Ansible

最新推荐文章于 2023-02-26 15:59:15 发布

Ableson_liujun

最新推荐文章于 2023-02-26 15:59:15 发布

阅读量210

点赞数

分类专栏：第二阶段架构

本文链接：https://blog.csdn.net/ljaixiaoxue/article/details/103612153

版权

第二阶段架构专栏收录该内容

21 篇文章 0 订阅

订阅专栏

配置文件查找优先级

ANSIBLE_CONFIG #全局
ansible.cfg #项目目录
.ansible.cfg
/etc/ansible/ansible.cfg

Ansible Inventory 主机清单
Ansible Ad-Hoc 模块 ansible-doc module_name
1.yum | yum_repository
2.copy
3.file
4.service|systemd
5.cron
6.mount
7.user
8.group
9.shell | command
10.firewalld | selinux

command shell

建议使用shell模块，因为command不支持管道技术

yum模块

内容	含义
name	软件包名称
state	具体动作 present absent latest
exclude	排除
enablerepo	通过哪个仓库安装
disablerepo	安装时不使用哪个仓库

2yum 安装软件

#示例一、安装当前最新的Apache软件，如果存在则不安装
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=httpd state=latest"

#示例二、安装当前最新的Apache软件，通过epel仓库安装
[root@manager ~]# ansible oldboy -m yum -a "name=httpd enablerepo=epel state=present"

#示例三、通过公网URL安装rpm软件
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=http://192.168.16.236/zabbix/4.0/rhel/7/x86_64/zabbix-agent-4.0.0-2.el7.x86_64.rpm state=present"

#示例五、更新所有的软件包，但排除和kernel相关的
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name='*' state=latest exclude="kernel*""   


#示例六、删除Apache软件
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=httpd state=absent"

copy模块

内容	含义
src	当前管理机的配置文件路径
content	要写入的内容
dest	目标文件的配置文件路径
owner	属主
group	属组
mode	权限
backup	备份（每个变更进行备份）

[root@manager ~/ansible-project1]# ansible oldboy -m copy -a 'src=./hosts dest=/tmp/ owner=root group=root mode=600 backup=yes'


管理httpd配置文件
[root@manager ~/ansible-project1]# ansible oldboy -m copy -a "src=./files/httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=0644 backup=yes"


systemd
	name：		服务名称
	state： 	started stopped restarted  reloaded
	enabled：   开机自启动  yes|no

	
1.启动httpd服务
[root@manager ~/ansible-project1]# ansible oldboy -m systemd -a "name=httpd state=started"

2.开机自启动
[root@manager ~/ansible-project1]# ansible oldboy -m systemd -a "name=httpd state=started enabled=yes"

file模块

path: /work					#在被控端哪个路径下创建目录 | 文件
state: directory  touch		# directory 目录  touch 文件``
owner: root
group: root
mode: '0755'
recurse: yes 递归授权

[root@manager ~/ansible-project1]# ansible oldboy -m file -a “path=/ansible_data state=directory owner=root group=root mode=0755”

group
    name: 		组名称
    state: 		present  absent
	gid：		组id
[root@manager ~/ansible-project1]# ansible oldboy -m group -a "name=test gid=8888 state=present"
[root@manager ~/ansible-project1]# ansible oldboy -m group -a "name=test state=absent"

user
	name:				指定用户名称
    uid: 				指定用户的uid
    group: 				指定用户的组名称  或 组 GID
	groups: 			指定用户的附加组（附加组需存在） append：yes 给一个用户追加附加组
	create_home			创建用户家目录/home/Username   默认yes | no 
	shell: 				指定登录用户的bash  /bin/bash  /sbin/nologin
	system:             指定系统用户
	password
    
1.创建一个dev用户，uid为9999    属于test主的组，附加组为admin，root组
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=dev uid=9999 group=test groups=adm,root shell=/bin/bash create_home=yes"

2.追加两个组给dev用户
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=dev groups=bin,daemon append=yes"

3.创建一个系统用户ops，没有家目录  不允许登录系统
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=ops system=yes shell=/sbin/nologin create_home=no"


4.创建一个普通用户，可登录  devops  123456
ansible all -i localhost, -m debug -a "msg={{ '123456' | password_hash('sha512', 'mysecretsalt') }}"
    "msg": "$6$mysecretsalt$ZB9R8AirQYAXhtfhOo2qdJz52FyNI6v3L6Uc3KNRP.arBKIYpcuEyQewT5qBAHoyQFwHkW6Z551Ql.cZ53GeY0"
	
[root@manager ~/ansible-project1]# ansible oldboy -m user -a 'name=devops password="$6$mysecretsalt$ZB9R8AirQYAXhtfhOo2qdJz52FyNI6v3L6Uc3KNRP.arBKIYpcuEyQewT5qBAHoyQFwHkW6Z551Ql.cZ53GeY0"'

mount挂载

	src：   源设备  （磁盘 | 光盘|  远程的共享的地址） src=172.16.1.31:/data
    path: 	挂载点
    fstype: 设备类型  nfs xfs ext4 iso9660 ....
    opts: 	挂载选项  defaults
    state: 
		absent  mounted 		永久
		present unmounted		临时

1.挂载172.16.1.31/data/blog  挂载至本地的/opt  
[root@manager ~/ansible-project1]# ansible oldboy -m mount -a "src=172.16.1.31:/data/blog path=/opt fstype=nfs opts=defaults state=mounted"

