ansible 實現自動化部署ambari（純離線）

前言

本文有本人指導，Mr.Lu_1實踐完成

一、業務場景

大規模集羣（幾十上百臺服務器）搭建ambari，頻繁更換登錄服務器操作不便並且容易出現操作失誤的情況，集羣特點是環境基本一致，各節點的操作大部分相同，由此想到做一鍵部署腳本。

二、選用技術

1. ansible：新出現的自動化運維工具，基於Python開發，集合了衆多運維工具（puppet、cfengine、chef、func、fabric）的優點，實現了批量系統配置、批量程序部署、批量運行命令等功能。執行命令基於ssh
2. shell ：安裝各種依賴使用ansible調用shell腳本的方式

三、準備

這裏我選用的純離線安裝方式，原因主要是受網絡限制
需要下載的依賴包：

1. ambari-2.5.0.3-centos7.tar.gz
2. HDP-2.6.5.0-centos7-rpm.tar.gz
3. HDP-UTILS-1.1.0.21-centos7.tar.gz
4. ansible-2.4-rpms.el7.tar.gz（包含安裝ansible各種依賴）
5. mysql-5.7.27-el7-x86_64.tar.gz
6. mysql-connector-java-5.1.47.jar
7. jdk-8u201-linux-x64.tar.gz
   （版本根據項目需求自己選擇）

四、服務器準備

• 我這裏用了10臺centos7.2的沒有裝過任何軟件的服務器

五、配置步驟

1、配置網卡（所有節點）

• “DEVICE”：網卡對應的設備別名，如ifcfg-eth0第一塊網卡；
• “HWADDR”：網卡物理地址；
• “BOOTPROTO”：網卡獲得ip地址的方式，Static（靜態 ip地址）dhcp（通過dhcp協議獲取ip） bootip通過bootp協議獲得的ip地址；
• “IPADDR”： 網 卡 IP 地 址 ； “NETMASK”：網卡對應網絡掩碼；
• “NETWORK”：網卡對應的網絡地址；
• “ONBOOT”：系統啓動時是否設置此網絡接口，設置爲yes時，系統啓動時激活此設備。默認設置 爲yes；
• “DNS”：配置該網絡環境下的DNS。
  保存上述編輯內容，運行如下命令重啓network服務。

service network restart

• 上傳下載好的依賴包 我這邊是放在/opt下了

[root@node01 opt]# ll
total ……
drwxr-xr-x. 2 root root      4096 May 20 17:37 playbook # 存放ansible執行playbook文件
drwxr-xr-x. 5 root root      4096 May 20 17:44 srcConfig # 存放實現準備好的配置文件（具體內容放在步驟裏）
drwxr-xr-x. 6 root root      4096 May 20 11:57 srcPackage # 存放依賴包
drwxr-xr-x. 2 root root      4096 May 21 10:08 srcScript # 所有編寫腳本文件夾（下面的所有腳本都放在這裏）

2、配置hosts映射（主節點）

• 先配好hostname
• 配置/etc/hosts，編寫以下腳本並執行vim addHosts.sh

#! /bin/bash
echo "******** add host -> hosts ********"
# ip 和 hostname 應改爲集羣對應的
echo "192.168.111.201 node01" >> /etc/hosts
echo "192.168.111.202 node02" >> /etc/hosts
echo "192.168.111.203 node03" >> /etc/hosts
echo "192.168.111.204 node04" >> /etc/hosts
echo "192.168.111.205 node05" >> /etc/hosts
echo "192.168.111.206 node06" >> /etc/hosts
echo "192.168.111.207 node07" >> /etc/hosts
echo "192.168.111.208 node08" >> /etc/hosts
echo "192.168.111.209 node09" >> /etc/hosts
echo "192.168.111.210 node10" >> /etc/hosts
cp /etc/hosts /opt/srcConfig/system/ 
# 拷貝到配置文件源目錄，這裏只是方便管理統一的配置文件，非必要操作
echo "******** END ********"

3、配置主節點到各個機器的ssh（主節點）

• 編寫ssh腳本
• vim sshScript.sh

#! /bin/bash
ssh-keygen -t rsa
# 192.168.111 改爲集羣所在網段（和hosts中配置對應）
ALL_CLIENTS=`cat /etc/hosts| grep "192.168.111" | awk '{print $2}'`
for client in $ALL_CLIENTS
do
        echo "=============copy-ssh-id $client============="
        ssh-copy-id $client
done                    

