ansible管理windows集群

windows主机 客户端配置

升级PowerShell版本到3.0以上，并且至少要在Windows主机上安装.NET 4.0，我这里windows系统中的PowerShell版本默认是5.1版本。

# 查看PowerShell版本
get-host

Windows Server开启winrm服务【这个服务 远程管理作用】

以下都在PowerShell中进行

# 1.查看powershell执行策略
get-executionpolicy

# 2.更改powershell执行策略为remotesigned【输入y确认】
set-executionpolicy remotesigned

# 3.配置winrm service并启动服务
winrm quickconfig

# 4.修改winrm配置，启用远程连接认证【这里是PowerShell的命令，如果用cmd的话，@前面的' 和 末尾的' 要去掉的】
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="true"}'

# 5.查看winrm service启动监听状态【如果有应答，说明服务配置并启动成功了】
winrm enumerate winrm/config/listener

设置防火墙入站规则，或者关闭防火墙(略)

Linux主机 ansible服务端配置

重点：千万不要用yum安装ansible。选择pip安装，或者二进制包安装。
否则，即便安装了pywinrm插件也无法管理Windows主机，yum安装的ansible无法调用pip安装的pywinrm插件！！！报错信息如下：
"msg": "winrm or requests is not installed: No module named winrm"

centos默认没有安装pip3，这里我们要先安装: pip3

安装pywinrm插件

 pip3 install pywinrm

pip下载ansible

pip3 install ansible

ln -s /usr/local/python3/bin/ansible /usr/bin/ansible

[root@NOC-Zabbix-Proxy ~]# ansible --version
ansible [core 2.11.4] 
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/python3/lib/python3.8/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.8.1 (default, Sep  7 2021, 17:20:45) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
  jinja version = 3.0.1
  libyaml = True

pip安装是没有config file文件的，需要我们手动创建

# 创建好文件后ansible会自动搜索,无需操作
mkdir /etc/ansible
touch /etc/ansible/ansible.cfg

[root@NOC-Zabbix-Proxy ~]# ansible --version
ansible [core 2.11.4] 
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/python3/lib/python3.8/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.8.1 (default, Sep  7 2021, 17:20:45) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
  jinja version = 3.0.1
  libyaml = True

创建ansible-doc工具

ln -s /usr/local/python3/bin/ansible-doc /usr/bin/ansible-doc

创建ansible-playbook工具

ln -s /usr/local/python3/bin/ansible-playbook /usr/bin/ansible-playbook

测试

管理员用户权限

# 配置文件默认路径：/etc/ansible/hosts
[root@NOC-Zabbix-Proxy ~]# vim /etc/ansible/hosts
[windows]
1.1.1.45

[windows:vars]
ansible_ssh_user='Administrator'
ansible_ssh_pass='Pass1234'
ansible_ssh_port=5985
ansible_connection='winrm'
ansible_winrm_server_cert_validation=ignore

非管理员用户权限

# 配置文件默认路径：/etc/ansible/hosts
[root@NOC-Zabbix-Proxy ~]# vim /etc/ansible/hosts
[windows]
1.1.1.45

[windows:vars]
ansible_ssh_user=vr_huangda@capitaland.com
ansible_ssh_pass=hd@889521
ansible_ssh_port=5985
ansible_connection=winrm
ansible_winrm_transport=ntlm

验证通不通，显示SUCCESS表示通了

[root@NOC-Zabbix-Proxy ~]# ansible windows -m win_ping 
1.1.1.45 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

windows模块官网

附：批量分发公钥脚本

ssh-keygen		# 生成公钥

# yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum -y install sshpass

vim a.sh
#!/bin/bash

while read line
do
ip=$(echo $line | awk -F: '{print $2}')

    echo "===============================start====================================="
    ssh-copy-id -i /root/.ssh/id_rsa.pub root@$ip "-o StrictHostKeyChecking=no" &>/dev/null
    if [ $? -eq 0 ];then
        echo "successful"
    else
        echo "fail"
    fi
done<b.txt

vim b.txt
Zabbix:1.1.1.170		# 主机名:ip