1.anisble 簡介
anisble 是一款自動化運維工具，基於Python開發，集合了衆多運維工具（puppet、chef、func、fabric）的優點，實現了批量系統配置、批量程序部署、批量運行命令等功能。
ansible只是提供一種框架。主要包括：
（1）連接插件：負責和被監控端實現通信；
（2）host inventory ：指定操作的主機，是一個配置文件裏面定義監控的主機
（3）各種模塊核心模塊，command 模塊，自定義模塊。
（4）藉助於插件完成記錄日誌郵件等功能；
（5）playbook ：劇本執行多個任務時，非必要可以讓節點一次性運行多個任務。
ansible 架構圖：
上圖中我們看到的主要模塊如下：
Ansible：Ansible核心程序。
HostInventory：記錄由Ansible管理的主機信息，包括端口、密碼、ip等。
Playbooks：“劇本”YAML格式文件，多個任務定義在一個文件中，定義主機需要調用哪些模塊來完成的功能。
CoreModules：核心模塊，主要操作是通過調用核心模塊來完成管理任務。
CustomModules：自定義模塊，完成核心模塊無法完成的功能，支持多種語言。
ConnectionPlugins：連接插件，Ansible和Host通信使用
ansible安裝
實驗說明
| 服務角色 | ip | 系統及所需軟件 |
|---|---|---|
| 主控主機 | 192.168.55.130 | centos7 ansible |
| 受控主機 | 192.168.55.129 | centos7 |
安裝yum源
[root@yanyinglai ~]# cd /etc/yum.repos.d/
[root@yanyinglai yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo
[root@yanyinglai yum.repos.d]# sed -i 's/\$releasever/7/g' 163.repo
[root@yanyinglai yum.repos.d]# sed -i 's/^enabled=.*/enabled=1/g' 163.repo
[root@yanyinglai yum.repos.d]# yum -y install epel-release
安裝ansible
[root@yanyinglai yum.repos.d]# yum -y install ansible ansible-doc
查看ansible的版本
[root@yanyinglai yum.repos.d]# ansible --version
ansible 2.6.3
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
ansible配置
ansible配置文件：
配置文件 說明
/etc/ansible/ansible.cfg ansible主配置文件
/etc/ansible/hosts 受控主機清單
受控主機清單配置方式：
•分組配置
•ip配置
•域名配置
•通配符配置
ansible通過ssh來控制遠程主機，所以要配置ssh互信，否則將會提示你輸入密碼
[root@yanyinglai ~]# ssh-keygen -t rsa //使用ssh-keygen 創建公鑰-私鑰對
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:CibhCzCCgPi1gjIm4ypUWJhkyDCp8Mj1QudN2Wu/akg root@yanyinglai
The key's randomart image is:
+---[RSA 2048]----+
|@+o o |
|X= +.. o . |
|O=*.+.o . |
|@*++.o . o |
|*o+.+ S . |
| + + . E . |
|o . o . . |
|o . . . |
|. ... |
+----[SHA256]-----+
[root@yanyinglai ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected] //使用 ssh-copy-id 將公鑰複製到受控上的正確位置
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.55.129 (192.168.55.129)' can't be established.
ECDSA key fingerprint is SHA256:7mLj77SFk7sPkhjpMPfdK3nZ98hOuyP4OKzjXeijSJ0.
ECDSA key fingerprint is MD5:a0:1b:eb:7f:f0:b6:7b:73:97:91:4c:f3:b1:89:d8:ea.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '[email protected]'"
and check to make sure that only the key(s) you wanted were added.
