ansible自动化运维工具
1.环境:
m0 192.168.1.67 管理机
s1 192.168.1.68 被管理
s2 192.168.1.69 被管理
s3 192.168.1.70 被管理
2.安装ansible
[root@m0 ~]# yum -y install ansible
[root@m0 ~]# find /etc/ -name "*ansible*"
/etc/ansible
/etc/ansible/ansible.cfg
3.做免密登陆
[root@m0 ~]# ssh-keygen
[root@m0 ~]# ssh-copy-id 192.168.1.68
[root@m0 ~]# ssh-copy-id 192.168.1.69
4.定义主机组
[root@m0 ~]# vim /etc/ansible/hosts //写两个组,01组两个都是做免密的,02组两个免密,一个没做免密
[group01]
192.168.1.68
192.168.1.69
[group02]
192.168.1.68
192.168.1.69
192.168.1.70
5.测试
[root@m0 ~]# ansible 192.168.1.68 -m ping //ping1.68主机
192.168.1.68 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
[root@m0 ~]# ansible group01 -m ping //pinggroup01组(1.68,1.69)
192.168.1.68 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.69 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
[root@m0 ~]# ansible group02 -m ping //pinggroup02组,没有做免密的s3没有成功
The authenticity of host '192.168.1.70 (192.168.1.70)' can't be established.
ECDSA key fingerprint is SHA256:vcks5uGmemwyxNBSF54XWNYY0tCzHAh/OP4IJPQeSFI.
ECDSA key fingerprint is MD5:83:fe:4f:99:f8:7a:a1:9c:fb:94:c4:e3:81:3c:e2:a8.
Are you sure you want to continue connecting (yes/no)? yes
192.168.1.68 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.69 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.70 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Warning: Permanently added '192.168.1.70' (ECDSA) to the list of known hosts.\r\nPermission denied (publickey,gssapi-keyex,gssapi-with-mic,password).",
"unreachable": true
}
[root@m0 ~]# vim /etc/ansible/hosts //没有做免密登陆的可以利用别名来传递端口密码等
[group01]
192.168.1.68
192.168.1.69
other ansible_ssh_host=192.168.1.70 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass=q
[group02]
192.168.1.68
192.168.1.69
other
[root@m0 ~]# ansible group02 -m ping //三台都ping成功了
192.168.1.69 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.68 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
other | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
[root@m0 ~]# ansible other -m ping //单独pingother(1.70)也是可以成功的
other | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
练习:不论你⽤哪种环境(免密或不免密,端⼝是否22), 请最终将两台被管理机器加⼊到group1组即可
[root@m0 ~]# vim /etc/ansible/hosts
web01 ansible_ssh_host=192.168.1.68 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass=q
web02 ansible_ssh_host=192.168.1.69 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass=q
[group01]
web01
web02
[root@m0 ~]# ansible group01 -m ping
web02 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
web01 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
6.ansible模块
[root@m0 ~]# ansible-doc -l //查看所以支持的模块
官⽹模块⽂档地址: https://docs.ansible.com/ansible/latest/modules
/list_of_all_modules.html
7.hostname模块(用于修改主机名)
[root@m0 ~]# ansible group02 -m hostname -a 'name=ab.tdr.tds' //三台主机的名字都被改成了ab.tdr.tds
8.file模块(重点)
(1)path 文件地址
(2)state 方法
1)directory 创建目录
2)touch 创建文件
3)absent 删除文件
4)link 创建软链接
5)hard 创建硬链接
3)recurse 是否允许递归操作
4)src 文件源
[root@m0 ~]# ansible group01 -m file -a 'path=/tmp/abc state=directory' //三台主机都被创建了abc目录
[root@m0 ~]# ansible group02 -m file -a 'path=/tmp/abc recurse=yes owner=bin group=daemon mode=1777' //给属性
[root@m0 ~]# ansible group02 -m file -a 'path=/tmp/abc state=absent' //删除这三台机子的/tmp/abc目录
[root@m0 ~]# ansible group02 -m file -a 'path=/tmp/aaa state=touch owner=bin group=daemon mode=1777' //创建文件并给属性
[root@m0 ~]# ansible group02 -m file -a 'src=/etc/fstab path=/tmp/xxx state=link' //创建一个软链接
[root@m0 ~]# ansible group02 -m file -a 'src=/etc/fstab path=/tmp/xxx2 state=hard' //创建一个硬链接
9.stat模块
[root@m0 ~]# ansible group02 -m stat -a 'path=/etc/fstab'
10.copy模块
[root@m0 ~]# ansible group02 -m copy -a 'src=./mysql57.tar.gz dest=~' //把文件mysql57.tar.gz传到另外三台主机的家(~)目录下
[root@m0 ~]# ansible group02 -m copy -a 'content="wo shi ni die" dest=~/a.sh' //使用content参数直接往远程⽂件⾥写内容(会覆盖原内容)注意:ansible中-a后⾯的参数⾥也有引号时,记得要单引双引交叉使⽤,如果都为双引或单引会出现问题