[root@manager ~/ansible-project1]# ansible oldboy -m mount -a "src=172.16.1.31:/data/blog path=/opt fstype=nfs opts=defaults state=unmounted"	
	



selinux
	[root@manager ~/ansible-project1]# ansible oldboy -m selinux -a "state=disabled"

firewalld
	zone: 				指定区域 默认public
    service: 			指定服务名称
	port:				指定端口
    state: 				启用或禁止
	masquerade: 		开机地址伪装 yes
	immediate:			临时生效 yes
	permanent: 			永久生效
	source: 			来源IP
    rich_rule: rule service name="ftp" audit limit value="1/m" accept

1.放行http服务
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public  service=http state=enabled immediate=yes permanent=yes"

2.放行tcp80端口
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public  port=80/tcp state=enabled immediate=yes permanent=yes"

3.将5555端口转发到 172.16.1.7 22  端口 开启masquerade地址伪装
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public rich_rule='rule family=ipv4 forward-port port=5555 protocol=tcp to-port=22 to-addr=172.16.1.7'  state=enabled immediate=yes"
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public masquerade=yes state=enabled immediate=yes"


4.配置基于来源IP  10.0.0.1主机 放行 22 端口
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public rich_rule='rule family=ipv4 source address=10.0.0.100/32 service name=ssh accept'  state=enabled immediate=yes"


cron
1.添加一个定时任务 （能不能执行跟cron模块没有关系）
[root@manager ~/ansible-project1]# ansible oldboy -m cron -a "name='Backup scripts' minute=00 hour=05 user=root job='/bin/bash /scripts/check_data.sh &>/dev/null'"

2.删除定时任务
[root@manager ~/ansible-project1]# ansible oldboy -m cron -a "name='Backup scripts' minute=00 hour=05 user=root job='/bin/bash /scripts/check_data.sh &>/dev/null' state=absent"
	
yum_repository
    name: 			仓库名称，并且是文件的名称
    description: 	描述--
    baseurl: 		仓库的地址|很重要  http:// https:// ftp:// file://
    enabled: 		是否启用该仓库yes
	gpgcheck: 		不对下载的软件包进行检查
[root@manager ~/ansible-project1]# ansible oldboy -m yum_repository -a 'name=rpmforge description="RPMforge YUM Repo" baseurl="https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/os/$basearch/" enabled=yes gpgcheck=no'

ansible-doc （user group mount）

1.使用ansible 的 ad-hoc  搭建  NFS  服务？  31
	1.安装nfs
		# ansible nfs -m yum -a "name=nfs-utils state=present"
	
	2.配置nfs
	[root@manager ~/ansible-project1]# cat exports.j2 
	/data/blog 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666) 
	/data/zh 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666)
	/data/ansible 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666)
	
	[root@manager ~/ansible-project1]# ansible nfs -m copy -a "src=./exports.j2 dest=/etc/exports owner=root group=root mode=0644 backup=yes"
	
	3.根据配置文件进行初始化操作   创建用户  创建目录 授权
	
	[root@manager ~/ansible-project1]# ansible nfs -m group -a "name=www gid=666 state=present"
	[root@manager ~/ansible-project1]# ansible nfs -m user -a "name=www uid=666 group=www  state=present"
	
	[root@manager ~/ansible-project1]# ansible nfs -m file -a "path=/data/ansible state=directory owner=www group=www mode=755 recurse=yes"
	
	3.启动nfs
	[root@manager ~/ansible-project1]# ansible nfs -m systemd -a "name=nfs state=restarted enabled=yes"
	
	
2.使用ansible 的 ad-hoc  实现  NFS  挂载？   7
	1.安装nfs-utils工具
		[root@manager ~/ansible-project1]# ansible web -m yum -a "name=nfs-utils state=present"
	
	2.使用mount挂载即可
		[root@manager ~/ansible-project1]# ansible web -m mount -a "src=172.16.1.31:/data/ansible path=/mnt fstype=nfs opts=defaults state=mounted"



[root@manager ~/ansible-project1]# cat nfs-server.yml 
- hosts: nfs
  tasks:
    - name: Installed NFS Server
      yum:
        name: nfs-utils
        state: present

    - name: Configure NFS Server
      copy:
        src: ./exports.j2
        dest: /etc/exports
        owner: root
        group: root
        mode: 0644

    - name: Create NFS Group
      group:
        name: www
        gid: 666
  
    - name: Create NFS User
      user: 
        name: www
        uid: 666
        group: 666

    - name: Create NFS Share directory
      file:
        path: /data/ansible
        state: directory
        owner: www
        group: www
        mode: 755

    - name: Restart NFS Server
      systemd: 
        name: nfs
        state: restarted	
			
		
[root@manager ~/ansible-project1]# cat nfs-client.yml 
- hosts: web
  tasks:
    - name: Mount NFS Server
      mount: 
        src: 172.16.1.31:/data/ansible 
        path: /mnt
        fstype: nfs
        opts: defaults 
        state: mounted

Ableson_liujun

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
Ansible

配置文件查找优先级ANSIBLE_CONFIG #全局ansible.cfg #项目目录.ansible.cfg/etc/ansible/ansible.cfgAnsible Inventory 主机清单Ansible Ad-Hoc 模块 ansible-doc module_name1.yum | yum_repository2.copy3.f...
复制链接

扫一扫

专栏目录