Ansible中playbook的相关书写技巧

---

一、Ansible中的变量

变量命名：
只能包含数字，下划线，字母
只能用下划线或字母开头
变量级别：
全局: 从命令行或配置文件中设定的
paly: 在play和相关结构中设定的
主机: 由清单，事实收集或注册的任务

1.在playbook中直接定义变量

---
- name: test var
  hosts: all
  vars:
    USER: westosuser

2.在文件中定义变量

vim user_list.yml
---
user: westosuser

vim westos.yml
---
- name: Create User
  hosts: all
  vars_files:
    - ./user_list.yml

3.使用变量

tasks:
    - name: create user
      user:
        name: "{{ USER }}"

4.用命令覆盖变量

ansible-playbook user.yml -e "USER=hello"
举例：
[root@test2 ansible]# ansible-playbook -e "http_port=80" webserver.yml       %在命令行直接传参

二、JINJA2模板

1.介绍

Jinja2是Python下一个被广泛应用的模版引擎
他的设计思想来源于Django的模板引擎，
并扩展了其语法和一系列强大的功能。
其中最显著的一个是增加了沙箱执行功能和可选的自动转义功能

2.j2模板书写规则

举例如下：
[root@server1 ansible]# cat hostinfo.j2 
hostname: {{ ansible_facts['hostname'] }}
ip: {{ ansible_facts["eth0"]["ipv4"]["address"] }}
DNS: {{ ansible_facts['dns']['nameservers'][-1] }}
vda1: {{ ansible_facts['devices']['vda']['partitions']['vda1']['size'] }}
kernel: {{ ansible_facts['kernel'] }}

3.j2模板在playbook中的应用

举例如下：
[root@server1 ansible]# cat playbook.yml
---
- hosts: all
  tasks:
  - name: system info
    template:
      src: hostinfo.j2
      dest: /tmp/hostinfo

三、循环

举例如下：
[root@server1 ansible]# cat user.yml 
---
- hosts: test
  gather_facts: no
  tasks:
  - name: create users
    user:
      name: "{{ item.user }}"              %item指的是迭代变量名称
      password: "{{ item.passwd | password_hash('sha512') }}"
    loop:                                  %循环结构
      - { user: 'user1', passwd: '123' }   %字典的形式
      - { user: 'user2', passwd: '456' }
      - { user: 'user3', passwd: '789' }

四、交互式

举例如下：
[root@server1 apache]# cat task.yml 
---
- hosts: localhost
  vars:
    http_port: 80
  vars_prompt:
    - name: username
      prompt: What is your username?
      private: no
    - name: password
      prompt: What is your password?
  become: no
  gather_facts: false
  tasks:
  - name: check webserver 
    uri:
      url: "http://172.25.0.2:{{http_port}}"
      user: "{{ username }}"
      password: "{{ password }}"
      return_content: yes
      status_code: 200
    register: result
  
  - debug:
      var: result
[root@server1 apache]# cat webserver.yml 
---
- hosts: webserver
  vars:
    web_pkg: httpd
    web_svc: httpd
    http_port: 80
  tasks:
  - name: install apache
    dnf:
      name: "{{ web_pkg }}"
      state: present

  - name: copy htpasswd
    copy:
      src: htpasswd
      dest: /etc/httpd/conf/htpasswd
      mode: 0644
  
  - name: copy htaccess
    copy:
      src: htaccess
      dest: /var/www/html/.htaccess
      mode: 0644

  - name: configure apache
    template:
      src: httpd.conf.j2
      dest: /etc/httpd/conf/httpd.conf
    notify: restart apache

  - name: start apache
    service:
      name: "{{ web_svc }}"
      state: started
      enabled: yes

  - name: create index.html
    copy:
      content: "{{ ansible_hostname }}\n"
      dest: /var/www/html/index.html

  - name: start firewalld
    service:
      name: firewalld
      state: started
      enabled: yes

  - name: accept http
    firewalld:
      port: "{{ http_port }}/tcp"
      permanent: yes
      immediate: yes
      state: enabled

  handlers:
    - name: restart apache
      service:
        name: "{{ web_svc }}"
        state: restarted
 
- import_playbook: task.yml      %导入另一个playbook：task.yml   

在执行ansible-playbook webserver.yml时，结尾会出现交互式界面，提示输入用户名和密码

五、Apache的网页认证

设置如下：
[root@test1 conf]# cd /var/www/html/
[root@test1 html]# ls
index.html  myadmin
[root@test1 html]# vim .htaccess
[root@test1 html]# ls
index.html  myadmin
[root@test1 html]# l.
.  ..  .htaccess
[root@test1 html]# htpasswd -c /etc/httpd/conf/htpasswd lrl
New password: 
Re-type new password: 
Adding password for user lrl
[root@test1 html]# vim /etc/httpd/conf/httpd.conf   
[root@test1 html]# cat /etc/httpd/conf/htpasswd
lrl:$apr1$Mro6/0Af$2hn2DeGRCbBLUu64KOwu10
[root@test1 html]# vim /etc/httpd/conf/httpd.conf 
[root@test1 html]# systemctl restart httpd.service 
[root@test1 html]# cat .htaccess
AuthType Basic
AuthName "westos auth"
AuthUserFile /etc/httpd/conf/htpasswd
require valid-user

六、playbook中的加密

结合变量的方法对Playbook进行加密，防止在部署重要任务的时候泄漏重要信息：
[root@server1 ansible]# cat user.yml 
---
- hosts: test
  gather_facts: no
  vars_files:
    - userlist.yml
  tasks:
  - name: create users
    user:
      name: "{{ item.user }}"
      password: "{{ item.passwd | password_hash('sha512') }}"
    loop: "{{ userlist }}"

[root@server1 ansible]# cat userlist.yml 
---
userlist:
  - user: 'user1'
    passwd: '123'
  - user: 'user2'
    passwd: '456'
  - user: 'user3'
    passwd: '789'

ansible-vault encrypt userlist.yml   %对userlist.yml文件进行加密（执行完该指令后cat userlist.yml时看到的是加密后的内容）
ansible-playbook  user.yml --ask-vault-pass  %执行ansible-playbook  user.yml时询问密码
Vault password: