RHCE个人笔记

1、安装ansible
题目：
node1是dev主机组的成员
node2是test主机组的成员
node3和node4是prod主机组的成员
node5是balancers主机组的成员
prod组是webservers主机组的成员
创建名为/home/greg/ansible/inventory的静态清单文件
创建名为/home/gerg/anisble/ansible.cfg的配置文件
使用的角色位置/home/greg/ansibe/roles
解答：
sudo yum install -y ansible
mkdir /home/greg/ansible
vim inventory
cat inventory
[dev]
node1
[test]
node2
[prod]
node3
node4
[balancers]
node5
[webservers:children]
prod
[all:vars]
ansible_user=root
ansible_password=flectrag
cp /etc/ansible/ansible.cfg .
mkdir roles
cat ansible.cfg
inventory = /home/greg/ansible/inventory
roles_path = /home/greg/ansible/roles
host_key_checking = false
remote_user = root
验证：
ansible --version
ansible-inventory --graph
2、创建和运行ansible临时命令
题目：创建shell脚本，在各个节点上安装yum存储源
存储库：EX294_BASE
描述：EX294 base software
基础url为http://content/rhel8.4/x86_64/dvd/BaseOS
GPG签名检查启动
GPG密钥url为http://content/rhel8.4/x86/dvd/RPM-GPG-KEY_redhat-release
存储库为启用
解答：
ansible-doc yum_repository查看模块
vim adhoc.sh
#!/bin/bash
ansible all -m yum_repository -a ‘name=“EX294_BASE” description=“EX294 base software” baseurl=“http://content/rhel8.4/x86_64/dvd/BaseOS” gpgcheck=yes enabled=yes gpgkey=“http://content/rhel8.4/x86_64/dvd/RPM-GPG-KEY-redhat-release”’

chmod +x adhoc.sh
./adhoc.sh
3、安装软件包
题目：
将php和mariadb软件包安装到dev、test、prod主机组中
将RPM Development Tools 软件包组安装到dev主机组中
将dev主机组中主机上的所有软件包更新为最新版本
解答：

• name: 3
  hosts: dev,test,prod

  tasks:

  • name: install php and mariadb
    yum:
    name: php,mariadb
    state: latest
  • name: install RPM Development Tools
    yum:
    name: “@RPM Development Tools”
    state: latest
    when: inventory_hostname in groups.dev
  • name: update all packages
    yum:
    name: ‘*’
    state: latest
    when: inventory_hostname in groups.dev

4、使用rhel系统角色
①题目：
在所有节点上运行，使用selinux角色，配置该角色，配置节点色selinux为enforcing
解答：
sudo yum install rhel-system-roles
vim ansible.cfg
roles_path= /home/greg/ansible/roles:/usr/share/ansible/roles
cp /usr/share/doc/rhel-system-roles/selinux/example-timesync-playbook.yml /home/student/ansible/timesync.yml
mv example-selunux-playbook.yml selinux.yml
ansible-playbook selinux.yml
②题目：
在所有节点上运行，使用timesync角色，配置该角色，以使用当前有效的ntp提供商，配置时间服务器172.25.254.254，配置启动iburst参数
解答：
sudo yum install rhel-system-roles -y
roles_path = /home/greg/ansible/roles:/usr/share/ansible/roles
cp /usr/share/doc/rhel-system-roles/timesync/example-timesync-playbook.yml timesync.yml

vim timesync.yml

• hosts: all
  vars:
  timesync_ntp_servers:
  - hostname: 172.25.250.254
  iburst: yes
  roles:

  • rhel-system-roles.timesync
    5、使用ansible galaxy安装角色
    题目：
    使用ansible galaxy 和要求文件/home/greg/ansible/roles/requirements.yml.
    从一下url下载角色并安装到/home/greg/ansible/roles:
    http://materials/haproxy.tar,此角色名称应当为balancer
    http://materials/phpinfo.tar,此角色的名称应当为phpinfo
    解答：
    cd roles/
    vim requirements.yml

• src: http://materials.example.com/cd/exam_rhce8/haproxy.tar
  name: balancer

• src: http://materials.example.com/cd/exam_rhce8/phpinfo.tar
  name: phpinfo

ansible-galaxy install -r /home/student/ansible/roles/requirements.yml -p /home/greg/ansible/roles
ansible-galaxy list | grep -E ‘balancer|phpinfo’
解释：
ansible-galaxy install
-r:安装文件
-p:安装位置
6、创建和使用角色
题目：创建名为apache的角色，httpd软件已安装，并为自启动，防火墙已启动，允许访问web服务，模板文件index.html.j2已存在，用于创建具有以下输出的文件/var/www/html/index.html
welcome to HOSTNAME on IPADDRESS
完全限定域名 节点ip
解答：
cd roles
ansible-galaxy init apahce创建角色
vim apache/tasks/main.yml
name: 1
yum:
name: httpd
state: latest
name: 2
service:
name: httpd
state: started
enabled: yes
name: 3
service:
name: firewalld
state: started
enabled: yes
name: 4
firewalld:
service: http
permanent: yes
state: enabled
immediate: yes
name: 5
template:
src: index.html.j2
dest: /var/www/html/index.html
vim apache/tmeplate/index.html.j2
welcome to {{ ansible_fqdn}} on {{ ansible_default_ipv4.address}}
vim apache.yml
name:
hosts: webservers
roles:
- apahce

7、ansible galaxy使用角色
vim roles.yml
name: 1
hosts: webservers
roles:
- phpinfo
name: 2
hosts: webservers
roles:
- apache
name: 3
hosts: balancers
roles:
- balancer