將受控主機信息加入清單配置文件中
[root@yanyinglai ~]# vim /etc/ansible/hosts
//添加以下內容
[webservers] //組名
192.168.55.129//受控主機IP
ansible使用
ansible webservers組名或受控主機IP -m 模塊名 -a ‘命令’
ansible如何獲取幫助
ansible通過ansible-doc命令來獲取幫助信息，可以使用此命令的-s選項來獲取指定模塊的幫助信息。
//查詢service模塊的幫助文檔
[root@yanyinglai ~]# ansible-doc -s service
- name: Manage services
service:
arguments: # Additional arguments provided on
line
enabled: # Whether the service should start
least one of
state and enabled
are required.*
name: # (required) Name of the service.
pattern: # If the service does not respond
command, name a
substring to look
for as would be
found in the
output of the
`ps' command as a
stand-in for a
ansible常用模塊使用詳解
ansible常用模塊有：
ping
yum
template
copy
user
group
service
raw
command
shell
script
ansible常用模塊raw ，command，shell的區別
shell 模塊調用的/bin/sh指令執行
command模塊不是調用的shell的指令，所以沒有bash的環境變量
raw很多地方和shell類似，更多地方建議使用shell和command模塊。但是如果是使用老版本Python，需要用到raw，又或者是客戶端是路由器，因爲沒有安裝Python模塊，那就需要使用raw模塊了。
ansible常用模塊之ping
ping模塊用於檢查指定節點機器是否連通，用法很簡單，不涉及參數，主機如果在線，則回覆pong
[root@yanyinglai ~]# ansible all -m ping
192.168.55.129 | SUCCESS => {
"changed": false,
"ping": "pong"
}
ansible 常用模塊之command
command模塊用於在遠程主機上執行命令，ansible默認就是使用command模塊
缺陷：就是不能使用管道符和重定向功能
查看受控主機的/tmp目錄內容
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ls /tmp'
192.168.55.129 | SUCCESS | rc=0 >>
ansible_mHvKbh
ks-script-ubrQPY
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-chronyd.service-Z4raq3
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-systemd-hostnamed.service-HSwEIa
在受控主機的/tmp目錄下新建一個文件test
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'touch /tmp/test'
[WARNING]: Consider using the file module with state=touch rather than running
touch. If you need to use command because file is insufficient you can add
warn=False to this command task or set command_warnings=False in ansible.cfg to
get rid of this message.
192.168.55.129 | SUCCESS | rc=0 >>
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ls /tmp'
192.168.55.129 | SUCCESS | rc=0 >>
ansible_Fl9jFS
ks-script-ubrQPY
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-chronyd.service-Z4raq3
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-systemd-hostnamed.service-HSwEIa
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-vgauthd.service-JcKLmk
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-vmtoolsd.service-taZqEB
systemd-private-ebf89dd80707441f87cc25628094a3ef-chronyd.service-7IFbjd
systemd-private-ebf89dd80707441f87cc25628094a3ef-vgauthd.service-j8UNnT
systemd-private-ebf89dd80707441f87cc25628094a3ef-vmtoolsd.service-rWMy2z
test
command模板不支持管道符，不支持重定向
[root@yanyinglai ~]# ansible 192.168.55.129 -a "echo 'hello world' > /tmp/test"
192.168.55.129 | SUCCESS | rc=0 >>
hello world > /tmp/test
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'cat /tmp/test'
192.168.55.129 | SUCCESS | rc=0 >>
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ps -ef|grep vsftpd'
192.168.55.129 | FAILED | rc=1 >>
error: unsupported SysV option
Usage:
ps [options]
Try 'ps --help <simple|list|output|threads|misc|all>'
or 'ps --help <s|l|o|t|m|a>'
for additional help text.
For more details see ps(1).non-zero return code
ansible常用模塊之raw
raw模塊用於在受控主機上執行命令，其支持管道符與重定向
支持重定向
[root@yanyinglai ~]# ansible 192.168.55.129 -m raw -a 'echo "hello world" > /tmp/test'
192.168.55.129 | SUCCESS | rc=0 >>
Shared connection to 192.168.55.129 closed.
