Ansible中的变量和加密

##1.变量命名##
只能包含数字,下划线,字母
只能用下划线或字母开头

##2.变量级别##
全局:
从命令行或配置文件中设定的
paly:
在play和相关结构中设定的
主机:
由清单,事实收集或注册的任务 

 示例：

全局变量：

play

主机: 

变量优先级设定:
狭窄范围有限与广域范围

#2.在文件中定义变量# 

#4.设定主机变量和清单变量#
#在定义主机变量和清单变量时使用 

主机变量：

清单变量：

#5.目录设定变量#
group_vars  ##清单变量,目录中的文件名称与主机清单名称一致

vim list.yml

  注意： 做此实验 vim inventory 删除之前清单中的变量

host_vars     ##主机变量,目录中的文件名称与主机名称一致 

vim list.yml   #6.用命令覆盖变量#
ansible-playbook user.yml -e "USER=hello"

#7.使用数组设定变量# 

create web vhost
www.westos.com 80   ------ > /var/www/html   ------> www.westos.com
linux.westos.com 80 ------> /var/www/virtual/westos.com/linux -----> linux.westos.com 

vim web_list.yml

vim web.yml

编写本地解析文件 注：在哪个主机的浏览器查看就在哪个主机上编辑解析文件

实验结果查看

 #8.注册变量#
#register 把模块输出注册到指定字符串中

实例： 检测受控主机/mnt/file1是否存在,如果存在register 把模块输出注册到out字符串.#9.事实变量#
事实变量是ansible在受控主机中自动检测出的变量
事实变量中还有与主机相关的信息
当需要使用主机相关信息时不需要采集赋值,直接调用即可gather_facts: no
##在playbook中关闭事实变量收集
因为变量信息为系统信息所以不能随意设定仅为采集信息,故被成为事实变量 

gather_facts: no ##在playbook中关闭事实变量收集

[devops@ansible .ansible]$ ansible westos -m setup | less

#10.魔法便变量#

hostvars	##ansible软件的内部信息 #eg:ansible localhost -m debug -m "var=hostvars"
group_names	##当前受管主机所在组 #eg:ansible localhost -m debug -m       "var=group_names"
groups	##列出清单中所有的组和主机 #eg:ansible localhost -m debug -m "var=groups"
inventory_hostname	##包含清单中配置的当前授管主机的名称 #eg:ansible localhost -m debug -m "var=inventory_hostname"

[devops@westoslinux .ansible]$ ansible localhost -m debug -a 'var=hostvars'
ansible软件的内部信息

[devops@westoslinux .ansible]$ ansible westos -m debug -a 'var=group_names' 当前受控主机所在的组
172.25.254.198 | SUCCESS => {
    "group_names": [
        "westos"
    ]
}

[devops@westoslinux .ansible]$ ansible westos -m debug -a 'var=groups' 列出清单中的所有组和主机
172.25.254.198 | SUCCESS => {
    "groups": {
        "all": [
            "172.25.254.198",
            "172.25.254.213"
        ],
        "ungrouped": [],
        "westos": [
            "172.25.254.198"
        ],
        "westos1": [
            "172.25.254.213"
        ]
    }
}

[devops@westoslinux .ansible]$ ansible westos -m debug -a  'var=inventory_hostname'
172.25.254.198 | SUCCESS => {
    "inventory_hostname": "172.25.254.198"
}

[devops@westoslinux .ansible]$ ansible all -m debug -a  'var=inventory_hostname'包含清单中配置的当前授管主机的名称
172.25.254.213 | SUCCESS => {
    "inventory_hostname": "172.25.254.213"
}
172.25.254.198 | SUCCESS => {
    "inventory_hostname": "172.25.254.198"
}

##j2模板书写规则#
{# /etc/hosts line #}   ##注释说明文件用途
127.0.0.1  localhost  ##文件内容
{{ ansible_facts['all_ipv4_addresses'] }}             {{ansible_facts['fqdn']}} ##使用事实变量
#for循环#
vim users.yml
users:
    - westos
    - linux
    - ansible
vim test.j2
{% for NAME in users %}
{{ NAME }}
{%endfor%}

