ansible安装与配置

自定义环境

角色 主机名 ip地址 组名

控制主机 server.example.com 192.168.157.100 server

受控主机1 node1.example.com 192.168.157.134 node1

受控主机2 node2.example.com 192.168.157.135 node2

多台主机配置主机名并且确保多台主机能够通过主机名互访

vim /etc/hosts //控制主机配置本地DNS

hostnamectl set-hostname server.example.com //改名

hostnamectl set-hostname node1.example.com

安装ansible

1、删除多余的（yum配置）源文件

[dm@server ~]$ cd /etc/yum.repos.d/

[dm@server yum.repos.d]$ ll

-rw-r--r--. 1 root root 136 Dec 30 16:50 redhat.repo //仅保留此文件

2、配置centos8基础源

vim /etc/yum.repos.d/base.repo

[AppStream]

name=AppStream

baseurl=https://mirrors.aliyun.com/centos/8-stream/AppStream/x86_64/os/

gpgcheck=0

[BaseOS]

name=AppStream

baseurl=https://mirrors.aliyun.com/centos/8-stream/BaseOS/x86_64/os/

gpgcheck=0

3、配置epel

yum install -y https://mirrors.aliyun.com/epel/epel-release-latest-8.noarch.rpm

[dm@server yum.repos.d]$ ll

total 28

-rw-r--r--. 1 root root 112 Dec 30 16:49 base.repo

-rw-r--r--. 1 root root 214 Dec 30 17:04 Centos-stream.repo

-rw-r--r--. 1 root root 1692 Dec 30 17:03 epel-modular.repo

-rw-r--r--. 1 root root 1326 Dec 30 17:03 epel.repo

-rw-r--r--. 1 root root 1791 Dec 30 17:03 epel-testing-modular.repo

-rw-r--r--. 1 root root 1425 Dec 30 17:03 epel-testing.repo

-rw-r--r--. 1 root root 136 Dec 30 16:50 redhat.repo

sed -i 's|^#baseurl=https://download.example/pub|baseurl=https://mirrors.aliyun.com|' /etc/yum.repos.d/epel*

sed -i 's|^metalink|#metalink|' /etc/yum.repos.d/epel*

yum install ansible -y

ansible --version

[dm@server /]$ ansible --version

ansible [core 2.13.5]

config file = /etc/ansible/ansible.cfg

configured module search path = ['/home/zx/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']

ansible python module location = /usr/lib/python3.9/site-packages/ansible

ansible collection location = /home/zx/.ansible/collections:/usr/share/ansible/collections

executable location = /usr/bin/ansible

python version = 3.9.14 (main, Dec 5 2022, 13:41:22) [GCC 8.5.0 20210514 (Red Hat 8.5.0-17)]

jinja version = 3.1.2

libyaml = True

案例一：控制主机和受控主机通过root用户通过免密验证方式远程控住受控主机实施对应任务

root下免密登陆

[root@server ~]# ssh-keygen -t RSA

# ssh-copy-id -i node1 //发送密钥

# ssh-copy-id -i node2

验证：

[root@server /]# ssh node1

Activate the web console with: systemctl enable --now cockpit.socket

This system is not registered to Red Hat Insights. See https://cloud.redhat.com/

To register this system, run: insights-client --register

Last login: Fri Dec 30 17:41:23 2022

[root@node1 ~]#

[root@server /]# ssh node1 hostname

node1.example.com

案例二：控制主机连接受控主机通过普通用户以免密验证远程控住受控主机实施特权指定操作。

普通用户的免密登陆实现

[dm@server ~]$ ssh-keygen -t RSA

$ ssh-copy-id -i node1

$ ssh-copy-id -i node2

验证：

[dm@server /]$ ssh node1

Activate the web console with: systemctl enable --now cockpit.socket

This system is not registered to Red Hat Insights. See https://cloud.redhat.com/

To register this system, run: insights-client --register

Last login: Fri Dec 30 18:51:37 2022 from 192.168.157.100

[dm@node1 ~]$

[dm@server /]$ ssh node1 hostname

node1.example.com

实现特权指定操作：

[dm@server /]$ ssh node1 sudo useradd user1

此时会报错，因为受控主机中没有该普通用户的权限

修改权限：

[root@node1 zx]# vim /etc/sudoers

## Allow root to run any commands anywhere

root ALL=(ALL) ALL

dm ALL=(ALL) NOPASSWD: ALL //添加部分

## Allows members of the 'sys' group to run networking, software,

## service management apps and more.

# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands

%wheel ALL=(ALL) ALL

[dm@server /]$ ssh node1 sudo useradd user1

[dm@server /]

[root@node1 zx]# id user1

uid=1001(user1) gid=1001(user1) groups=1001(user1)