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'cat /tmp/test'
192.168.55.129 | SUCCESS | rc=0 >>
hello world
支持管道符
[root@yanyinglai ~]# ansible 192.168.55.129 -m raw -a 'cat /tmp/test |grep -Eo hello'
192.168.55.129 | SUCCESS | rc=0 >>
hello
Shared connection to 192.168.55.129 closed.
ansible常用模塊之shell
shell模塊用於在受控主機上執行受控主機上的腳本，也可以直接在受控主機上執行命令
shell模塊也支持管道與重定向
先受控主機建一個腳本
[root@yanyinglai ~]# mkdir /scripts
[root@yanyinglai ~]# cat /scripts/test.sh
#!/bin/bash
for i in $(seq 10);do
echo $i
done
查看受控主機上的腳本
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ls -l /scripts/'
192.168.55.129 | SUCCESS | rc=0 >>
總用量 4
-rw-r--r--. 1 root root 52 9月 10 18:49 test.sh
使用shell模塊在受控主機上執行受控機上的腳本
[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a '/bin/bash /scripts/test.sh'
192.168.55.129 | SUCCESS | rc=0 >>
1
2
3
4
5
6
7
8
9
10
ansible常用模塊之script
script模塊用於在受控機上執行主控主機上的腳本
[root@yanyinglai ~]# ansible 192.168.55.129 -m script -a '/scripts/yan.sh &> /tmp/users'
192.168.55.129 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.55.129 closed.\r\n",
"stderr_lines": [
"Shared connection to 192.168.55.129 closed."
],
"stdout": "",
"stdout_lines": []
}
查看受控機上的/tmp/users文件內容
[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'cat /tmp/users'
192.168.55.129 | SUCCESS | rc=0 >>
root:x:0:0:root:/root:/bin/bash
----------------------
bin:x:1:1:bin:/bin:/sbin/nologin
----------------------
daemon:x:2:2:daemon:/sbin:/sbin/nologin
----------------------
adm:x:3:4:adm:/var/adm:/sbin/nologin
----------------------
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
----------------------
sync:x:5:0:sync:/sbin:/bin/sync
----------------------
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
----------------------
halt:x:7:0:halt:/sbin:/sbin/halt
----------------------
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
----------------------
operator:x:11:0:operator:/root:/sbin/nologin
----------------------
games:x:12:100:games:/usr/games:/sbin/nologin
----------------------
ftp:x:14:50:FTP
----------------------
User:/var/ftp:/sbin/nologin
----------------------
nobody:x:99:99:Nobody:/:/sbin/nologin
----------------------
systemd-network:x:192:192:systemd
----------------------
Network
----------------------
Management:/:/sbin/nologin
----------------------
dbus:x:81:81:System
----------------------
message
----------------------
bus:/:/sbin/nologin
----------------------
polkitd:x:999:997:User
----------------------
for
----------------------
polkitd:/:/sbin/nologin
----------------------
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
----------------------
sshd:x:74:74:Privilege-separated
----------------------
SSH:/var/empty/sshd:/sbin/nologin
----------------------
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
----------------------
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
----------------------
ansible常用模塊之template
template模塊用於生成一個模塊，並將其傳輸到受控主機上
下載一個163源文件並開啓此源
[root@yanyinglai ~]# cd /etc/yum.repos.d/
[root@yanyinglai yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:--100 1572 100 1572 0 0 5255 0 --:--:-- --:--:-- --:--:-- 5383
[root@yanyinglai yum.repos.d]# sed -i 's/\$releasever/7/g' 163.repo
[root@yanyinglai yum.repos.d]# sed -i 's/^enabled=.*/enabled=1/g' 163.repo
將設置好的163源傳到受控主機上
[root@yanyinglai ~]# ansible 192.168.55.129 -m template -a 'src=/etc/yum.repos.d/163.repo dest=/etc/yum.repos.d/163.repo'
192.168.55.129 | SUCCESS => {
"changed": true,