• 此腳本執行的時候需要與人員交互（輸入各節點服務器密碼），機器比較多的時候可以考慮使用expect

4、安裝ansible

• 依賴包位置

/opt/srcPackage/ansible/ansible-2.4-rpms.el7.tar.gz

• 編寫安裝ansible腳本 vim installAnsible.sh

tar -xzvf /opt/srcPackage/ansible/ansible-2.4-rpms.el7.tar.gz -C /opt/srcPackage/ansible/
cd /opt/srcPackage/ansible/ansible-2.4-rpms.el7

rpm -ivh PyYAML*rpm libyaml*rpm python-babel*rpm python-backports*rpm python-backports-ssl_match_hostname*rpm python-cffi*rpm python-enum34*rpm python-httplib2*rpm python-idna*rpm python-ipaddress*rpm python-jinja2*rpm python-markupsafe*rpm python-paramiko*rpm python-passlib*rpm python-ply*rpm python-pycparser*rpm python-setuptools*rpm python-six*rpm python2-cryptography*rpm python2-jmespath*rpm python2-pyasn1*rpm sshpass*rpm --nodeps --force

rpm -ivh ansible-2.4.2.0-2.el7.noarch.rpm
ansible --version

5、配置ansible的hosts（ansible使用的ip和定義主機組的映射）

• 編寫配置腳本vim addAnsibleHosts.sh

#! /bin/bash
echo "******** add ansible host -> ansible hosts ********"
# ip 和 hostname 應改爲集羣對應的
echo "[test]" >> /etc/ansible/hosts # 主機組（所有節點）名稱
echo "192.168.111.201" >> /etc/ansible/hosts
echo "192.168.111.202" >> /etc/ansible/hosts
echo "192.168.111.203" >> /etc/ansible/hosts
echo "192.168.111.204" >> /etc/ansible/hosts
echo "192.168.111.205" >> /etc/ansible/hosts
echo "192.168.111.206" >> /etc/ansible/hosts
echo "192.168.111.207" >> /etc/ansible/hosts
echo "192.168.111.208" >> /etc/ansible/hosts
echo "192.168.111.209" >> /etc/ansible/hosts
echo "192.168.111.210" >> /etc/ansible/hosts

echo "[testmaster]" >> /etc/ansible/hosts # 主機組（主節點）名稱
echo "192.168.111.201" >> /etc/ansible/hosts

echo "[testslave]" >> /etc/ansible/hosts # 主機組（從節點）名稱
echo "192.168.111.202" >> /etc/ansible/hosts
echo "192.168.111.203" >> /etc/ansible/hosts
echo "192.168.111.204" >> /etc/ansible/hosts
echo "192.168.111.205" >> /etc/ansible/hosts
echo "192.168.111.206" >> /etc/ansible/hosts
echo "192.168.111.207" >> /etc/ansible/hosts
echo "192.168.111.208" >> /etc/ansible/hosts
echo "192.168.111.209" >> /etc/ansible/hosts
echo "192.168.111.210" >> /etc/ansible/hosts

echo "******** END ********"                           

六、編寫playbook

• playbook支持yaml文件格式，語法也遵循yaml格式vim installAmbari.yaml

---
- hosts: test # 所有機器
  remote_user: root

  tasks:
# 配置host文件
    - name: copy hosts
      copy: src=/opt/srcConfig/system/hosts dest=/etc/hosts
# 執行腳本統一存放路徑,有的腳本需要在所有機器本地執行，在所有機器上創建一個腳本存放路徑，方便管理
    - name: mkdir shFile dir
      shell: mkdir -p /opt/shFile
# 關閉大頁
# 腳本內容見 下面 七 中的closeTHP.sh
    - name: copy closeTHP file
      copy: src=/opt/srcScript/closeTHP.sh dest=/opt/shFile/closeTHP.sh
# 執行腳本
    - name: closeTHP.sh
      shell: sh /opt/shFile/closeTHP.sh
# 修改linux限制
# 腳本內容見 下面 七 中的modifyLimits.sh
    - name: copy modifyLimits file
      copy: src=/opt/srcScript/modifyLimits.sh dest=/opt/shFile/modifyLimits.sh
# 執行腳本
    - name: modifyLimits.sh
      shell: sh /opt/shFile/modifyLimits.sh


- hosts: testmaster # 主節點
  remote_user: root
# 配置ntp服務 安裝http
  tasks:
# ntp server配置
# 腳本內容見 下面 七 中的modifyNtpMaster.sh
    - name: copy modifyNtpMaster file # 腳本需要修改 ip網段
      copy: src=/opt/srcScript/modifyNtpMaster.sh dest=/opt/shFile/modifyNtpMaster.sh
# 執行腳本並安裝http服務
    - name: modifyNtpMaster.sh install http
      shell: sh /opt/shFile/modifyNtpMaster.sh
    - shell: yum install httpd -y
    - shell: systemctl start httpd
    - shell: systemctl enable httpd