[root@m0 ~]# ansible group02 -m copy -a 'content="wo shi ni baba" dest=~/a.sh force=no' //如果⽬标⽂件已经存在,则不覆盖
[root@m0 ~]# ansible group02 -m copy -a 'content="wo shi ni baba" dest=~/a.sh force=yes' //如果⽬标⽂件已经存在,则会强制覆盖
[root@m0 ~]# ansible group02 -m copy -a 'content="wo shi ni baba" dest=~/a.sh backup=yes' //backup=yes表示如果拷⻉的⽂件内容与原内容不⼀样,则会备份⼀份, group1的机器上会将~/a.sh备份⼀份(备份⽂件命名加上时间),再远程拷⻉新的⽂件为~/a.sh
效果如下:
[root@ab ~]# ls
anaconda-ks.cfg a.sh a.sh.14315.2024-08-16@15:29:28~ mysql57.tar.gz s.sh x.sh
[root@ab ~]# cat a.sh
wo shi ni baba[root@ab ~]# cat a.sh.14315.2024-08-16@15\:29\:28~
wo shi ni die[root@ab ~]#
copy模块拷⻉时要注意拷⻉⽬录后⾯是否带"/"符号
/etc/yum.repos.d后⾯不带/符号,则表示把/etc/yum.repos.d整个⽬录拷⻉到/tmp/⽬录下
[root@m0 ~]# ansible group02 -m copy -a 'src=/etc/yum.repos.d dest=/tmp/'
/etc/yum.repos.d/后⾯带/符号,则表示把/etc/yum.repos.d/⽬录⾥的所有⽂件拷⻉到/tmp/⽬录下
[root@m0 ~]# ansible group02 -m copy -a 'src=/etc/yum.repos.d/ dest=/tmp/'
11.fetch模块(fetch模块与copy模块类似,但作⽤相反。⽤于把远程机器的⽂件拷⻉到本地。)
[root@m0 ~]# ansible group02 -m fetch -a 'src=/etc/sysconfig/network-scripts/ifcfg-ens33 dest=/tmp/'
[root@m0 ~]# tree /tmp //树状查看
/tmp
├── 192.168.1.68
│ └── etc
│ └── sysconfig
│ └── network-scripts
│ └── ifcfg-ens33
├── 192.168.1.69
│ └── etc
│ └── sysconfig
│ └── network-scripts
│ └── ifcfg-ens33
├── other
│ └── etc
│ └── sysconfig
│ └── network-scripts
│ └── ifcfg-ens33
12.user模块
user模块⽤于管理⽤户账号和⽤户属性。
[root@m0 ~]# ansible group02 -m user -a 'name=aaaa state=present' //创建aaa⽤户,默认为普通⽤户,创建家⽬录
[root@m0 ~]# ansible group02 -m user -a 'name=mysql state=present system=yes shell="/sbin/nologin"' //创建mysql系统⽤户,并且登录shell环境为/sbin/nologin
[root@m0 ~]# ansible group02 -m file -a 'path=/usr/local/mysql state=directory' //创建目录
[root@m0 ~]# ansible group02 -m file -a 'path=/usr/locall/mysql/mysql-file state=touch owner=mysql group=mysql mode=1777 ' //创建文件,并指定它的属主属组权限
[root@m0 ~]# ansible group02 -m user -a 'name=abc state=present uid=1999 password=abc' //创建abc用户指定uid和密码
[root@m0 ~]# ansible group2 -m user -a 'name=hadoop generate_ssh_key=yes' //创建⼀个普通⽤户叫hadoop,并产⽣空密码密钥对
[root@m0 ~]# ansible group02 -m user -a 'name=aaaa state=absent' //删除aaaa⽤户,但家⽬录默认没有删除
[root@m0 ~]# ansible group02 -m user -a 'name=bbbb state=absent remove=yes' //删除bbb⽤户,使⽤remove=yes参数让其删除⽤户的同时也删除家⽬录
13.group模块
⽤于管理⽤户组和⽤户组属性。
[root@m0 ~]# ansible group1 -m group -a 'name=groupa gid=3000 state=present' //创建组
[root@m0 ~]# ansible group1 -m group -a 'name=groupa state=absent //删除组(如果有⽤户的gid为此组,则删除不了)
14.cron模块
cron模块⽤于管理周期性时间任务
[root@m0 ~]# ansible group1 -m cron -a 'name="test cron1" user=root job="touch /tmp/111" minute=*/2' //创建⼀个cron任务,不指定user的话,默认就是root,如果minute,hour,day,month,week不指定的话,默认都为*
[root@m0 ~]# ansible group1 -m cron -a 'name="test cron1" state=absent //删除cron任务
15.yum_repository模块
⽤于配置yum仓库
[root@m0 ~]# ansible group1 -m yum_repository -a "name=local description=localyum baseurl=file:///mnt/ enabled=yes gpgcheck=no" //增加⼀个/etc/yum.repos.d/local.repo配置⽂件
[root@m0 ~]# ansible group1 -m yum_repository -a "name=local state=absent" //删除/etc/yum.repos.d/local.repo配置⽂件
16.yum模块(重点)
yum模块⽤于使⽤yum命令来实现软件包的安装与卸载。
[root@m0 ~]# ansible group1 -m yum -a 'name=vsftpd state=present' //使⽤yum安装⼀个软件(前提:group1的机器上的yum配置都已经好)
[root@m0 ~]# ansible group1 -m yum -a 'name=httpd,httpd-devel state=latest' //使⽤yum安装httpd,httpd-devel软件,state=latest表示安装最新版本
[root@m0 ~]# ansible group1 -m yum -a 'name=httpd,httpd-devel state=absent' //使⽤yum卸载httpd,httpd-devel软件
17.service模块(重点)
service模块⽤于控制服务的启动,关闭,开机⾃启动等。
[root@m0 ~]# ansible group1 -m service -a 'name=vsftpd state=started enabled=on' //启动vsftpd服务,并设为开机⾃动启动
[root@m0 ~]# ansible group1 -m service -a 'name=vsftpd state=stopped enabled=false' //关闭vsftpd服务,并设为开机不⾃动启动
18.command与shell模块
两个模块都是⽤于执⾏linux命令的,这对于命令熟悉的⼯程师来说,⽤起来⾮常爽。
shell模块与command模块差不多(command模块不能执⾏⼀些类似$HOME,>,<,|等符号,但shell可以)
注意: shell模块并不是百分之百任何命令都可以,⽐如vim或ll别名就不可以。