命令执行流程
Created with Raphaël 2.2.0
ansible命令执行
读取ansible.cfg配置文件
通过规则过滤invtentory中定义的主机列表
加载task对应模块文件
通过ansible core将模块或者命令打包成python脚本文件
将临时文件发送的目标主机
对应执行用户的夹目录中.ansible/tmp/xxx/xxx.py文件
给文件加执行权
执行py文件并返回结果
删除文件退出
实践
实验环境
主机 IP 作用 node1 192.168.27.11 控制机,安装有ansible 2.9.3 node2 192.168.27.12 被控制节点 node3 192.168.27.13 被控制节点
实践目标
Inventory实践
配置node2有node3主机管理清单 设置独立管理用户 使用ping模块进行测试
Ad-hoc实践
使用copy模块复制文件 使用command模块操作 使用yum模块安装、卸载httpd服务 使用shell模块检查软件安装 使用user模块床创建用户 使用service模块操作httpd服务开启关闭 使用setup模块收集节点主机信息 安装mariadb数据库,并开启服务,进行测试
实践过程
[ root@node1 ~]
[ root@node1 ~]
[ root@node2 ~]
[ root@node2 ~]
[ root@node3 ~]
[ root@node3 ~]
[ root@node1 ansible]
[ ans@node1 ~] $ mkdir ansible
[ ans@node1 ~] $ cd ansible/
[ ans@node1 ansible] $ vim ansible.cfg
[ defaults]
inventory= ./inventory
[ ans@node1 ansible] $ vim inventory
[ web]
node2
[ db]
node3
[ app:children]
web
db
[ ans@node1 ansible] $ ansible app --list-hosts
hosts ( 2) :
node2
node3
[ ans@node1 ansible] $ ansible web --list-hosts
hosts ( 1) :
node2
[ ans@node1 ansible] $ ansible db --list-hosts
hosts ( 1) :
node3
[ ans@node1 ansible] $ ansible app -m ping -u ans -k
SSH password:
node2 | SUCCESS = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : false,
"ping" : "pong"
}
node3 | SUCCESS = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : false,
"ping" : "pong"
}
[ ans@node1 ansible] $ ssh-keygen
[ ans@node1 ansible] $ ssh-copy-id ans@node2
[ ans@node1 ansible] $ ssh-copy-id ans@node3
[ ans@node1 ansible] $ ansible app -m ping
node2 | SUCCESS = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : false,
"ping" : "pong"
}
node3 | SUCCESS = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : false,
"ping" : "pong"
}
[ ans@node1 ansible] $ touch test.file
[ ans@node1 ansible] $ ansible app -m copy -a "src=/home/ans/ansible/test.file dest=/tmp/test.file"
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"checksum" : "e7509a8c032f3bc2a8df1df476f8ef03436185fa" ,
"dest" : "/tmp/test.file" ,
"gid" : 1000,
"group" : "ans" ,
"md5sum" : "d73b04b0e696b0945283defa3eee4538" ,
"mode" : "0664" ,
"owner" : "ans" ,
"size" : 11,
"src" : "/home/ans/.ansible/tmp/ansible-tmp-1583587416.74-58502808521992/source" ,
"state" : "file" ,
"uid" : 1000
}
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"checksum" : "e7509a8c032f3bc2a8df1df476f8ef03436185fa" ,
"dest" : "/tmp/test.file" ,
"gid" : 1000,
"group" : "ans" ,
"md5sum" : "d73b04b0e696b0945283defa3eee4538" ,
"mode" : "0664" ,
"owner" : "ans" ,
"size" : 11,
"src" : "/home/ans/.ansible/tmp/ansible-tmp-1583587416.73-216420757286424/source" ,
"state" : "file" ,
"uid" : 1000
}
[ ans@node1 ansible] $ ansible app -a "ls -l /tmp"
node3 | CHANGED | rc= 0 >>
total 4
drwx------ 2 ans ans 41 Mar 7 07:52 ansible_command_payload_utUHaX
-rw-rw-r-- 1 ans ans 11 Mar 7 07:51 test.file
node2 | CHANGED | rc= 0 >>
total 4
drwx------ 2 ans ans 41 Mar 7 07:52 ansible_command_payload_znrWdZ
-rw-rw-r-- 1 ans ans 11 Mar 7 07:51 test.file
[ ans@node1 ansible] $ ansible app -a "rm /tmp/test.file"
node3 | CHANGED | rc= 0 >>
node2 | CHANGED | rc= 0 >>
[ ans@node1 ansible] $ vim ansible.cfg
……
[ privilege_escalation]
become= True
become_method= sudo
become_user= root
become_ask_pass= False
[ root@node2 ~]
……
ans ALL= ( ALL) NOPASSWD: ALL
……
[ ans@node1 ansible] $ ansible app -m copy -a "src=/home/ans/ansible/test.file dest=/mnt/test.file"
node3 | FAILED! = > {
"msg" : "Missing sudo password"
}
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"checksum" : "e7509a8c032f3bc2a8df1df476f8ef03436185fa" ,
"dest" : "/mnt/test.file" ,
"gid" : 0,
"group" : "root" ,
"md5sum" : "d73b04b0e696b0945283defa3eee4538" ,
"mode" : "0644" ,
"owner" : "root" ,
"size" : 11,
"src" : "/home/ans/.ansible/tmp/ansible-tmp-1583590928.25-164215043325998/source" ,
"state" : "file" ,
"uid" : 0
}
[ ans@node1 ansible] $ ansible web -m yum -a "name=httpd state=present" -u root -k
SSH password:
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"changes" : {
"installed" : [
"httpd"
]
} ,
"msg" : "" ,
"rc" : 0,
"results" : [
"Loaded plugins: product-id, search-disabled-repos, subscription-manager\nThis system is not registered with an entitlement server. You can use subscription-manager to register.\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.4.6-80.el7 will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n httpd x86_64 2.4.6-80.el7 rhel7.5 1.2 M\n\nTransaction Summary\n================================================================================\nInstall 1 Package\n\nTotal download size: 1.2 M\nInstalled size: 3.7 M\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n Installing : httpd-2.4.6-80.el7.x86_64 1/1 \n Verifying : httpd-2.4.6-80.el7.x86_64 1/1 \n\nInstalled:\n httpd.x86_64 0:2.4.6-80.el7 \n\nComplete!\n"
]
}
[ ans@node1 ansible] $ ansible web -a "rpm -q httpd"
node2 | CHANGED | rc= 0 >>
httpd-2.4.6-80.el7.x86_64
[ ans@node1 ansible] $ ansible web -a "rpm -q httpd"
node2 | CHANGED | rc= 0 >>
httpd-2.4.6-80.el7.x86_64
[ ans@node1 ansible] $ ansible web -m yum -a "name=httpd state=absent" -u root -k
SSH password:
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"changes" : {
"removed" : [
"httpd"
]
} ,
"msg" : "" ,
"rc" : 0,
"results" : [
"Loaded plugins: product-id, search-disabled-repos, subscription-manager\nThis system is not registered with an entitlement server. You can use subscription-manager to register.\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.4.6-80.el7 will be erased\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nRemoving:\n httpd x86_64 2.4.6-80.el7 @rhel7.5 3.7 M\n\nTransaction Summary\n================================================================================\nRemove 1 Package\n\nInstalled size: 3.7 M\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n Erasing : httpd-2.4.6-80.el7.x86_64 1/1 \n Verifying : httpd-2.4.6-80.el7.x86_64 1/1 \n\nRemoved:\n httpd.x86_64 0:2.4.6-80.el7 \n\nComplete!\n"
]
}
[ ans@node1 ansible] $ ansible web -m service -a "name=httpd state=started" -u root -k
SSH password:
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"name" : "httpd" ,
"state" : "started" ,
……
[ ans@node1 ansible] $ ansible web -m service -a "name=httpd state=stopped" -u root -k
SSH password:
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"name" : "httpd" ,
"state" : "stopped" ,
……
[ ans@node1 ansible] $ ansible app -m user -a "name=test password=test" -u root -k
SSH password:
[ WARNING] : The input password appears not to have been hashed. The 'password' argument must be
encrypted for this module to work properly.
