本文介绍了Ansible的基本概念和架构，详细讲解了如何在管理节点上安装和配置Ansible，包括关闭防火墙、安装epel源和ansible服务、配置主机清单以及密钥对验证。此外，还详细探讨了Ansible的command、cron、user等模块的使用方法，通过实例展示了如何执行命令、创建计划任务和管理用户。
ansible简介
1.Ansible可以同时管理Redhat系的Linux，Debian系的Linux，以及Windows主机。管理节点只在执行脚本时与远程主机连接，没有特别的同步机制，所以断电等异常一般不会影响ansbile。
2.ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
(1)、连接插件connection plugins：负责和被监控端实现通信；
(2)、host inventory：指定操作的主机，是一个配置文件里面定义监控的主机；
(3)、各种模块核心模块、command模块、自定义模块；
(4)、借助于插件完成记录日志邮件等功能；
(5)、playbook：剧本执行多个任务时，非必需可以让节点一次性运行多个任务。
3.ansible的架构：连接其他主机默认使用ssh协议
ansible安装
ansible环境安装部署
管理端：192.168.35.100
被管理端：192.168.35.101
被管理端：192.168.35.102
所有管理端关闭防火墙
[root@localhost ~]# systemctl stop firewalld.service
[root@localhost ~]# setenforce 0
安装epel源
[root@localhost ~]# yum install -y epel-release
安装ansible服务
[root@localhost ~]# yum install ansible -y
查看ansible版本
[root@localhost ~]# ansible --version
ansible 2.9.2
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Aug 4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
树状结构展示文件夹
[root@localhost ~]# yum install tree -y //安装tree服务
[root@localhost ~]# tree /etc/ansible/
/etc/ansible/
├── ansible.cfg #ansible的配置文件
├── hosts #ansible的主仓库，用于存储需要管理的远程主机的相关信息
└── roles1 directory, 2 files
配置主机清单
[root@localhost ~]# vim /etc/ansible/hosts
#在25~28行添加
[webserver]
192.168.35.101
[mysql]
192.168.35.102
配置密钥对验证
[root@localhost ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): #回车
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): #输入密码abc123
Enter same passphrase again: #再次输入密码abc123
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:45OoRKsFf6MuqeGFWfRdORMW+kVjkCpeULT7fhXgvuQ root@localhost.localdomain
The key's randomart image is:
+---[RSA 2048]----+
| oo =++ |
| . +.=.. |
| . .o.=... |
| . ...o+ +. . |
| ..o.ooS.. . |
| ++ o o.o o . |
|.o o= + +.o o |
|..++ + ... E |
|.o.o+ .. |
+----[SHA256]-----+
秘钥对传送
[root@localhost ~]# ssh-copy-id root@192.168.35.101
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.35.101 (192.168.35.101)' can't be established.
ECDSA key fingerprint is SHA256:JsLSnAul/dncM/HPvpJWWB09dHLzpIfArHv1fWjQyA8.
ECDSA key fingerprint is MD5:d1:b7:d7:74:c6:4a:2a:7b:fc:33:8c:9c:3a:f2:6e:8a.
Are you sure you want to continue connecting (yes/no)? yes #输入yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.35.101's password: # 输入要访问主机密码123123Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.35.101'"
and check to make sure that only the key(s) you wanted were added.[root@localhost ~]# ssh-copy-id root@192.168.35.102
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.35.102 (192.168.35.102)' can't be established.
ECDSA key fingerprint is SHA256:JsLSnAul/dncM/HPvpJWWB09dHLzpIfArHv1fWjQyA8.
ECDSA key fingerprint is MD5:d1:b7:d7:74:c6:4a:2a:7b:fc:33:8c:9c:3a:f2:6e:8a.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.35.102's password:Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.35.102'"
and check to make sure that only the key(s) you wanted were added.
