ansible笔记

其它很多源都不行，只有这个可以
[[email protected] ~]# vim ansible.repo    

[ansible]
name=ansible
baseurl=https://mirror.tuna.tsinghua.edu.cn/epel/7/x86_64/
gpgcheck=0

ansbile默认目录在/etc/ansible/
要读取的文件是hosts文件

创建公钥和私钥
ssh-keygen 一直回车，会在当前用户家目录.ssh/下产生两个文件一个公钥一个私钥
id_rsa  私     id_rsa.pub 公
ssh-copy-id -i /root/.ssh/id_rsa.pub  [email protected]  下面那种也可以
ssh-copy-id  [email protected]  自动考到客户端去
再ssh客户端就不用密码了

配置ssh免密码登录后，仍提示输入密码
解决方法：
首先我们就要去查看系统的日志文件
tail /var/log/secure -n 20
发现问题的所在：Authentication refused: bad ownership or modes for file
注意被控端权限要这样不然还是要密码：
[[email protected] ~]# chmod 755 /root
[[email protected] ~]# chmod 700 .ssh
[[email protected] ~]# chmod 600 .ssh/authorized_keys
Root目录和子目录必须要所有者和所组都是root
drwxr-xr-x. 23 root root 4096 Mar 25 22:50 /root

这样hosts文件中就不用写客户端密码一可以访问了

 
常用模块：
默认读取IP在/etc/ansible/hosts文件中

Copy、yum、service、script、file、group、user、cront、mount、shell
每个模块用法查看：ansible-doc+模块名  看examples案例

ping模块用法
ansible -i /etc/ansible/hosts www -m ping

改密码：
ansible www -m shell -a "echo admin|passwd --stdin root"

软件安装
ansible www –k –m yum –a “name=httpd  state=installed  disable_gpg_check=no”

第二种安装方法
ansible www–m shell  -a “yum install httpd -y”

停止程序
ansible www –m shell –a “pkill yum”

拷贝文件
ansible  www –k –m copy –a “src=/etc/passwd dest=/tmp/ mode=755  owner=root”

2、主配置文件
 vi /etc/ansible/ansible.cfg
	[defaults]
	inventory = /etc/ansible/hosts
	forks = 5 命令完一次出几行结果
	become = root (sudo_user这项已经不用了可以不用开)
	remote_port = 22
	host_key_checking = False
	timeout = 10
	log_path = /var/log/ansible.log
	private_key_file = /root/.ssh/id_rsa 用公钥加密,ssh不安全
	
3、简单使用
/etc/ansible/hosts下增加这2行
[webservers]
192.168.1.10 ansible_ssh_user=root ansible_ssh_pass=123456
摧送了公钥这都不用写用户和密码了

服务器访问ansible webservers -a "df -h" 

#批量执行命令
[[email protected] ~]# ansible oldboy -m command -a "df -h"

5.定义主机清单
[web]
172.16.1.7

[nfs]
172.16.1.31

[backup]
172.16.1.41

[oldboy:children] 针对组的组进行管理
web
nfs
backup

ansible oldboy --list-hosts查看组的主机列表
ansible web -m ping 测试主机ping用ping模块

6、利用客户端普通用户来进行访问
先在客户端把用户加入visudo里面
visudo 下找到root    ALL=(ALL)       ALL
按这个格式把新用户添加一行

服务器上面修改hosts文件下面这样就行了不用账号密码:
[webserver]
192.168.10.3

然后服务端测试访问:(后面的K为大写)
ansible webserver -a "ls /root" -u user1 -k --become --become-user root -K
#前面小k后面大K
SSH password: (root密码)
SUDO password[defaults to SSH password]: (user1普通用户密码)

7.command命令模块(带管道符的用不了这个模块，要用shell模块)
如果不知道模块怎么写:ansible-doc copy  可以看EXAMPLES下面的例子 
# 默认模块, 执行命令
[[email protected] ~]# ansible oldboy  -a "hostname"
# 如果需要一些管道操作，则使用shell
[[email protected] ~]# ansible oldboy -m shell -a "ifconfig|grep eth0" -f 50
# -f =forks   /etc/ansible/ansible.cfg #结果返回的数量

8.yum安装模块
#推送脚本文件至远程，远程执行脚本文件

[[email protected] ~]# ansible oldboy -m yum -a "name=httpd state=installed"
name    ---指定要安装的软件包名称
state   ---指定使用yum的方法
    installed，present   ---安装软件包
    removed，absent      ---移除软件包
    latest               ---安装最新软件包
    