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"comment" : "" ,
"create_home" : true,
"group" : 1001,
"home" : "/home/********" ,
"name" : "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER" ,
"password" : "NOT_LOGGING_PASSWORD" ,
"shell" : "/bin/bash" ,
"state" : "present" ,
"system" : false,
"uid" : 1001
}
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"comment" : "" ,
"create_home" : true,
"group" : 1001,
"home" : "/home/********" ,
"name" : "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER" ,
"password" : "NOT_LOGGING_PASSWORD" ,
"shell" : "/bin/bash" ,
"state" : "present" ,
"system" : false,
"uid" : 1001
}
[ ans@node1 ansible] $ ansible app -m user -a "name=test state=absent remove=yes" -u root -k
SSH password:
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"force" : false,
"name" : "test" ,
"remove" : true,
"state" : "absent"
}
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"force" : false,
"name" : "test" ,
"remove" : true,
"state" : "absent"
}
[ ans@node1 ansible] $ ansible web -m user -a "name=test password={{'test'|password_hash('sha512')}}" -u root -k
SSH password:
node2 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"append" : false,
"changed" : true,
"comment" : "" ,
"group" : 1001,
"home" : "/home/test" ,
"move_home" : false,
"name" : "test" ,
"password" : "NOT_LOGGING_PASSWORD" ,
"shell" : "/bin/bash" ,
"state" : "present" ,
"uid" : 1001
}
[ ans@node1 ansible] $ ansible app -m setup| more
node2 | SUCCESS = > {
"ansible_facts" : {
"ansible_all_ipv4_addresses" : [
"192.168.27.12"
] ,
"ansible_all_ipv6_addresses" : [
"fe80::5054:ff:fee1:b9dd"
] ,
"ansible_apparmor" : {
"status" : "disabled"
} ,
"ansible_architecture" : "x86_64" ,
"ansible_bios_date" : "01/01/2011" ,
"ansible_bios_version" : "0.5.1" ,
"ansible_cmdline" : {
"BOOT_IMAGE" : "/vmlinuz-3.10.0-862.el7.x86_64" ,
"LANG" : "en_US.UTF-8" ,
"crashkernel" : "auto" ,
"quiet" : true,
"rd.lvm.lv" : "rhel/swap" ,
"rhgb" : true,
"ro" : true,
"root" : "/dev/mapper/rhel-root"
} ,
"ansible_date_time" : {
"date" : "2020-03-07" ,
"day" : "07" ,
"epoch" : "1583590562" ,
"hour" : "09" ,
"iso8601" : "2020-03-07T14:16:02Z" ,
"iso8601_basic" : "20200307T091602482191" ,
"iso8601_basic_short" : "20200307T091602" ,
"iso8601_micro" : "2020-03-07T14:16:02.482254Z" ,
"minute" : "16" ,
"month" : "03" ,
"second" : "02" ,
--More--
[ ans@node1 ansible] $ ansible db -m yum -a "name=mariadb-server state=present" -u root -k
SSH password:
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"changes" : {
"installed" : [
"mariadb-server"
……
[ ans@node1 ansible] $ ansible db -m yum -a "name=MySQL-python state=present" -u root -k
SSH password:
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"changes" : {
"installed" : [
"MySQL-python"
……
[ ans@node1 ansible] $ ansible db -m service -a "name=mariadb state=started" -u root -k
SSH password:
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"name" : "mariadb" ,
"state" : "started" ,
[ ans@node1 ansible] $ ansible db -m mysql_user -a "login_user=root name=ans password=ans priv=*.*:select host='%' state=present"
node3 | CHANGED = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : true,
"msg" : "User added" ,
"user" : "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER"
}
[ ans@node1 ansible] $ ansible db -m mysql_db -a "name=test state=present"
node3 | SUCCESS = > {
"ansible_facts" : {
"discovered_interpreter_python" : "/usr/bin/python"
} ,
"changed" : false,
"db" : "test" ,
"db_list" : [
"test"
]
}