- hosts: testslave # 從節點
  remote_user: root
# 配置ntp服務  
  tasks:
# ntp agent配置
# 腳本內容見 下面 七 中的modifyNtpSlave.sh
    - name: copy modifyNtpSlave file # 腳本中 變量masterIp需要修改 網段也需要修改
      copy: src=/opt/srcScript/modifyNtpSlave.sh dest=/opt/shFile/modifyNtpSlave.sh
# 執行腳本
    - name: modifyNtpSlave.sh
      shell: sh /opt/shFile/modifyNtpSlave.sh
  
- hosts: test # 所有節點
  remote_user: root
# 關閉防火牆 開啓ntp服務
  tasks:
    - name: stop disable firewalld & start enable ntpd
      shell: systemctl stop firewalld.service
    - shell: systemctl disable firewalld.service
    - shell: systemctl start ntpd
    - shell: systemctl enable ntpd
# 安裝 openssl jdk     
    - name: install openssl
      shell: yum  install openssl -y
# 修改路徑 注意修改腳本中對應的路徑
    - name: copy jdk
      copy: src=/opt/srcPackage/jdk dest=/opt
# 腳本內容見 下面 七 中的installJdk.sh
    - name: copy installJdk.sh
      copy: src=/opt/srcScript/installJdk.sh dest=/opt/shFile/installJdk.sh
    - name: chmod installJdk.sh
      shell: chmod u+x /opt/shFile/installJdk.sh
# 執行腳本 並刷新環境變量
    - name: sh installJdk.sh
      shell: sh /opt/shFile/installJdk.sh
      register: jdk_status
# 返回安裝jdk狀態
    - name: show
      debug: var=jdk_status verbosity=0
# 關閉selinux
# 腳本內容見 下面 七 中的closeSelinux.sh
    - name: copy closeSelinux.sh
      copy: src=/opt/srcScript/closeSelinux.sh dest=/opt/shFile/closeSelinux.sh

    - name: sh closeSelinux.sh
      shell: sh /opt/shFile/closeSelinux.sh
      
- hosts: testmaster # 主節點
  remote_user: root

  tasks:
# 安裝mysql
# 腳本內容見 下面 七 中的installMysql.sh 安裝過程中遇到了比較噁心的問題有興趣可以看一下 九 問題mysql部分 
# 腳本中需要使用一個my.cnf 配置文件 內容見  八.1
    - name: copy installMysql.sh 
      copy: src=/opt/srcScript/installMysql.sh dest=/opt/shFile/installMysql.sh
# 執行腳本
    - name: sh installMysql.sh
      shell: sh /opt/shFile/installMysql.sh
      register: installMysql_status
# 返回安裝mysql狀態
    - name: show
      debug: var=installMysql_status verbosity=0
# 配置ambari HDP HDP-UTILS yum源   
# 解壓ambari tar 包
    - name: tar -zxvf ambari-2.5.0.3-centos7.tar.gz 
      shell: tar -zxvf /opt/srcPackage/ambari/ambari-2.5.0.3-centos7.tar.gz -C /var/www/html/
# 使用提前準備好的配置文件 注意路徑 
# /opt/srcConfig/ambari/ambari.repo 是我提前寫好 存放的路徑
# 配置文件內容見 八 中 ambari.repo
    - name: copy ambari.repo # 需要修改ip
      copy: src=/opt/srcConfig/ambari/ambari.repo dest=/etc/yum.repos.d/ambari.repo
# 配置文件內容見 八 中 HDP.repo
    - name: copy HDP.repo # 需要修改ip
      copy: src=/opt/srcConfig/ambari/HDP.repo dest=/etc/yum.repos.d/HDP.repo

    - name: tar -zxvf ambari-2.5.0.3-centos7.tar.gz 
      shell: tar -zxvf /opt/srcPackage/ambari/HDP-2.6.5.0-centos7-rpm.tar.gz -C /var/www/html/

#    - name: copy HDP-UTILS-1.1.0.21-centos7.tar.gz 
#      copy: src=/opt/srcPackage/ambari/HDP-UTILS-1.1.0.21-centos7.tar.gz dest=/var/www/html/HDP-UTILS-1.1.0.21-centos7.tar.gz
# 配置文件內容見 八 中 HDP-UTILS.repo
    - name: copy HDP-UTILS.repo # 需要修改ip
      copy: src=/opt/srcConfig/ambari/HDP-UTILS.repo dest=/etc/yum.repos.d/HDP-UTILS.repo
 