9.copy模块
# 推送文件模块
[[email protected] ~]# ansible oldboy -m copy -a "src=/etc/hosts dest=/tmp/test.txt owner=www group=www mode=0600"

# 在推送覆盖远程端文件前，对远端已有文件进行备份，按照时间信息备份
[[email protected] ~]# ansible oldboy -m copy -a "src=/etc/hosts dest=/tmp/test.txt backup=yes"

# 直接向远端文件内写入数据信息，并且会覆盖远端文件内原有数据信息
[[email protected] ~]# ansible oldboy -m copy -a "content='bgx' dest=/tmp/oldboy"

src           --- 推送数据的源文件信息
dest          --- 推送数据的目标路径
backup        --- 对推送传输过去的文件，原摧送的位置多一个文件备份带时间格式的 
content       --- 直在客户机上建立一个文件并且还可以写入指定的信息
group         --- 将本地文件推送到远端，指定文件属组信息
owner         --- 将本地文件推送到远端，指定文件属主信息
mode          --- 将本地文件推送到远端，指定文件权限信息

10.service服务模块
[[email protected] ~]# ansible oldboy -m service -a "name=crond state=stopped enabled=yes"
name        --- 定义要启动服务的名称
state       --- 指定服务状态是停止或是运行
    started     --- 启动
    stopped     --- 停止
    restarted   --- 重启
    reloaded    --- 重载
enabled     --- 是否让服务开启自启动


11.安装
[[email protected] ~]# ansible web -m yum -a "name=httpd state=installed"
12.配置
[[email protected] ~]# ansible web -m copy -a "content='This is Ansible' dest=/var/www/html/index.html"
13.启动
[[email protected] ~]# ansible web -m service -a "name=httpd state=started"


yum copy service mount cron user file 
1.机器还原快照（firewalld、selinux、配置好仓库）
2.推送你的公钥
3.指定backup安装rsync、配置、启动、创建目录、创建用户、准备密码文件、权限
4.指定nfs安装nfs、配置、启动
5.web挂载nfs
6.web执行脚本推送数据至bakcup，加入定时任务


14、拷贝文件去客户端
ansible webserver -m copy -a "src=anaconda-ks.cfg  dest=/tmp" 

15、在客户端新建立文件夹
ansible webserver -m file -a "dest=/tmp/abc mode=777 state=directory" 

16、删除客户端文件
ansible webserver -m file -a "dest=/tmp/abc  state=absent" 

17、客户端新建文件
ansible webserver -m file -a "dest=/tmp/abc mode=777 state=touch" 

18、软件安装
ansible webserver -m yum -a "name=vim state=present"

19、创建用户
ansible webserver -m user -a "name=foo password=admin" 

20、删除用户
ansible webserver -m user -a "name=foo state=absent" 

21、创建用户不可以登陆
ansible webserver -m user -a "name=foo password=admin shell=/sbin/nologin"  

22、启动、停止、重启、开机启动，服务
ansible webserver -m service -a "name=httpd state=started" 
state=restarted     state=stopped       enabled=true

23、#在本地运行模块，等同于在远程执行，不需要将脚本文件进行推送目标主机执行
[[email protected] ~]# ansible oldboy -m script -a "/server/scripts/yum.sh"

24.file配置模块
    创建目录
[[email protected] ~]# ansible oldboy -m file -a "path=/tmp/oldboy state=diretory"
    创建文件
[[email protected] ~]# ansible oldboy -m file -a "path=/tmp/tt state=touch mode=555 owner=root group=root"
[[email protected] ~]# ansible oldboy -m file -a "src=/tmp/tt path=/tmp/tt_link state=link"
递归改组root
 ansible web -m file -a "path=/tmp/test state=directory owner=root group=root recurse=yes"
path        --- 指定远程主机目录或文件信息
recurse     --- 递归授权
state       --- 
    directory   --- 在远端创建目录
    touch       --- 在远端创建文件
    link        --- link或hard表示创建链接文件
    absent      --- 表示删除文件或目录
    mode        --- 设置文件或目录权限
    owner       --- 设置文件或目录属主信息
    group       --- 设置文件或目录属组信息

25.group模块
name            --- 指定创建的组名
gid             --- 指定组的gid
state
    absent      --- 移除远端主机的组
    present     --- 创建远端主机的组（默认）


创建组，指定gid
[[email protected] ~]# ansible oldboy -m group -a "name=oldgirl gid=888"

8.user模块
uid             --- 指定用户的uid
group           --- 指定用户组名称
groups          --- 指定附加组名称
password        --- 给用户添加密码
shell           --- 指定用户登录shell
create_home     --- 是否创建家目录