实例1：利用for循环生成受控主机解析文件到/mnt/hosts

[devops@westoslinux .ansible]$ cp /etc/hosts hosts.j2
[devops@westoslinux .ansible]$ vim hosts.j2
[devops@westoslinux .ansible]$ cat hosts.j2
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
{% for HOST in groups['all'] %}
{{HOST}} {{hostvars[HOST]['ansible_facts']['fqdn']}}
{% endfor %}
[devops@westoslinux .ansible]$ vim hosts.yml
[devops@westoslinux .ansible]$ cat hosts.yml
- name: test
  hosts: all
  tasks:
    - name: test j2
      template:
        src: ./hosts.j2
        dest: /mnt/hosts
[devops@westoslinux .ansible]$ cat inventory
[westos]
172.25.254.198

[westos1]
172.25.254.213

[devops@westoslinux .ansible]$ ansible-playbook hosts.yml

PLAY [test] *********************************************************************************************

TASK [Gathering Facts] **********************************************************************************
ok: [172.25.254.198]
ok: [172.25.254.213]

TASK [test j2] ******************************************************************************************
changed: [172.25.254.198]
changed: [172.25.254.213]

PLAY RECAP **********************************************************************************************
172.25.254.198             : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
172.25.254.213             : ok=2    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0 

[devops@westoslinux .ansible]$ ansible all -m shell -a 'cat /mnt/hosts'
172.25.254.198 | CHANGED | rc=0 >>
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.198 qwe.westos.org
172.25.254.213 westoslinux.westos.or

实例2：


loop.index   ##循环迭代记数从1开始
loop.index0 ##循环迭代计数从0开始


#if 判定#
{% for NAME in users if not NAME == "ansible" %}
User number {{loop.index}} - {{ NAME }}
{%endfor%}

{% for user in students %}
name: {{user['name']}}
{%if user['age'] is defined%}
age: {{user['age']}}
{%endif%}
{% if user['age'] is not defined %}
age: null
{% endif%}
obj: {{user['obj']}}
{%endfor%}

test:

create web vhost
www.westos.com 80   ------ > /var/www/html   ------> www.westos.com
linux.westos.com 80 ------> /var/www/virtual/westos.com/linux -----> linux.westos.com 

news.westos.com 80 ------>  /var/www/virtual/westos.com/news ------> news.westos.com

[devops@westoslinux .ansible]$ vim vhosts.yml
[devops@westoslinux .ansible]$ cat vhosts.yml
webs:
  - name: linux.westos.com
    doc: /var/www/html/virtual/westos.com/linux
    index: linux.westos.com

  - name: news.westos.com
    doc: /var/www/html/virtual/westos.com/news
    index: news.westos.com

  - doc: /var/www/html
    index: www.westos.com

[devops@westoslinux .ansible]$ vim vhosts.conf.j2
[devops@westoslinux .ansible]$ cat vhosts.conf.j2
{% for web in webs %}
{% if web.name is not defined %}
<VirtualHost _default_:80>
{% endif %}
{% if web.name is defined %}
<VirtualHost *:80>
{% endif %}
{% if web.name is defined %}
  ServerName {{web.name}}
{% endif %}
  DocumentRoot {{web.doc}}
</VirtualHost>

{% endfor %}

[devops@westoslinux .ansible]$ vim web.yml
[devops@westoslinux .ansible]$ cat web.yml
- name: visit httpd
  hosts: westos
  vars_files: ./vhosts.yml
  tasks:
    - name: install httpd
      dnf: 
        name: httpd
        state: present
    - name: firewalld httpd
      firewalld:
        service: http
        permanent: yes
        state: enabled
        immediate: yes
    - name: start httpd
      service:
        name: httpd
        state: restarted
        enabled: yes
    - name: create DocumentRoot
      file:
        path: "{{item.doc}}"
        state: directory
      loop:
        "{{webs}}"
    - name: check file
      file:
        path: /etc/httpd/conf.d/vhosts.conf
        state: absent
    - name: configure vhost
      template:
        src: ./vhosts.conf.j2
        dest: /etc/httpd/conf.d/vhosts.conf
    - name: configure index.html
      copy:
        dest: "{{item.doc}}/index.html"
        content: "{{item.index}}"
      loop:
        "{{webs}}"

[devops@westoslinux .ansible]$ ansible-playbook web.yml

PLAY [visit httpd] *******************************************************************

