ansible-roles

roles：通过使用include_tasks功能，将大型剧本，缩小体积，变得更加模块化

1.案例：通过roles部署rsync，lsync，nfs服务

1.新建roles标准目录结构

[root@master-61 /server]# mkdir roles
[root@master-61 /server]# cd roles/
[root@master-61 /server/roles]# touch main.yml
[root@master-61 /server/roles]# mkdir ./{nfs_lsync-server,nfs-client,rsync-server}
[root@master-61 /server/roles]# mkdir nfs_lsync-server/{files,handlers,tasks,templates}
[root@master-61 /server/roles]# mkdir nfs-client/{files,handlers,tasks,templates}
[root@master-61 /server/roles]# mkdir rsync-server/{files,handlers,tasks,templates}
[root@master-61 /server/roles]# tree -NF .
.
├── main.yml
├── nfs-client/
│?? ├── files/
│?? ├── handlers/
│?? ├── tasks/
│?? └── templates/
├── nfs_lsync-server/
│?? ├── files/
│?? ├── handlers/
│?? ├── tasks/
│?? └── templates/
└── rsync-server/
    ├── files/
    ├── handlers/
    ├── tasks/
    └── templates/

2.在对应目录中建立main.yml文件，编写剧本

2.1 编写nfs_lsync-server模块中的剧本

[root@master-61 /server/roles/nfs_lsync-server]# vim ./tasks/main.yml
[root@master-61 /server/roles/nfs_lsync-server]# cat ./tasks/main.yml 
- name: 01安装nfs-utils,rpcbind,lsyncd
  yum: 
    name: "{{ item }}"
    state: present
  loop: 
    - nfs-utils
    - rpcbind
    - lsyncd
- name: 02发送nfs-utils配置文件
  copy:
    src: /etc/exports
    dest: /etc/exports
  notify: 
    - 重启nfs
- name: 03发送lsyncd密码文件
  copy: 
    src: /server/rsync.passwd
    dest: /etc/rsync.passwd
    mode: 600
- name: 04发送lsyncd配置文件
  copy: 
    src: /lsyncd.conf
    dest: /etc/lsyncd.conf
  notify:
    - 重启lsyncd
- name: 05创建共享目录
  file:
    path: /nfs-data
    state: directory
    owner: nfsnobody
    group: nfsnobody
- name: 06启动服务
  systemd: 
    name: "{{ item }}" 
    state: started
  loop: 
    - rpcbind
    - nfs
    - lsyncd

[root@master-61 /server/roles/nfs_lsync-server]# vim ./handlers/main.yml
[root@master-61 /server/roles/nfs_lsync-server]# cat ./handlers/main.yml 
- name: 重启nfs
  systemd: 
    name: nfs
    state: restarted  
- name: 重启lsyncd
  systemd: 
    name: lsyncd

2.2 编写nfs-client模块中的剧本

[root@master-61 /server/roles/nfs_lsync-server]# cd /server/roles/nfs-client/
[root@master-61 /server/roles/nfs-client]# vim ./tasks/main.yml
[root@master-61 /server/roles/nfs-client]# cat ./tasks/main.yml 
- name: 01安装nfs-utils
  yum: 
    name: nfs-utils
    state: present
- name: 02挂载共享目录
  mount: 
    src: 172.16.1.31:/nfs-data
    path: /nfs_test
    fstype: nfs
    state: mounted

2.3 编写rsync-server模块中的剧本

[root@master-61 /server/roles/nfs-client]# cd /server/rsync-server/
[root@master-61 /server/rsync-server]# vim tasks/main.yml
[root@master-61 /server/rsync-server]# cat tasks/main.yml 
- name: 01安装rsync软件
  yum: 
    name: rsync
    state: present
- name: 02发送配置文件
  copy: 
    src: /rsyncd.conf
    dest: /etc/rsyncd.conf
  notify: 
    - 重启rsync
- name: 03发送密码文件
  copy: 
    src: /rsync.passwd
    dest: /etc/rsync.passwd
    mode: 600
- name: 04创建www用户
  user:
    name: www
    create_home: no
    shell: /sbin/nologin