    - name: tar -zxvf HDP-UTILS-1.1.0.21-centos7.tar.gz 
      shell: mkdir -p /var/www/html/HDP-UTILS
    - shell: tar -zxvf /opt/srcPackage/ambari/HDP-UTILS-1.1.0.21-centos7.tar.gz -C /var/www/html/HDP-UTILS
# 配置 mysql-connector
    - name: cp mysql-connector-java-5.1.47.jar
      copy: src=/opt/srcPackage/mysql/mysql-connector-java-5.1.47.jar dest=/usr/share/java/mysql-connector-java.jar

# 安裝 ambari-server
    - name: install ambari-server
      shell: yum install ambari-server -y
# 配置mysql 注意mysql密碼爲自己修改的
    - name: Configure MySQL
      shell: ln -s /usr/local/mysql/bin/mysql /usr/bin
    - shell: mysql -e"use mysql;GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION" -p123456 -h127.0.0.1
    - shell: mysql -e"CREATE USER ambari IDENTIFIED BY '123456'" -p123456 -h127.0.0.1
    - shell: mysql -e"CREATE DATABASE ambari" -p123456 -h127.0.0.1
# 執行ambari的sql腳本 路徑默認是一樣的
    - shell: mysql  -uroot -p123456 -h127.0.0.1 ambari < /var/lib/ambari-server/resources/Ambari-DDL-MySQL-CREATE.sql
# 賦權
    - shell: mysql -e"grant ALL on ambari.* to ambari;flush  privileges" -uroot -p123456 -h127.0.0.1
# 這一部分是我第一次 ambari-server setup的時候使用expect 進行配置的
# 但是由於每次setup步驟不是固定的，老是出現問題 我這裏就換成使用配置文件的方式了
# install expect
#    - name: install expect
#      shell: yum install expect -y
# ambari-server setup 啓動ambari-server
#    - name: copy ambari-server setup Script
#      copy: src=/opt/srcScript/ambariSetup-expect.sh dest=/opt/shFile/ambariSetup-expect.sh
#    - name: ambari-server setup
#      shell: expect /opt/shFile/ambariSetup-expect.sh
#    - shell: ambari-server start

# 配置文件內容見 八 中的 ambari.properties 注意該文件的權限爲  -rwxr-xr-x.
# password.dat 文件內容爲 mysql密碼 權限爲 -rw-r-----
    - name: ambari-server setup
      shell: cat /opt/srcConfig/ambari/ambari.properties > /etc/ambari-server/conf/ambari.properties
    - shell: cp /opt/srcConfig/ambari/password.dat /etc/ambari-server/conf/
    - name: start ambari-server
      shell: ambari-server start
      register: ambari_server_status
# 返回ambari-server啓動狀態
    - name: show
      debug: var=ambari_server_status verbosity=0
- hosts: testslave # 從節點
  remote_user: root

  tasks:

    - name: copy ambari.repo
      copy: src=/opt/srcConfig/ambari/ambari.repo dest=/etc/yum.repos.d/ambari.repo
    
    - name: copy HDP.repo
      copy: src=/opt/srcConfig/ambari/HDP.repo dest=/etc/yum.repos.d/HDP.repo

    - name: copy HDP-UTILS.repo
      copy: src=/opt/srcConfig/ambari/HDP-UTILS.repo dest=/etc/yum.repos.d/HDP-UTILS.repo

#    - name: install ambari-agent
#      shell: yum install ambari-agent -y

- hosts:test # 所有節點
  remote_user: root

  tasks:
    - name: install ambari-agent
      shell: yum install ambari-agent -y
    - name: ambari-agent.ini
      shell: sed -i 's/localhost/node01/g' /etc/ambari-agent/conf/ambari-agent.ini  # 應把 node01 改爲 ambari-server 節點主機名
    - shell: sed -i 's/verify=platform_default/verify=disable/' /etc/python/cert-verification.cfg
    - shell: sed -i "53 iforce_https_protocol=PROTOCOL_TLSv1_2" /etc/ambari-agent/conf/ambari-agent.ini
    - name: start ambari-agent
      shell: /etc/init.d/ambari-agent start
      register: ambari_agent_status
#返回ambari-agent啓動狀態
    - name: show
      debug: var=ambari_agent_status verbosity=0

七、附件-腳本

1.closeTHP.sh

#! /bin/bash
echo "******** CLOSE THP *********"
echo "if test -f /sys/kernel/mm/transparent_hugepage/enabled; then" >> /etc/rc.d/rc.local
echo "echo never > /sys/kernel/mm/transparent_hugepage/enabled" >> /etc/rc.d/rc.local
echo "fi" >> /etc/rc.d/rc.local
echo "if test -f /sys/kernel/mm/transparent_hugepage/defrag; then" >> /etc/rc.d/rc.local
echo "echo never > /sys/kernel/mm/transparent_hugepage/defrag" >> /etc/rc.d/rc.local
echo "fi" >> /etc/rc.d/rc.local
chmod +x /etc/rc.d/rc.local
echo "******** END ********"