"checksum": "60b8868e0599489038710c45025fc11cbccf35f2",
"dest": "/etc/yum.repos.d/163.repo",
"gid": 0,
"group": "root",
"md5sum": "5a3e688854d9ceccf327b953dab55b21",
"mode": "0644",
"owner": "root",
"secontext": "system_u:object_r:system_conf_t:s0",
"size": 1462,
"src": "/root/.ansible/tmp/ansible-tmp-1536580825.25-219729472958888/source",
"state": "file",
"uid": 0
}
查看受控主機上是否有163源
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ls /etc/yum.repos.d/'
192.168.55.129 | SUCCESS | rc=0 >>
163.repo
CentOS-Base.repo
CentOS-CR.repo
CentOS-Debuginfo.repo
CentOS-fasttrack.repo
CentOS-Media.repo
CentOS-Sources.repo
CentOS-Vault.repo
ansible常用模塊之yum
yum模塊用於在指定節點機器上通過yum管理軟件，其支持的參數主要有兩個
•name:要管理的包名
•state:要執行的操作
state常用的值：
•latest：安裝軟件
•installd：安裝軟件
•present ：安裝軟件
•removed：卸載軟件
•absent:卸載軟件
如果想使用yum來管理軟件，請確保受控主機上的yum源無異常
在受控機上查詢vsftpd是否安裝
[root@yanyinglai ~]# rpm -qa|grep vsftpd
[root@yanyinglai ~]#
在ansible主機上使用yum模塊在受控機上安裝vsftpd
[root@yanyinglai ~]# ansible 192.168.55.129 -m yum -a 'name=vsftpd state=present'
192.168.55.129 | SUCCESS => {
"changed": true,
"msg": "Repository base is listed more than once in the configuration\nRepository updates is listed more than once in the configuration\nRepository extras is listed more than once in the configuration\nRepository centosplus is listed more than once in the configuration\nfile:///mnt/repodata/repomd.xml: [Errno 14] curl#37 - \"Couldn't open file /mnt/repodata/repomd.xml\"\nTrying other mirror.\n",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror\nLoading mirror speeds from cached hostfile\nResolving Dependencies\n--> Running transaction check\n---> Package vsftpd.x86_64 0:3.0.2-22.el7 will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n vsftpd x86_64 3.0.2-22.el7 base 169 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package\n\nTotal download size: 169 k\nInstalled size: 348 k\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n Installing : vsftpd-3.0.2-22.el7.x86_64 1/1 \n Verifying : vsftpd-3.0.2-22.el7.x86_64 1/1 \n\nInstalled:\n vsftpd.x86_64 0:3.0.2-22.el7 \n\nComplete!\n"
]
}
查看受控機上是否安裝了vsftpd
[root@yanyinglai ~]# rpm -qa|grep vsftpd
vsftpd-3.0.2-22.el7.x86_64
ansible常見模塊之copy
copy模塊用於複製文件至遠程受控機
[root@yanyinglai ~]# ls
anaconda-ks.cfg
[root@yanyinglai ~]# ansible 192.168.55.129 -m copy -a 'src=/root/anaconda-ks.cfg dest=/tmp/yyl'
192.168.55.129 | SUCCESS => {
"changed": true,
"checksum": "1ac780f24dff3351db9322fdf9853ebbe27e39bd",
"dest": "/tmp/yyl",
"gid": 0,
"group": "root",
"md5sum": "8f8da0d3c4e5d61fa5496f12ee82b73f",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:admin_home_t:s0",
"size": 1287,
"src": "/root/.ansible/tmp/ansible-tmp-1536582597.03-118106324399653/source",
"state": "file",
"uid": 0
}
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'ls /tmp'
192.168.55.129 | SUCCESS | rc=0 >>
ansible_xYcnC6
ks-script-ubrQPY
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-chronyd.service-Z4raq3
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-systemd-hostnamed.service-HSwEIa
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-vgauthd.service-JcKLmk
systemd-private-d073b6cf2d8c4928a7ea533db6a27d95-vmtoolsd.service-taZqEB
systemd-private-ebf89dd80707441f87cc25628094a3ef-chronyd.service-7IFbjd
systemd-private-ebf89dd80707441f87cc25628094a3ef-vgauthd.service-j8UNnT
systemd-private-ebf89dd80707441f87cc25628094a3ef-vmtoolsd.service-rWMy2z
test
users
yum.log
yyl
ansible常用模塊之group
group模塊用於受控主機上添加或刪除組