- name: 05创建共享目录
  file:
    path: /backup
    state: directory
    owner: www
    group: www
- name: 启动rsync服务
  systemd: 
    name: rsyncd
    state: started

[root@master-61 /server/rsync-server]# vim handlers/main.yml
[root@master-61 /server/rsync-server]# cat handlers/main.yml 
- name: 重启rsync
  systemd: 
    name: rsyncd
    state: restarted

2.4 编写roles下的main.yml文件

[root@master-61 /server/rsync-server]# vim /server/roles/main.yml 
[root@master-61 /server/rsync-server]# cat /server/roles/main.yml 
- hosts: nfs
  roles: 
    - role: nfs_lsync-server
- hosts: web
  roles: 
    - role: nfs-client
- hosts: rsync
  roles:
    - role: rsync-server

2.5 执行查看结果

[root@master-61 /server/rsync-server]# cd /server/roles/
[root@master-61 /server/roles]# ansible-playbook main.yml 

PLAY [nfs] **************************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************************
ok: [172.16.1.31]

TASK [nfs_lsync-server : 01安装nfs-utils,rpcbind,lsyncd] ******************************************************************************************************
ok: [172.16.1.31] => (item=nfs-utils)
ok: [172.16.1.31] => (item=rpcbind)
ok: [172.16.1.31] => (item=lsyncd)

TASK [nfs_lsync-server : 02发送nfs-utils配置文件] *****************************************************************************************************************
ok: [172.16.1.31]

TASK [nfs_lsync-server : 03发送lsyncd密码文件] ********************************************************************************************************************
ok: [172.16.1.31]

TASK [nfs_lsync-server : 04发送lsyncd配置文件] ********************************************************************************************************************
ok: [172.16.1.31]

TASK [nfs_lsync-server : 05创建共享目录] **************************************************************************************************************************
ok: [172.16.1.31]

TASK [nfs_lsync-server : 06启动服务] ****************************************************************************************************************************
ok: [172.16.1.31] => (item=rpcbind)
changed: [172.16.1.31] => (item=nfs)
changed: [172.16.1.31] => (item=lsyncd)

PLAY [web] **************************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************************
ok: [172.16.1.9]
ok: [172.16.1.8]
ok: [172.16.1.7]

TASK [nfs-client : 01安装nfs-utils] ***************************************************************************************************************************
ok: [172.16.1.9]
ok: [172.16.1.7]
ok: [172.16.1.8]

TASK [nfs-client : 02挂载共享目录] ********************************************************************************************************************************
changed: [172.16.1.7]
changed: [172.16.1.8]
changed: [172.16.1.9]

PLAY [rsync] ************************************************************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************************************************
ok: [172.16.1.41]

PLAY RECAP **************************************************************************************************************************************************
172.16.1.31                : ok=7    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
172.16.1.41                : ok=1    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
172.16.1.7                 : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
172.16.1.8                 : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
172.16.1.9                 : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

2.Vault

• 加密指定文件，用于对主机清单，变量，重要的配置文件进行加密

2.1 案例：对密码文件rsync.passwd进行加密，并查看其中内容

[root@master-61 /server]# ansible-vault encrypt rsync.passwd 
New Vault password: 
Confirm New Vault password: 
Encryption successful
[root@master-61 /server]# cat rsync.passwd 
$ANSIBLE_VAULT;1.1;AES256
61316437616434656430373833643162313935636339333031616562353061373831333634393336
3538636436633862393833663034363366333733336130660a363531373564623738343531376432
37353231396539383533656463306566326631613864363132386631366539356538656436313936
6165333866663936660a323733393761626438316331373139663265333463663366333838373165
6537

2.2 对加密文件永久解密后进行查看

[root@master-61 /server]# ansible-vault decrypt rsync.passwd 
Vault password: 
Decryption successful
[root@master-61 /server]# cat rsync.passwd 
123456