创建oldgirl，设定uid为888，并加入gid为888
[[email protected] ~]# ansible oldboy -m user -a "name=oldgirl uid=888 group=888 shell=/sbin/nologin create_home=no"

随机生成加密字符串（-1使用MD5进行加密 -stdin 非交互式 -salt 加密参数）
[[email protected] ~]# echo "bgx" | openssl passwd -1 -stdin
固定加密字符串
[[email protected] ~]# echo "123"| openssl passwd -1 -stdin -salt 'salt

创建普通用户，并配置对应的用户密码
[[email protected] ~]# echo "bgx" | openssl passwd -1 -stdin
$1$1KmeCnsK$HGnBE86F/XkXufL.n6sEb.
[[email protected] ~]# ansible oldboy -m user -a 'name=xlw password="$1$765yDGau$diDKPRoCIPMU6KEVEaPTZ0"'



26.crond模块
# 正常使用crond服务
[[email protected] ~]# crontab -l 查看有哪些计划
* * * * *  /bin/sh /server/scripts/yum.sh

# 使用ansible添加一条定时任务
[[email protected] ~]# ansible oldboy -m cron -a "minute=* hour=* day=* month=* weekday=*  job='/bin/sh /server/scripts/test.sh'"
[[email protected] ~]# ansible oldboy -m cron -a "job='/bin/sh /server/scripts/test.sh'"

# 设置定时任务注释信息name='cron01'，防止重复，name设定
[[email protected] ~]# ansible oldboy -m cron -a "name='cron01' job='/bin/sh /server/scripts/test.sh'"

# 删除相应定时任务
[[email protected] ~]# ansible oldboy -m cron -a "name='ansible cron02' minute=0 hour=0 job='/bin/sh /server/scripts/test.sh' state=absent"
 
# 注释相应定时任务，使定时任务失效    
[[email protected] scripts]# ansible oldboy -m cron -a "name='ansible cron01' minute=0 hour=0 job='/bin/sh /server/scripts/test.sh' disabled=yes"


27.mount模块(挂栽的目录会自动创建,如果用absent卸载会把目录同时删除)
(剧本中没测试不知道是否可以自动创立文件夹)

present     ---开机挂载，仅将挂载配置写入/etc/fstab
mounted     ---挂载设备，并将配置写入/etc/fstab
unmounted   ---卸载设备，不会清除/etc/fstab写入的配置
absent      ---卸载设备，会清理/etc/fstab写入的配置

挂载光盘
ansible web -m mount -a "src=/dev/cdrom path=/mnt/cdrom fstype=iso9660 opts=defaults state=mounted"

仅将挂载的配置写入/etc/fstab，并不会执行挂载操作
[[email protected] ~]# ansible oldboy -m mount -a "src=172.16.1.31:/data path=/data fstype=nfs opts=defaults state=present"

临时挂载设备，并将挂载信息写入/etc/fstab
[[email protected] ~]# ansible web -m mount -a "src=172.16.1.31:/data path=/data fstype=nfs opts=defaults state=mounted"

临时卸载，不会清理/etc/fstab
[[email protected] ~]# ansible web -m mount -a "src=172.16.1.31:/data path=/data fstype=nfs opts=defaults state=unmounted"

卸载，不仅临时卸载，同时会清理/etc/fstab
[[email protected] ~]# ansible web -m mount -a "src=172.16.1.31:/data path=/data fstype=nfs opts=defaults state=absent"


yum copy service mount cron user file 
1.机器还原快照（firewalld、selinux、配置好仓库）
    选择虚拟机-》快照-》恢复

           

-----------------playbook---------------------------- playbook是由一个或多个模块组成的，使用多个不同的模块，完成一件事情。

yum
copy
service
安装一个服务，配置，并启动。
    1.找谁来拍。
    2.大概的任务。
    3.具体怎么做。


安装httpd服务->playbook
1.安装
2.配置
3.启动

测试一个案例：
[[email protected] ansible]# cat http_install.yaml 
#this is ansible playbook!
#
- hosts: www
  tasks:

    - name: copy yum
      copy: src=/etc/ansible/my-yum.repo  dest=/etc/yum.repos.d/my-yum.repo

    - name: mounts
      mount: src=/dev/cdrom path=/mnt fstype=iso9660 opts=defaults state=mounted
    