模块管理
1、command模块
命令格式：ansible [主机] [-m 模块] [-a args]
ansible-doc -l //列出所有已安装的模块 注：按q退出
ansible-doc -s yum //-s列出yum模块描述信息和操作动作
查看对方系统时间
//指定分类执行date
[root@localhost ~]# ansible webserver -m command -a 'date'
Enter passphrase for key '/root/.ssh/id_rsa': #输入密码abc123
192.168.35.101 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 11:58:25 CST[root@localhost ~]# ssh-agent bash #免交互代理
[root@localhost ~]# ssh-add
Enter passphrase for /root/.ssh/id_rsa: #输入密码abc123
Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)
[root@localhost ~]# ansible webserver -m command -a 'date' #在进行验证，直接就会查看，无需输入密码
192.168.35.101 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:00:10 CST[root@localhost ~]# ansible mysql -m command -a 'date' //免交互
192.168.35.102 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:50:33 CST或者：
指定ip执行date
[root@localhost ~]# ansible 192.168.35.101 -m command -a 'date'
Enter passphrase for key '/root/.ssh/id_rsa':
192.168.35.101 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:46:00 CST[root@localhost ~]# ansible 192.168.35.102 -m command -a 'date'
Enter passphrase for key '/root/.ssh/id_rsa':
192.168.35.102 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:46:10 CST
所有hosts主机执行date命令
[root@localhost ~]# ansible all -m command -a 'date'
192.168.35.102 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:53:39 CST192.168.35.101 | CHANGED | rc=0 >>
2020年 01月 26日 星期日 12:53:39 CST
如果不加-m模块，则默认运行command模块
[root@localhost ~]# ansible all -a 'ls /'
192.168.35.102 | CHANGED | rc=0 >>
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var192.168.35.101 | CHANGED | rc=0 >>
bin
boot
dev
etc
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
2、cron模块
两种状态（state）：present表示添加（可以省略），absent表示移除。
查看cron模块信息
[root@localhost ~]# ansible-doc -s cron
创建计划性任务并查看
[root@localhost ~]# ansible webserver -m cron -a 'minute="*/1" job="/bin/echo heihei" name="test cron job"'
192.168.35.101 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"envs": [],
"jobs": [
"test cron job"
]
}
[root@localhost ~]# ansible webserver -a 'crontab -l'
192.168.35.101 | CHANGED | rc=0 >>
#Ansible: test cron job
*/1 * * * * /bin/echo heihei
移除计划任务，假如该计划任务没有取名字，name=None即可
[root@localhost ~]# ansible webserver -m cron -a 'name="test cron job" state=absent'
192.168.35.101 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"envs": [],
"jobs": []
}
[root@localhost ~]# ansible webserver -a 'crontab -l'192.168.35.101 | CHANGED | rc=0 >>
3、user模块
user模块是请求的是useradd, userdel, usermod三个指令
查看user模块信息
[root@localhost ~]# ansible-doc -s user
创建用户test01
[root@localhost ~]# ansible mysql -m user -a 'name="test01"'
192.168.35.102 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"comment": "",
"create_home": true,
"group": 1001,
"home": "/home/test01",
"name": "test01",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 1001
}
[root@localhost ~]# ansible mysql -m command -a 'tail /etc/passwd'
192.168.35.102 | CHANGED | rc=0 >>
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
shan:x:1000:1000:shan:/home/shan:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
test01:x:1001:1001::/home/test01:/bin/bash
删除用户test01
[root@localhost ~]# ansible mysql -m user -a 'name="test01" state=absent'
192.168.35.102 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"force": false,
"name": "test01",
"remove": false,
"state": "absent"
}
[root@localhost ~]# ansible mysql -m command -a 'tail /etc/passwd'
192.168.35.102 | CHANGED | rc=0 >>
setroubleshoot:x:993:988::/var/lib/setroubleshoot:/sbin/nologin
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
shan:x:1000:1000:shan:/home/shan:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
4、group模块
group模块请求的是groupadd, groupdel, groupmod 三个指令。
查看group模块信息
[root@localhost ~]# ansible-doc -s group
创建组
[root@localhost ~]# ansible mysql -m group -a 'name=mysql gid=306 system=yes'
192.168.35.102 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
[root@localhost ~]# ansible mysql -a 'tail /etc/group'
192.168.35.102 | CHANGED | rc=0 >>
slocate:x:21:
postdrop:x:90:
postfix:x:89:
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
tcpdump:x:72:
shan:x:1000:
apache:x:48:
mysql:x:306:
创建用户添加到组里面
[root@localhost ~]# ansible mysql -m user -a 'name=test01 uid=306 system=yes group=mysql'
192.168.35.102 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"comment": "",
"create_home": true,
"group": 306,
"home": "/home/test01",
"name": "test01",
"shell": "/bin/bash",
"state": "present",
"system": true,
"uid": 306
}
[root@localhost ~]# ansible mysql -a 'tail /etc/passwd'
192.168.35.102 | CHANGED | rc=0 >>
sssd:x:992:987:User for sssd:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
gnome-initial-setup:x:991:986::/run/gnome-initial-setup/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
shan:x:1000:1000:shan:/home/shan:/bin/bash
apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
test01:x:306:306::/home/test01:/bin/bash[root@localhost ~]# ansible mysql -a 'id test01'
192.168.35.102 | CHANGED | rc=0 >>
uid=306(test01) gid=306(mysql) 组=306(mysql)
5、copy模块
查看copy模块信息
[root@localhost ~]# ansible-doc -s copy
复制文件
src：源
dest：目标
owner：属主
mode：权限
[root@localhost ~]# ansible mysql -m copy -a 'src=/etc/fstab dest=/opt/fstab.back owner=root mode=640'
192.168.35.102 | CHANGED => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": true,
"checksum": "779a5cdfc49a154200e8d8f1383714711cbbdf3e",
"dest": "/opt/fstab.back",
"gid": 0,
"group": "root",
"md5sum": "c850cea297d9fb76af5351854f120776",
"mode": "0640",
"owner": "root",
"secontext": "system_u:object_r:usr_t:s0",
"size": 541,
"src": "/root/.ansible/tmp/ansible-tmp-1580017743.15-32004883742223/source",
"state": "file",
"uid": 0
}[root@localhost ~]# ansible mysql -a 'ls -l /opt' #查看
192.168.35.102 | CHANGED | rc=0 >>
总用量 16
-rw-r-----. 1 root root 541 1月 26 13:49 fstab.back
-rw-r--r--. 1 root root 11798 10月 8 10:33 httpd.txt
drwxr-xr-x. 2 root root 6 3月 26 2015 rh[root@localhost ~]# ansible mysql -a 'cat /opt/fstab.back' #查看
192.168.35.102 | CHANGED | rc=0 >>
#
# /etc/fstab
# Created by anaconda on Tue Oct 8 16:42:28 2019
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
最低0.47元/天 解锁文章
扫一扫
644
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