2.modifyLimits.sh

#! /bin/bash
echo "******** Modify system limits ********"
echo "* soft nofile 1024000" >> /etc/security/limits.conf
echo "* hard nofile 1024000" >> /etc/security/limits.conf
echo "hive   - nofile 1024000" >> /etc/security/limits.conf
echo "hive   - nproc  1024000" >> /etc/security/limits.conf
echo "******** END ********"

3.modifyNtpMaster.sh

#! /bin/bash
#文件具體怎麼修改可參考 我前面安裝ntp負的文章
echo "******** MODIFY NTP MASTER CONFIG ********"
localIp=`ifconfig -a|grep inet|grep -v 127.0.0.1|grep -v inet6|awk '{print $2}'|tr -d "addr:"|grep "192.168.111"`
file=/etc/ntp.conf
# 行數需按具體情況修改
sed -i "21,24s/^/#/" $file

sed '13 irestrict '$localIp' nomodify notrap nopeer noquery' -i $file
sed '20 irestrict 192.168.111.1 mask 255.255.255.0 nomodify notrap' -i $file
sed '27 iserver 127.127.1.0' -i $file
sed '28 iFudge 127.127.1.0 stratum 10' -i $file

echo "******** END ********" 

4.modifyNtpSlave.sh

#! /bin/bash

echo "******** MODIFY NTP MASTER CONFIG ********"
# ip需改爲 ntpserver節點ip
masterIp="10.20.10.129"
# 10.20.10 需改爲集羣節點所在網段
localIp=`ifconfig -a|grep inet|grep -v 127.0.0.1|grep -v inet6|awk '{print $2}'|tr -d "addr:"|grep "10.20.10"`
file=/etc/ntp.conf

sed -i "21,24s/^/#/" $file

sed '13 irestrict '$localIp' nomodify notrap nopeer noquery' -i $file
# 10.20.10.1 需改爲集羣網關
sed '20 irestrict 10.20.10.1 mask 255.255.255.0 nomodify notrap' -i $file
sed '27 iserver '$masterIp -i $file
sed '28 iFudge '$masterIp' stratum 10' -i $file

echo "******** END ********"     

5.installJdk.sh

#! /bin/bash
echo "******** JDK ********"
tar -xvf /opt/jdk/jdk-8u201-linux-x64.tar.gz -C /opt/jdk
# 我這裏是沒有配置過環境變量的新機器，所以可以直接在/etc/profile 後追加
# 如果已經有環境變量可根據具體情況使用sed -i等命令配置
echo "export JAVA_HOME=/opt/jdk/jdk1.8.0_201" >> /etc/profile
echo "export PATH=\$PATH:\$JAVA_HOME/bin" >> /etc/profile
echo "export CLASSPATH=.:\$JAVA_HOME/lib/dt.jar:\$JAVA_HOME/lib/tools.jar" >> /etc/profile

rm -rf /usr/bin/java
rm -rf /usr/bin/javac
#hostname=`"hostname"`
#ssh $hostname "source /etc/profile;java -version;exit"
source /etc/profile
echo "******* JDK installation completed ********"

6. closeSelinux.sh

#! /bin/bash
echo "******** CLOSE SELINUX *********"
setenforce 0
file=/etc/selinux/config
sed -i "7s/^/#/" $file
sed '7 iSELINUX=disabled' -i $file
echo "******** END ********"

7.installMysql.sh

#! /bin/bash
echo "******** INSTALL MYSQL *********"
#卸載原有的mariadb
OLD_MYSQL=`rpm -qa|grep mariadb`
profile=/etc/profile
for mariadb in $OLD_MYSQL
do
	rpm -e --nodeps $mariadb
done
#刪除原有的my.cnf
rm -rf /etc/my.cnf
#添加用戶組 用戶
groupadd mysql
useradd -g mysql mysql

#解壓mysql包並修改名稱
tar -zxvf /opt/srcPackage/mysql/mysql-5.7.27-el7-x86_64.tar.gz -C /usr/local
mv /usr/local/mysql-5.7.27-el7-x86_64 /usr/local/mysql
#更改所屬的組和用戶
chown -R mysql /usr/local/mysql
chgrp -R mysql /usr/local/mysql

mkdir -p /usr/local/mysql/data
chown -R mysql:mysql /usr/local/mysql/data

#粘貼配置文件my.cnf 內容見八 中的 my.cnf
cp /opt/srcConfig/mysql/my.cnf /usr/local/mysql/

# 安裝mysql
/usr/local/mysql/bin/mysql_install_db --user=mysql --basedir=/usr/local/mysql/ --datadir=/usr/local/mysql/data/