在受控主機上添加一個系統組，gid爲306，組名爲mysql[root@yanyinglai ~]# ansible 192.168.55.129 -m group -a 'name=mysql gid=306 state=present'
192.168.55.129 | SUCCESS => {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": false
}刪除受控主機上的mysql組
[root@yanyinglai ~]# ansible 192.168.55.129 -m group -a 'name=mysql gid=306 state=absent'
192.168.55.129 | SUCCESS => {
"changed": true,
"name": "mysql",
"state": "absent"
}
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'grep mysql /etc/group'
192.168.55.129 | FAILED | rc=1 >>
non-zero return code
ansible 常用模塊之useruser模塊用於管理受控主機上的用戶賬戶在受控主機上添加一個系統用戶，用戶名爲mysql，uid爲306，設置其shell爲/sbin/nologin 無家目錄[root@yanyinglai ~]# ansible 192.168.55.129 -m user -a 'name=mysql uid=306 system=yes create_home=no shell=/sbin/nologin state=present'
192.168.55.129 | SUCCESS => {
"changed": true,
"comment": "",
"create_home": false,
"group": 306,
"home": "/home/mysql",
"name": "mysql",
"shell": "/sbin/nologin",
"state": "present",
"system": true,
"uid": 306
}[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'grep mysql /etc/passwd'
192.168.55.129 | SUCCESS | rc=0 >>
mysql:x:306:306::/home/mysql:/sbin/nologin
[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'ls /home'
192.168.55.129 | SUCCESS | rc=0 >>//修改mysql用戶的uid爲366[root@yanyinglai ~]# ansible 192.168.55.129 -m user -a 'name=mysql uid=366'
192.168.55.129 | SUCCESS => {
"append": false,
"changed": true,
"comment": "",
"group": 306,
"home": "/home/mysql",
"move_home": false,
"name": "mysql",
"shell": "/sbin/nologin",
"state": "present",
"uid": 366
}[root@yanyinglai ~]# ansible 192.168.55.129 -a 'grep mysql /etc/passwd'
192.168.55.129 | SUCCESS | rc=0 >>
mysql:x:366:306::/home/mysql:/sbin/nologin
刪除受控主機上的mysql用戶
[root@yanyinglai ~]# ansible 192.168.55.129 -m user -a 'name=mysql state=absent'
192.168.55.129 | SUCCESS => {
"changed": true,
"force": false,
"name": "mysql",
"remove": false,
"state": "absent"
}
[root@yanyinglai ~]# ansible 192.168.55.129 -a 'grep mysql /etc/passwd'
192.168.55.129 | FAILED | rc=1 >>
non-zero return code
ansible常用模塊之serviceservice模塊用於管理受控機上的服務查看受控機上的vsftpd服務是否啓動[root@yanyinglai ~]# ansible 192.168.55.129 -a 'systemctl is-active vsftpd'
192.168.55.129 | FAILED | rc=3 >>
unknownnon-zero return code
啓動受控機上的vsftpd服務[root@yanyinglai ~]# ansible 192.168.55.129 -m service -a 'name=vsftpd state=started'
192.168.55.129 | SUCCESS => {
查看受控機上的vsftpd服務是否開機自啓動[root@yanyinglai ~]# ansible 192.168.55.129 -a 'systemctl is-enabled vsftpd'
192.168.55.129 | FAILED | rc=1 >>
disablednon-zero return code
設置受控機上的vsftpd服務開機自動啓動[root@yanyinglai ~]# ansible 192.168.55.129 -m service -a 'name=vsftpd enabled=yes'
192.168.55.129 | SUCCESS => {
"changed": true,
"enabled": true,
"name": "vsftpd",
"status": { "ActiveEnterTimestamp": "一 2018-09-10 21:03:59 CST",
查看受控機上的vsftpd服務是否開機自動啓動[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'systemctl is-enabled vsftpd'
192.168.55.129 | SUCCESS | rc=0 >>
enabled
停止受控機上的vsftpd服務[root@yanyinglai ~]# ansible 192.168.55.129 -m service -a 'name=vsftpd state=stopped'
192.168.55.129 | SUCCESS => {
"changed": true,
"name": "vsftpd",
"state": "stopped",
[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'systemctl is-active vsftpd'
192.168.55.129 | FAILED | rc=3 >>
inactivenon-zero return code
[root@yanyinglai ~]# ansible 192.168.55.129 -m shell -a 'ss -antl'
192.168.55.129 | SUCCESS | rc=0 >>
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 :::22 :::*
LISTEN 0 100 ::1:25 :::*