TASK [Gathering Facts] ***************************************************************
ok: [172.25.254.198]

TASK [install httpd] *****************************************************************
ok: [172.25.254.198]

TASK [firewalld httpd] ***************************************************************
ok: [172.25.254.198]

TASK [start httpd] *******************************************************************
changed: [172.25.254.198]

TASK [create DocumentRoot] ***********************************************************
ok: [172.25.254.198] => (item={'name': 'linux.westos.com', 'doc': '/var/www/html/virtual/westos.com/linux', 'index': 'linux.westos.com'})
changed: [172.25.254.198] => (item={'name': 'news.westos.com', 'doc': '/var/www/html/virtual/westos.com/news', 'index': 'news.westos.com'})
ok: [172.25.254.198] => (item={'doc': '/var/www/html', 'index': 'www.westos.com'})

TASK [check file] ********************************************************************
changed: [172.25.254.198]

TASK [configure vhost] ***************************************************************
changed: [172.25.254.198]

TASK [configure index.html] **********************************************************
changed: [172.25.254.198] => (item={'name': 'linux.westos.com', 'doc': '/var/www/html/virtual/westos.com/linux', 'index': 'linux.westos.com'})
changed: [172.25.254.198] => (item={'name': 'news.westos.com', 'doc': '/var/www/html/virtual/westos.com/news', 'index': 'news.westos.com'})
ok: [172.25.254.198] => (item={'doc': '/var/www/html', 'index': 'www.westos.com'})

PLAY RECAP ***************************************************************************
172.25.254.198             : ok=8    changed=5    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

 

 

## Ansible的加密控制 ##

[devops@westoslinux .ansible]$ ansible-vault encrypt westos1.yml 加密现有文件
New Vault password: 
Confirm New Vault password: 
Encryption successful

[devops@westoslinux .ansible]$ cat westos1.yml
$ANSIBLE_VAULT;1.1;AES256
64393361656535346634306663343636376361623966323131363534306262653934616566306339
3639323837363561363736373661383930303833326533340a333263336537366561333137646632
63333163373037396561393163393731623834393934303465363635303865376239363461643135
3263633234363530660a366365313762396165346535326334623662666263373833613064616261
39666136353662323633393539663666333063326534343235366439386539306338383630663235
36373662656365666463663862323261376338316163396536356365396464303661633136303536
30323961623038356664663466333865666565303737646166666131616334333131306130623263
65353861366666656134376635376238356135386432306664646364326139623262323631633137
36613135653335613330353765366265373263376466323230336365333438613338653631326637
62353165326639306462333336383865376632366264363033393265383464363532373866646462
623738633861326134376262393761346537

[devops@westoslinux .ansible]$ ansible-vault view westos1.yml  查看加密文件
Vault password: 
- name: test play 
  hosts: westos
  tasks:
    - name: create file
      copy:
        dest: /mnt/hello
        content: hello westos

[devops@westoslinux .ansible]$ ansible-vault edit westos1.yml  编辑加密文件
Vault password:

[devops@westoslinux .ansible]$ ansible-vault create westos2.yml重新创建加密文件并进行编辑
New Vault password: 
Confirm New Vault password: 
[devops@westoslinux .ansible]$ vim pass
[devops@westoslinux .ansible]$ cat pass
westos2
[devops@westoslinux .ansible]$ ansible-vault view westos2.yml --vault-password-file=pass
查看加密文件
- name:
  hosts:
  tasks:
 
[devops@westoslinux .ansible]$ ansible-vault rekey westos2.yml 更改加密文件
Vault password: 
New Vault password: 
Confirm New Vault password: 
Rekey successful

[devops@westoslinux .ansible]$ ansible-vault rekey westos2.yml --vault-password-file=pass
New Vault password:  qwe
Confirm New Vault password: qwe
Rekey successful
[devops@westoslinux .ansible]$ cat pass
westos 虽然上边用密码文件的方法修改成功了密码,但此处密码仍旧没变 注意:更改密码时两种方法只能任选一种进行更改.

[devops@westoslinux .ansible]$ vim pass 解密文件时密码应设置与上次更改密码一致
[devops@westoslinux .ansible]$ ansible-vault decrypt westos2.yml --vault-password-file=pass
Decryption successful
[devops@westoslinux .ansible]$ cat pass
qwe