#設置文件及目錄權限：
cp /usr/local/mysql/support-files/mysql.server /etc/init.d/mysqld
chown 777 /usr/local/mysql/my.cnf
chmod +x /etc/init.d/mysqld

mkdir /var/lib/mysql
chmod 777  /var/lib/mysql

#啓動mysql
/etc/init.d/mysqld start

#設置開機啓動
chkconfig --level 35 mysqld on
chmod +x /etc/rc.d/init.d/mysqld
chkconfig --add mysqld

#修改環境變量 
#行數需根據實際情況修改
sed '78s/$/&:\/usr\/local\/mysql\/bin/' -i $profile
mysqlPw=`sed -n 2p /root/.mysql_secret`
mysqlPwTMP=`sed -n 2p /root/.mysql_secret`1
mysqlNewPw=123456
hostname=`"hostname"`
#ssh $hostname "source /etc/profile;java -version"
ssh $hostname "source /etc/profile;mysqladmin -h127.0.0.1 -uroot -p'$mysqlPw' password '$mysqlPwTMP';mysqladmin -h127.0.0.1 -uroot -p'$mysqlPwTMP' password '$mysqlNewPw';exit"


echo "******** MYSQL installation completed ********"

八、附件-配置文件

1. my.cnf

[mysql]
socket=/var/lib/mysql/mysql.sock
# set mysql client default chararter
default-character-set=utf8

[mysqld]
socket=/var/lib/mysql/mysql.sock
# set mysql server port  
port = 3306
# set mysql install base dir
basedir=/usr/local/mysql
# set the data store dir
datadir=/usr/local/mysql/data
# set the number of allow max connnection
max_connections=200
# set server charactre default encoding
character-set-server=utf8
# the storage engine
default-storage-engine=INNODB
lower_case_table_names=1
max_allowed_packet=16M
explicit_defaults_for_timestamp=true

[mysql.server]
user=mysql
basedir=/usr/local/mysql

2. ambari.repo

[ambari-2.5.0.3]
# 注意把 192.168.111.201 爲 自己集羣 主節點的ip
name=ambari Version - ambari-2.5.0.3
#baseurl=http://public-repo-1.hortonworks.com/ambari/centos7/2.x/updates/2.5.0.3 
baseurl=http://192.168.111.201/ambari/centos7/
gpgcheck=1
#gpgkey=http://public-repo-1.hortonworks.com/ambari/centos7/2.x/updates/2.5.0.3/RPM-GPG-KEY/RPM-GPG-KEY-Jenkins
gpgkey=http://192.168.111.201/ambari/centos7/RPM-GPG-KEY/RPM-GPG-KEY-Jenkins
enabled=1

3. HDP.repo

[HDP-2.6]
# 注意把 192.168.111.201 爲 自己集羣 主節點的ip
name=HDP-2.6
baseurl=http://192.168.111.201/HDP/centos7/2.6.5.0-292
path=/
enabled=1
gpgcheck=0

4. HDP-UTILS.repo

[HDP-UTILS-1.1.0.21]
# 注意把 192.168.111.201 爲 自己集羣 主節點的ip
name=HDP-UTILS-1.1.0.21
baseurl=http://192.168.111.201/HDP-UTILS/
path=/
enabled=1
gpgcheck=0

5. ambari.properties （注意改 node01 爲 主節點 hostname）

#
# Copyright 2011 The Apache Software Foundation
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

#
#Wed May 20 15:47:56 CST 2020
ulimit.open.files=65536
views.http.x-content-type-options=nosniff
server.persistence.type=remote
jdk1.8.jcpol-url=http://public-repo-1.hortonworks.com/ARTIFACTS/jce_policy-8.zip
java.releases.ppc64le=
recommendations.artifacts.lifetime=1w
http.pragma=no-cache
jdk1.8.url=http://public-repo-1.hortonworks.com/ARTIFACTS/jdk-8u112-linux-x64.tar.gz
server.execution.scheduler.misfire.toleration.minutes=480
java.home=/opt/jdk/jdk1.8.0_201
security.server.disabled.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384|TLS_RSA_WITH_AES_256_CBC_SHA256|TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384|TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256|TLS_DHE_DSS_WITH_AES_256_CBC_SHA256|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA|TLS_RSA_WITH_AES_256_CBC_SHA|TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA|TLS_ECDH_RSA_WITH_AES_256_CBC_SHA|TLS_DHE_RSA_WITH_AES_256_CBC_SHA|TLS_DHE_DSS_WITH_AES_256_CBC_SHA|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256|TLS_RSA_WITH_AES_128_CBC_SHA256|TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256|TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256|TLS_DHE_DSS_WITH_AES_128_CBC_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA|TLS_RSA_WITH_AES_128_CBC_SHA|TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA|TLS_ECDH_RSA_WITH_AES_128_CBC_SHA|TLS_DHE_RSA_WITH_AES_128_CBC_SHA|TLS_DHE_DSS_WITH_AES_128_CBC_SHA|TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA|TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA|SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA|SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA|TLS_EMPTY_RENEGOTIATION_INFO_SCSV|TLS_DH_anon_WITH_AES_256_CBC_SHA256|TLS_ECDH_anon_WITH_AES_256_CBC_SHA|TLS_DH_anon_WITH_AES_256_CBC_SHA|TLS_DH_anon_WITH_AES_128_CBC_SHA256|TLS_ECDH_anon_WITH_AES_128_CBC_SHA|TLS_DH_anon_WITH_AES_128_CBC_SHA|TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA|SSL_DH_anon_WITH_3DES_EDE_CBC_SHA|SSL_RSA_WITH_DES_CBC_SHA|SSL_DHE_RSA_WITH_DES_CBC_SHA|SSL_DHE_DSS_WITH_DES_CBC_SHA|SSL_DH_anon_WITH_DES_CBC_SHA|SSL_RSA_EXPORT_WITH_DES40_CBC_SHA|SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA|SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA|SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA|TLS_RSA_WITH_NULL_SHA256|TLS_ECDHE_ECDSA_WITH_NULL_SHA|TLS_ECDHE_RSA_WITH_NULL_SHA|SSL_RSA_WITH_NULL_SHA|TLS_ECDH_ECDSA_WITH_NULL_SHA|TLS_ECDH_RSA_WITH_NULL_SHA|TLS_ECDH_anon_WITH_NULL_SHA|SSL_RSA_WITH_NULL_MD5|TLS_KRB5_WITH_3DES_EDE_CBC_SHA|TLS_KRB5_WITH_3DES_EDE_CBC_MD5|TLS_KRB5_WITH_DES_CBC_SHA|TLS_KRB5_WITH_DES_CBC_MD5|TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA|TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
server.jdbc.hostname=node01
shared.resources.dir=/usr/lib/ambari-server/lib/ambari_commons/resources
server.jdbc.connection-pool.max-idle-time=14400
resources.dir=/var/lib/ambari-server/resources
custom.action.definitions=/var/lib/ambari-server/resources/custom_action_definitions
views.request.connect.timeout.millis=5000
jdk1.7.desc=Oracle JDK 1.7 + Java Cryptography Extension (JCE) Policy Files 7
server.jdbc.driver=com.mysql.jdbc.Driver
security.server.keys_dir=/var/lib/ambari-server/keys
server.jdbc.rca.user.name=ambari
webapp.dir=/usr/lib/ambari-server/web
views.http.pragma=no-cache
server.os_family=redhat7
server.jdbc.user.passwd=/etc/ambari-server/conf/password.dat
server.execution.scheduler.isClustered=false
views.ambari.request.connect.timeout.millis=30000
server.jdbc.database=mysql
server.jdbc.connection-pool=c3p0
server.jdbc.database_name=ambari
server.jdbc.rca.url=jdbc:mysql://node01:3306/ambari
bootstrap.script=/usr/lib/python2.6/site-packages/ambari_server/bootstrap.py
server.version.file=/var/lib/ambari-server/resources/version
jdk1.8.dest-file=jdk-8u112-linux-x64.tar.gz
server.task.timeout=1200
user.inactivity.timeout.role.readonly.default=0
server.jdbc.connection-pool.max-age=0
java.releases=jdk1.8,jdk1.7
recommendations.dir=/var/run/ambari-server/stack-recommendations
agent.stack.retry.tries=5
server.os_type=centos7
server.python.log.level=INFO
server.execution.scheduler.maxDbConnections=5
views.ambari.request.read.timeout.millis=45000
views.http.cache-control=no-store
rolling.upgrade.skip.packages.prefixes=
jdk1.8.home=/usr/jdk64/
jdk1.7.home=/usr/jdk64/
agent.task.timeout=900
bootstrap.setup_agent.script=/usr/lib/python2.6/site-packages/ambari_server/setupAgent.py
server.jdbc.rca.driver=com.mysql.jdbc.Driver
jdk1.7.dest-file=jdk-7u67-linux-x64.tar.gz
agent.package.install.task.timeout=1800
server.jdbc.port=3306
http.strict-transport-security=max-age=31536000
common.services.path=/var/lib/ambari-server/resources/common-services
agent.threadpool.size.max=25
ambari.python.wrap=ambari-python-wrap
skip.service.checks=false
server.jdbc.connection-pool.idle-test-interval=7200
ambari-server.user=root
jdk1.8.desc=Oracle JDK 1.8 + Java Cryptography Extension (JCE) Policy Files 8
views.http.strict-transport-security=max-age=31536000
http.x-content-type-options=nosniff
jdk1.7.re=(jdk.*)/jre
metadata.path=/var/lib/ambari-server/resources/stacks
jdk1.8.jcpol-file=jce_policy-8.zip
views.skip.home-directory-check.file-system.list=wasb,adls,adl
server.python.log.name=ambari-server-command.log
stackadvisor.script=/var/lib/ambari-server/resources/scripts/stack_advisor.py
http.x-xss-protection=1; mode=block
bootstrap.dir=/var/run/ambari-server/bootstrap
server.connection.max.idle.millis=900000
server.jdbc.rca.user.passwd=/etc/ambari-server/conf/password.dat
views.http.x-frame-options=SAMEORIGIN
server.jdbc.connection-pool.acquisition-size=5
http.x-frame-options=DENY
jce.download.supported=true
jdk.download.supported=true
jdk1.7.url=http://public-repo-1.hortonworks.com/ARTIFACTS/jdk-7u67-linux-x64.tar.gz
server.jdbc.user.name=ambari
mpacks.staging.path=/var/lib/ambari-server/resources/mpacks
pid.dir=/var/run/ambari-server
user.inactivity.timeout.default=0
agent.stack.retry.on_repo_unavailability=false
extensions.path=/var/lib/ambari-server/resources/extensions
views.request.read.timeout.millis=10000
jdk1.7.jcpol-file=UnlimitedJCEPolicyJDK7.zip
server.tmp.dir=/var/lib/ambari-server/data/tmp
server.execution.scheduler.maxThreads=5
server.jdbc.url=jdbc:mysql://node01:3306/ambari
server.fqdn.service.url=http://169.254.169.254/latest/meta-data/public-hostname
views.http.x-xss-protection=1; mode=block
server.http.session.inactive_timeout=1800
server.stages.parallel=true
kerberos.keytab.cache.dir=/var/lib/ambari-server/data/cache
jdk1.8.re=(jdk.*)/jre
http.cache-control=no-store
client.threadpool.size.max=25
jdk1.7.jcpol-url=http://public-repo-1.hortonworks.com/ARTIFACTS/UnlimitedJCEPolicyJDK7.zip
server.jdbc.connection-pool.max-idle-time-excess=0