    - name: flush
      shell: /usr/bin/yum makecache

    - name: install httpd
      yum: name=httpd,httpd-tools state=installed

    - name: start httpd 
      service: name=httpd state=started enabled=yes

    - name: copy file
      copy: src=/etc/ansible/httpd.conf dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd   //如果配置文件有变化就调用下面的重启服务

     
- hosts: www6
  tasks:

    - name: copy yum
      copy: src=/etc/ansible/my-yum6.repo  dest=/etc/yum.repos.d/my-yum.repo

    - name: mounts
      mount: src=/dev/cdrom path=/mnt fstype=iso9660 opts=defaults state=mounted
    
    - name: flush
      shell: /usr/bin/yum makecache

    - name: install httpd
      yum: name=httpd,httpd-tools state=installed

    - name: start httpd 
      service: name=httpd state=started enabled=yes

    - name: copy file
      copy: src=/etc/ansible/httpd.conf dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd    //如果配置文件有变化就调用下面的重启服务

  handlers:
    - name: restart httpd
      service: name=httpd state=restarted


[[email protected] ~]# cat httpd_install.yaml 
#这是一个ansible的playbook

- hosts: web
  tasks:

    - name: Install Httpd Server
      yum: name=httpd,httpd-tools state=installed

    - name: Configure Httpd Server
      copy: src=./httpd.conf dest=/etc/httpd/conf/httpd.conf

    - name: Start Httpd Server
      service: name=httpd state=started enabled=yes 


ansible-playbook --syntax-check http_install.yaml
查下语法没有错误

ansible-playbook –C  httpd_install.yaml
模拟运行一下

2.修改本地拷贝好的httpd.conf文件
3.执行ansible-playbook httpd_install.yaml 推送


1.环境规划
角色 	外网IP(NAT) 	内网IP(LAN) 	    部署软件
m01 	eth0:10.0.0.61 	eth1:172.16.1.61 	ansible
backup 	eth0:10.0.0.41 	eth1:172.16.1.41 	rsync
nfs 	eth0:10.0.0.31 	eth1:172.16.1.31 	nfs、Sersync
web01 	eth0:10.0.0.7 	eth1:172.16.1.7 	httpd


1.全网备份
2.实时备份

0.目录规划
[[email protected] ~]# mkdir /etc/ansible/ansible_playbook/{file,conf,scripts} -p 
[[email protected] ~]# tree /etc/ansible/ansible_playbook/
/etc/ansible/ansible_playbook/
├── conf
└── file
└── scripts

##########
1.基础环境：所有机器统一的配置
    1.需要关闭firewalld以及selinux、epel仓库、ssh端口、优化基础配置
    2.需要安装rsync和nfs-utils
    3.准备www用户
    4.需要准备/etc/rsync.pass密码文件
    5.需要准备全网备份脚本

基础的playbook剧本
简单精典案例(安装、配置、运行，重启):
vim install_httpd.yaml

#install http

- hosts: web
  tasks:

    - name: install httpd
      yum: name=httpd state=installed

    - name: configure file
		 把自己本地的httpd.conf文件改好copy到所有客户机上
      copy: src=./httpd.conf  dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd 如果配置文件有改动就会调下面的handlers名字下面的
							服务restart httpd这个名字一定要和下面对应

    - name: start service
      service: name=httpd state=started

  handlers:
    - name: restart httpd
      service: name=httpd state=restarted

测试语法:ansible-playbook --syntax-check install_http.yaml
模拟运行一下:ansible-playbook -C install_http.yaml

-----------------------------------------------------------
[[email protected] ansible_playbook]# 
阿里云yum添加:
1、https://opsx.alibaba.com/mirror
2、ctrl+f 过滤epel
3、打开帮助
4、wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
5、会在这里多一个yum文件：/etc/yum.repos.d/epel.repo 

vim  base.yaml 
- hosts: all
  tasks:

    - name: Install Epel Repos
	ansible没有wget所以我们用get_url模块一样的功能上面
      get_url: url=http://mirrors.aliyun.com/repo/epel-7.repo dest=/etc/yum.repos.d/epel.repo

    - name: Dns Client
      copy: src=./conf/resolv.conf dest=/etc/resolv.conf

    - name: Install Rsync Nfs-Utils
      yum: name=rsync,nfs-utils state=installed

    - name: Create Group WWW
      group: name=www gid=666

    - name: Create User WWW
      user: name=www uid=666 group=666 create_home=no shell=/sbin/nologin

    - name: Create Rsync_Client_Pass
      copy: content='1' dest=/etc/rsync.pass mode=600

    - name: Create Scripts Directory
      file: path=/server/scripts recurse=yes state=directory

