11.1 Ansible

1、Ansible的工作原理

 

1. 核心：ansible,可以理解为是ansible命令工具，其为核心执行工具
2. 核心模块（Core Modules）：这些都是ansible自带的模块
3. 扩展模块（Custom Modules）：如果核心模块不足以完成某种功能，可以添加扩展模块
4. 插件（Plugins）：完成模块功能的补充
5. 剧本（Playbooks）：ansible的任务配置文件，将多个任务定义在剧本中，由ansible自动执行
6. 连接插件（Connectior Plugins）：ansible基于连接插件连接到各个主机上，虽然ansible是使用ssh连接到各个主机的，但是它还支持其他的连接方法，所以需要有连接插件
7. 主机清单（Host Inventory）：定义ansible管理的主机

 

工作原理如下图所示

1、管理端支持local 、ssh、zeromq 三种方式连接被管理端，默认使用基于ssh的连接－－－这部分对应基本架构图中的连接模块；

2、可以按应用类型等方式进行Host Inventory（主机群）分类，管理节点通过各类模块实现相应的操作－－－单个模块，单条命令的批量执行，我们可以称之为ad-hoc；

3、管理节点可以通过playbooks 实现多个task的集合实现一类功能，如web服务的安装部署、数据库服务器的批量备份等。playbooks我们可以简单的理解为，系统通过组合多条ad-hoc操作的配置文件 。

ansible命令执行过程：

1. 加载自己的配置文件 默认/etc/ansible/ansible.cfg

2. 加载自己对应的模块文件，如command

3. 通过ansible将模块或命令生成对应的临时py文件，并将该文件传输至远程服务器的对应执行用户$HOME/.ansible/tmp/ansible-tmp-数字/XXX.PY文件

4. 给文件+x执行

5. 执行并返回结果

6. 删除临时py文件，sleep 0退出

参考：

http://www.talkwithtrend.com/Article/242331

https://www.linuxprobe.com/ansible-formwork-2.html

2、使用ansible在多台机器上添加用户

1) 定义host主机

vim etc/ansible/hosts

[servers]
192.168.1.111
192.168.1.222
192.168.1.101
192.168.1.100

2）使用ansible命令在多台机器上添加用户

ansible servers -m user -a 'name=user1 comment="ansible test users" uid=2020 home=/app/user1 group=root'

 

3、用ansible-playbook编译安装nginx服务

ansible控制端为192.168.1.106

被控端分别为192.168.1.107和192.168.1.108

1 设置ansible到各个被控机基于key验证通讯

ssh-keygen
ssh-copy-id -i .ssh/id_rsa.pub root@192.168.0.107
ssh-copy-id -i .ssh/id_rsa.pub root@192.168.0.108

 

2 ansible定义主机组

vim /etc/ansible/hosts
[testsrvs]
192.168.0.107
192.168.0.108

 

3 定义playbook : main.yml

- hosts: testsrvs
  remote_user: root

  tasks:
        - name: prepare the env
          yum: name={{item}}
          with_items:
          - openssl
          - zlib-devel
          - pcre-devel
          - gcc
        - name: copy package of nginx
          copy: src=/root/tools/nginx-1.14.1.tar.gz dest=/tmp/nginx-1.14.1.tar.gz

        - name: copy script to create user
          copy: src=/etc/ansible/roles/nginx/files/create_users.sh dest=/tmp/create_users.sh
        - name: create user for nginx
          shell: /bin/bash /tmp/create_users.sh
        - name: tar the package
          shell: cd /tmp; tar -zxvf nginx-1.14.1.tar.gz
        - name: install Nginx
          shell: cd /tmp/nginx-1.14.1;./configure  --user=nginx --group=nginx --sbin-path=/usr/sbin/nginx; make && make install
          notify: start nginx
  handlers:
        - name: start nginx
          shell: /usr/sbin/nginx

4 准备好main.yml文件中需要的文件

cat /etc/ansible/roles/nginx/files/create_users.sh

#!/bin/bash
a=`cat /etc/passwd | grep nginx | wc -l`
if [ $a == 0 ]; then
	useradd nginx
fi

