Ansible playbook剧本实战（1）

1.使用多play的playbook

# 以下所有的hosts指定的组名都是在/etc/ansible/hosts底下编写了对应的组并添加了对应的主机

# 或者是自己编写一个主机清单文件'inventory'没有后缀，运行剧本的时候，加上-i参数指定清单文件

vim intranet.yml

---
- name: Enable intranet services
  hosts: servera.lab.example.com
  # 提权
  become: true
  tasks:
    - name: dnf httpd
      ansible.builtin.dnf:
        name:
          - httpd
          - firewalld
        state: latest
        
    - name: touch test index.html
      ansible.builtin.copy:
        content: "Welcome to the example.com intranet!\n"
        dest: /var/www/html/index.html
        
    - name: start firewalld
      ansible.builtin.service:
        name: firewalld
        enabled: true
        state: started
        
	# 放行http服务，永久并立即生效
    - name: set firewalld
      ansible.posix.firewalld:
        service: http
        permanent: true
        state: enabled
        immediate: yes
        
    - name: start httpd
      ansible.builtin.service:
        name: httpd
        enabled: true
        state: started
        
- name: Test web server
  hosts: localhost
  become: false
  tasks:
    - name: connect to web server
      ansible.builtin.uri:
        url: http://servera.lab.example.com
        return_content: yes
        status_code: 200


# 检查剧本是否有误

ansible-navigator run -m stdout intranet.yml --syntax-check


# 运行剧本

ansible-navigator run -m stdout intranet.yml


# 访问测试

curl servera

2.ansible变量

vim data-variables.yml

---
- name: deploy web service
  hosts: webserver
  vars:
    web_pkg: httpd
    firewall_pkg: firewalld
    web_service: httpd
    firewall_service: firewalld
    python_pkg: python3-PyMySQL
    rule: http

  tasks:
    - name: Install packages
      ansible.builtin.dnf:
        name:
          - "{{ web_pkg }}"
          - "{{ firewall_pkg }}"
          - "{{ python_pkg }}"
        state: latest

    - name: start {{ firewall_service }}
      ansible.builtin.service:
        name: "{{ firewall_service }}"
        enabled: true
        state: started

    - name: start {{ web_service }}
      ansible.builtin.service:
        name: "{{ web_service }}"
        enabled: true
        state: started

    - name: web content
      ansible.builtin.copy:
        content: "Example web content!\n"
        dest: "/var/www/html/index.html"

    - name: set firewall {{ rule }}
      ansible.posix.firewalld:
        service: "{{ rule }}"
        permanent: true
        immediate: true
        state: enabled

- name: verify the Apache service
  hosts: workstation
  become: false
  tasks:
    - name: curl webserver
      ansible.builtin.uri:
        url: http://servera.lab.example.com
        status_code: 200


# 运行剧本

ansible-navigator run -m stdout data-variables.yml

3.创建secret管理敏感信息

# 创建secret加密文件，它只能加密存放用户密码的文件，而不是对里面的内容进行加密，里面的用户密码信息依旧是明文信息

# 创建加密文件，输入两次密码进入编辑模式，写入对应内容

ansible-vault create secret.yml


# 以上方式需要手动输入密码进行加密，也可以指定密码文本进行加密

echo "redhat" > user-pass

ansible-vault create --vault-password-file=user-pass secret.yml


# 输入加密文件密码，查看写入的内容

ansible-vault view secret.yml


# 更改密码，第一次输入的是旧密码，后面输入新密码确认

ansible-vault rekey secret.yml


# 修改内容

ansible-vault edit secret.yml


# 输入密码，将已有的账户密码文件进行加密

ansible-vault encrypt secret.yml


# 输入密码，将加密文件解密并输出到文件中

ansible-vault decrypt secret.yml --output=secret1.yml  


# 运行带加密文件的playbook剧本，必须加上'--vault-id @prompt'提示输入密码，和'--playbook-artifact-enable false'关闭artifact功能，不然就会报错

ansible-navigator run -m stdout --playbook-artifact-enable false site.yml --vault-id @prompt

# 查看加密文件内容

ansible-vault view secret.yml


# 编写创建带加密用户密码文件的playbook剧本测试

vim create_users.yml

---
- name: create user
  hosts: devservers
  become: true
  remote_user: devops
  vars_files:
    - secret.yml
  tasks:
    - name: create user from secret.yml
      ansible.builtin.user:
      # 变量的值要跟加密文件中保持一致
        name: "{{ username }}"
        password: "{{ pwhash }}"


# 运行剧本，需要输入加密文件密码

ansible-navigator run -m stdout \
--playbook-artifact-enable false create_users.yml \
--syntax-check --vault-id @prompt


# 用ansible-playbook也可以运行

ansible-playbook create_users.yml --vault-id @prompt  

# 直接指定加密文件运行剧本

echo 'redhat' > vault-pass

chmod 0600 vault-pass

ansible-navigator run -m stdout create_users.yml \
--vault-password-file=vault-pass