    - name: Push File Scripts
      copy: src=./scripts/rsync_backup_md5.sh dest=/server/scripts/

    - name: Crontable Scripts
      cron: name="backup scripts" hour=01 minute=00 job="/bin/bash /server/scripts/rsync_backup_md5.sh &>/dev/null"


##########
2.应用环境：Rsync
    1.安装rsync
    2.配置rsync（配置变更，一定要进行重载操作）
    3.创建虚拟用户，权限调整
    4.创建目录/data/  /backup
    5.启动rsync
    6.配置邮箱->邮箱的发件人->校验的脚本
    
[[email protected] ansible_playbook]# cat rsync.yaml 
- hosts: backup
  tasks:
    - name: Installed Rsync Server
      yum: name=rsync,mailx state=installed

    - name: configure Rsync Server
      copy: src=./conf/rsyncd.conf dest=/etc/rsyncd.conf
      notify: Restart Rsync Server

    - name: Create Virt User
      copy: content='rsync_backup:1' dest=/etc/rsync.password mode=600

    - name: Create Data 
      file: path=/data state=directory recurse=yes owner=www group=www mode=755

    - name: Create Backup 
      file: path=/backup state=directory recurse=yes owner=www group=www mode=755

    - name: Start RsyncServer
      service: name=rsyncd state=started enabled=yes

    - name: Push Check Scripts
      copy: src=./scripts/rsync_check_backup.sh dest=/server/scripts/

    - name: Crond Check Scripts
      cron: name="check scripts" hour=05 minute=00 job="/bin/bash /server/scripts/rsync_check_backup.sh &>/dev/null"

  handlers:
    - name: Restart Rsync Server
      service: name=rsyncd state=restarted
    
3.应用环境：NFS
    1.安装nfs-utils
    2.配置nfs     （当修改了配置，触发重载操作）
    3.创建目录，授权
    4.启动
 [[email protected] ansible_playbook]# cat nfs.yaml 
- hosts: nfs
  tasks:

    - name: Installed Nfs Server
      yum: name=nfs-utils state=installed

    - name: Configure Nfs Server
      copy: src=./conf/exports dest=/etc/exports
      notify: Restart Nfs Server

    - name: Create Share Data
      file: path=/data state=directory recurse=yes owner=www group=www mode=755

    - name: Start Nfs Server
      service: name=nfs-server state=started enabled=yes

  handlers:
    - name: Restart Nfs Server
      service: name=nfs-server state=restarted
 
4.应用环境：Sersync
    1.下载sersync
    2.解压，改名，配置
    3.启动
[[email protected] ansible_playbook]# cat sersync.yaml 
- hosts: nfs
  tasks:
    - name: Scp Sersync
      copy: src=./file/sersync2.5.4_64bit_binary_stable_final.tar.gz dest=/usr/local/sersync.tar.gz

    - name: Zip
      shell: cd /usr/local && tar xf sersync.tar.gz && mv GNU-Linux-x86 sersync
      args: 这个意思是上面如果有下面的目录了就不创建了
        creates: /usr/local/sersync
    
    - name: configure Sersync
      copy: src=./conf/confxml.xml dest=/usr/local/sersync/

    - name: Start Sersync
      shell: /usr/local/sersync/sersync2 -dro /usr/local/sersync/confxml.xml
 
5.应用环境：WEB

    1、挂载nfs共享的目录
    
[[email protected] ansible_playbook]# cat web.yaml 
- hosts: web
  tasks:

    - name: Mount NFS Server Share Data
      mount: src=172.16.1.31:/data path=/data fstype=nfs opts=defaults state=mounted   
    

6.包含模拟include
vim mail.yaml  写个总模块来调用上面的分模块
- import_playbook: base.yaml
- import_playbook: rsync.yaml
- import_playbook: nfs.yaml
- import_playbook: sersync.yaml
- import_playbook: web.yaml

7.快照还原
    1.推送公钥
    2.使用ping模块测试
    3.执行ansible-playbook测试
    4.测试全网备份，测试是否能发邮件，并校验结果
    5.测试nfs的挂载
    6.测试实时同步
    
###################################################
扩展：
    1.安装httpd,php服务
    [[email protected] ~]# yum install httpd php -y
    2.配置httpd服务
    -----上qq群下载httpd.conf文件即可--------
    3.上传代码
    [[email protected] conf]# cd /data/
    -------上传kaoshi.zip文件-------
    4.解压代码
    [[email protected] data]# unzip  kaoshi.zip
    5.启动httpd服务
    [[email protected] conf]# systemctl start httpd