8、创建和使用分区
①创建分区
hosts: all
tasks:
- file:
path: /data
state: dircortory
- block:
parted:
device: /dev/vdb
number: 1
state: present
part_end: 1500MiB
systemfile:
fytype: ext4
dev: /dev/vdb1
mount:
path: /data
src: /dev/vdb1
fstype: ext4
state: mounted
- rescue:
debug:
msg: xxxxxxxxxxxxxxxxxxxxxxxxxx
parted:
device: /dev/vdb
number: 1
state: present
part_end: 800MiB
when: ansible_facts.devices.vdb is defined
filesystem:
fstype:ext4
dev: /dev/vdb1
when: ansible_facts.devices.vdb is defined
mount:
path: /data
src: /dev/vdb1
fstype: ext4
state: mounted
when: ansible_facts.devices.vdb is defined
debug:
msg: this disk not exist
when: ansible_facts.devices.vdb is undefined

②创建逻辑卷
tasks:
- block:
lvol:
vg: research
lv: data
size: 1500MiB
systemfile:
fstype: ext4
dev: /dev/research/data
rescue:
debug:
msg:xxxxxxxxxxxxxxx
lvol:
vg: research
lv: data
size: 800MiB
when: ansible_lvm.vgs.research is defined
filesystem:
fstpe: ext4
dev: /dev/research/data
when: ansible_lvm.vgs.research is defined
debug:
msg: volume group done not exist
when: ansible_lvm.vgs.research is undefined
ignore_errors: yes

9、生成主机文件（模块template）
wget -o /home/greg/anisble/hosts.j2 http://materials/hosts.j2
vim hosts.j2
{% for host in groups.all %}
{{ hostvars[host][“ansible_facts”][“default_ipv4”][“address”] }} {{ hostvars[host][“ansible_facts”][“fqdn”] }} { hostvars[host][“ansible_facts”][“hostname”] }}
{% endfor %}

• name: 9
  hosts: all
  tasks:
  • name: template
    template:
    src: hosts.j2
    dest: /etc/myhosts
    when: inventory_hostname in groups.dev

10、修改文件内容（模块copy）
tasks:
- name: dev
copy:
content: “Development”
dest: /etc/issue
when: inventory_hostname in groups.dev
- name: test
copy:
content: “Test”
dest: /etc/issue
when: inventory_hostname in groups.test
- name: prod
copy:
content: “Production”
dest: /etc/issue
when: inventory_hostname in groups.prod

11、创建web内容目录（模块file，copy）
tasks:
- name: create group webdev
group:
name: webdev
state: present
- name: create directory
file:
path: /webdev
group: webdev
state: directory
mode: ‘2775’
setype: httpd_sys_content_t
- name: install httpd
yum:
name: httpd
- name: config firewalld
firewalld:
service: http
permanent: yes
state: enabled
immediate: yes
- name: make link
file:
src: /webdev
dest: /var/www/html/webdev
state: link
- name: make index.html
copy:
content: “Development”
dest: /webdev/index.html
setype: httpd_sys_content_t
- name: start httpd service
service:
name: httpd
state: started
enabled: yes

12、生成硬件报告（linefile）
tasks:
- name: get url
get_url:
url: http://materials.example.com/cd/exam_rhce8/hwreport.empty
dest: /root/hwreport.txt
- name: HOSTNAME
lineinfile:
path: /root/hwreport.txt
regexp: ‘^HOSTNAME’
line: HOSTNAME=“{{ ansible_fqdn | default(‘NONE’,true)}}”
- name: MEMORY
lineinfile:
path: /root/hwreport.txt
regexp: ‘^MEMORY’
line: MEMORY=“{{ ansible_memtotal_mb | default(‘NONE’,true)}}”
- name: BIOS_VERSION
lineinfile:
path: /root/hwreport.txt
regexp: ‘^BIOS_VERSION’
line: BIOS_VERSION=“{{ ansible_bios_version | default(‘NONE’,true)}}”
- name: VDASIZE
lineinfile:
path: /root/hwreport.txt
regexp: ‘^VDASIZE’
line: VDASIZE=“{{ ansible_devices.vda.size | default(‘NONE’,true)}}”
- name: VDBSIZE
lineinfile:
path: /root/hwreport.txt
regexp: ‘^VDBSIZE’
line: VDBSIZE=“{{ ansible_devices.vdb.size | default(‘NONE’,true) }}”

13、创建密码库
echo xxxxx > secret.txt
vim ansible.cfg
vault_password_file = /home/greg/ansible/secret.txt
vim locker.yml
pw_developer: Imadev
pw_manager: Imamgr
ansible-vault encrypt locker,yml

14、创建用户账户
wget http://materials/user_list.yml
hosts: all
vars_files:
- /home/greg/ansible/locker.yml
- /home/greg/ansible/user_list.yml
tasks:
- name: create group devops
group:
name: devops
state: present
loop: “{{ users }}”
when: item.job == ‘developer’
- name: useradd groups devops
user:
name: “{{ item.name }}”
groups: devops
password: “{{ pw_developer | password_hash(‘sha512’) }}”
loop: “{{ users }}”
when: item.job == “developer”
- name: create group opsmgr
group:
name: opsmgr
state: present
loop: “{{ users }}”
when: item.job == ‘developer’
- name: useradd groups opsmgr
user:
name: “{{ item.name }}”
groups: opsmgr
password: “{{ pw_manager | password_hash(‘sha512’) }}”
loop: “{{ users }}”
when: item.job == “manager”

15、更新ansible库的密钥
wget http://materials/salaries.yml
ansible-vault rekey --ask-vault-pass salaries.yml
ansible-vault view salaries.yml
16、配置cron作业
tasks:
- name: user add bob
user:
name: bob
- name: crontab -u bob -e
cron:
name: “a job for bob”
minute: “/2"
hour: "”
day: “"
month: "”
weekday: “*”
user: bob
job: logger “EX200 in progress”