九、遇到問題

1. 安裝mysq修改密碼問題

報錯信息

Access denied for user 'root'@'localhost' (using password: YES)

問題原因：根本原因是密碼設置策略問題，因爲我之間使用臨時密碼，設置新密碼爲很簡單的密碼123456纔會報錯
解決發放：
設置新密碼臨時密碼後面隨便加個字母，就可以成功，然後再重新設置爲簡單密碼，這樣就可以了
腳本如下

mysqlPw=`sed -n 2p /root/.mysql_secret`
mysqlPwTMP=`sed -n 2p /root/.mysql_secret`1
mysqlNewPw=123456
hostname=`"hostname"`
#ssh $hostname "source /etc/profile;java -version"
ssh $hostname "source /etc/profile;mysqladmin -h127.0.0.1 -uroot -p'$mysqlPw' password '$mysqlPwTMP';mysqladmin -h127.0.0.1 -uroot -p'$mysqlPwTMP' password '$mysqlNewPw';exit"

使用ssh修改的原因是，在當前shell中，前面剛剛source環境變量之後，當前shell拿不到最新的環境變量也就是會報錯
mysqladmin 命令找不到的錯誤

2.頁面進行註冊ambari-agent失敗問題

問題：在openssl版本一致的情況python-2.7.5可能會出現證書驗證失敗

解決辦法

sed -i 's/verify=platform_default/verify=disable/' /etc/python/cert-verification.cfg

問題：ssl版本問題

解決辦法

sed -i "53 iforce_https_protocol=PROTOCOL_TLSv1_2" /etc/ambari-agent/conf/ambari-agent.ini

十、總結

1.經驗總結

ansible：本人感覺沒有實際應用價值，用shell+ssh能完全實現一鍵式部署，不需要前面的安裝

2.缺陷

ansible：需要安裝
hosts：如果hosts文件更改，需要改的地方太多了
配置文件：ansible，shell腳本中變量沒有使用統一配置文件

3.期望

應該使用shell去讀hosts文件，直接使用shell完成一鍵式，摒棄ansible，使用配置文件來完成變量定義，如果更換環境，或在其他地方部署會方便的多