[root@localhost nginx]# ls /root/tools | grep nginx
nginx-1.14.1.tar.gz

5 测试

[root@localhost tasks]# ansible-playbook -C main.yml

PLAY [testsrvs] *********************************************************************************************************

TASK [Gathering Facts] **************************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [prepare the env] **************************************************************************************************
[DEPRECATION WARNING]: Invoking "yum" only once while using a loop via squash_actions is deprecated. Instead of using a 
loop to supply multiple items and specifying `name: "{{item}}"`, please use `name: ['openssl', 'zlib-devel', 'pcre-
devel', 'gcc']` and remove the loop. This feature will be removed in version 2.11. Deprecation warnings can be disabled 
by setting deprecation_warnings=False in ansible.cfg.
[DEPRECATION WARNING]: Invoking "yum" only once while using a loop via squash_actions is deprecated. Instead of using a 
loop to supply multiple items and specifying `name: "{{item}}"`, please use `name: ['openssl', 'zlib-devel', 'pcre-
devel', 'gcc']` and remove the loop. This feature will be removed in version 2.11. Deprecation warnings can be disabled 
by setting deprecation_warnings=False in ansible.cfg.
ok: [192.168.0.108] => (item=[u'openssl', u'zlib-devel', u'pcre-devel', u'gcc'])
ok: [192.168.0.107] => (item=[u'openssl', u'zlib-devel', u'pcre-devel', u'gcc'])

TASK [copy package of nginx] ********************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [copy script to create user] ***************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [create user for nginx] ********************************************************************************************
skipping: [192.168.0.108]
skipping: [192.168.0.107]

TASK [tar the package] **************************************************************************************************
skipping: [192.168.0.108]
skipping: [192.168.0.107]

TASK [install Nginx] ****************************************************************************************************
skipping: [192.168.0.108]
skipping: [192.168.0.107]

PLAY RECAP **************************************************************************************************************
192.168.0.107              : ok=4    changed=0    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0   
192.168.0.108              : ok=4    changed=0    unreachable=0    failed=0    skipped=3    rescued=0    ignored=0   

[root@localhost tasks]# ansible-playbook  main.yml 

PLAY [testsrvs] ******************************************************************************************************************************************

TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [prepare the env] ***********************************************************************************************************************************
[DEPRECATION WARNING]: Invoking "yum" only once while using a loop via squash_actions is deprecated. Instead of using a loop to supply multiple items and
 specifying `name: "{{item}}"`, please use `name: ['openssl', 'zlib-devel', 'pcre-devel', 'gcc']` and remove the loop. This feature will be removed in 
version 2.11. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
[DEPRECATION WARNING]: Invoking "yum" only once while using a loop via squash_actions is deprecated. Instead of using a loop to supply multiple items and
 specifying `name: "{{item}}"`, please use `name: ['openssl', 'zlib-devel', 'pcre-devel', 'gcc']` and remove the loop. This feature will be removed in 
version 2.11. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
ok: [192.168.0.108] => (item=[u'openssl', u'zlib-devel', u'pcre-devel', u'gcc'])
ok: [192.168.0.107] => (item=[u'openssl', u'zlib-devel', u'pcre-devel', u'gcc'])

TASK [copy package of nginx] *****************************************************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [copy script to create user] ************************************************************************************************************************
ok: [192.168.0.108]
ok: [192.168.0.107]

TASK [create user for nginx] *****************************************************************************************************************************
changed: [192.168.0.108]
changed: [192.168.0.107]

TASK [tar the package] ***********************************************************************************************************************************
changed: [192.168.0.108]
changed: [192.168.0.107]

TASK [install Nginx] *************************************************************************************************************************************
changed: [192.168.0.107]
changed: [192.168.0.108]

RUNNING HANDLER [start nginx] ****************************************************************************************************************************
changed: [192.168.0.107]
changed: [192.168.0.108]
***********************************************************************************************************************************************
192.168.0.107              : ok=8    changed=4    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
192.168.0.108              : ok=8    changed=4    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0  

在控制端访问：