false,
"ping": "pong"
}
192.168.1.102 | success >> {
"changed": false,
"ping": "pong"
}
192.168.1.101 | success >> {
"changed": false,
"ping": "pong"
}service：
管理節點服務的啓動狀態
[root@localhost ansible]# ansible webservs -m service -a 'enabled=true name=httpd state=started'
192.168.1.101 | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
192.168.1.100 | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}shell：
用到管道複雜命令功能時建議用shell
[root@localhost ansible]# ansible all -m shell -a 'echo 123..com | passwd --stdin user1' 192.168.1.102 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully. 192.168.1.101 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully. 192.168.1.100 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully.
script：將本地腳本複製到遠程主機
[root@localhost ansible]# ansible all -m script -a "/tmp/a.sh"
yum：安裝程序包 卸載的話 state=absent
[root@localhost ansible]# ansible all -m yum -a "name=zsh"
setup:遠程主機的facts
每個被管理節點在接受並運行管理命令之前，會將自己主機相關信息，如操作版本，ip等報告給遠程的ansible主機。
[root@localhost ansible]# ansible all -m yum -a "name=zsh"