ansible安装用epel源
配置文件:
[root@localhost ~]# vim /etc/ansible/ansible.cfg
#inventory = /etc/ansible/hosts #主机列表配置文件
#library = /usr/share/my_modules/ #库文件存放目录
#remote_tmp = ~/.ansible/tmp #临时py文件存放在远程主机目录
#local_tmp = ~/.ansible/tmp #本机的临时执行目录
#forks = 5 #默认并发数
#sudo_user = root # 默认sudo用户
#ask_sudo_pass = True #每次执行是否询问sudo的ssh密码
#ask_pass = True #每次执行是询问ssh密码
#remote_port = 22 #远程主机端口
#module_set_locale = False #跳过检查主机指纹
log_path = /var/log/ansible.log #ansible日志
安装–配置–启动
rpm -qa httpd
pm -qc httpd(查看配置文件)
主机清单:
[root@localhost project1]# ansible mahaohui -m ping -i hosts
192.168.142.142 | FAILED! => {
“msg”: “Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host’s fingerprint to your known_hosts file to manage this host.”
}
PS:报错时(未做ssh免密设置)
ssh-keygen
ssh-copy-id mhh@192.168.142.142
ansible mahaohui -m ping -i hosts
方式2:(常用)
1.mkdir project1/
2.sshpass -p 123 ssh-copy-id -i ~/.ssh/id_rsa.pub root@192.168.142.142
3.vim hosts
[mahaohui]
192.168.142.142
PS:列出主机情况
ansible mahaohui/all -i hosts --list-host
调整参数:
vim /etc/ansible/ansible.cfg
解除注释:host_key_checking = False
注意:ansible.cfg读取顺序
AD-HOC:
ansible mahaohui -m command -a “df -h(具体命令)” -i hosts
常用模块:
命令 command(默认) shell模块 scripts
安装 yum
配置 copy
启动 service systemd
用户 user group
任务 cron
挂载 mount
防火墙 firewall selinux
command shell 本质上都是执行基础命令(command不支持管道技术)
ansible mahaohui -m command -a “ps aux|grep nginx” -i hosts
ansible mahaohui -m shell -a “ps aux|grep nginx” -i hosts
1.yum模块
ansible-doc yum(查看yum帮助)
(1)安装当前最新的Apache软件,如果存在则更新
ansible mahaohui -m yum -a “name=httpd state=latest” -i hosts
(2)安装当前最新的Apache软件,通过epel仓库安装
ansible mahaohui -m yum -a “name=httpd state=latest enablerepo=epel” -i hosts
(3)通过公网URL安装rpm软件
ansible mahaohui -m yum -a “name=https://mirrors.aliyun.com/centos/8-stream/AppStream/x86_64/os/Packages/pcp-export-zabbix-agent-5.1.1-3.el8.x86_64.rpm?spm=a2c6h.13651111.0.0.1f412f70goBwOa&file=pcp-export-zabbix-agent-5.1.1-3.el8.x86_64.rpm state=latest” -i hosts
(4)更新所有软件包,但排除和kernel相关的
ansible mahaohui -m yum -a “name= state=latest exclude=kernel,foo*” -i hosts
(5)删除Apache软件
ansible mahaohui -m yum -a “name=httpd state=absent” -i hosts
PS:state=persent(正常安装)
=absent(卸载)
=latest(升级)
排除:exclude
指定仓库:enablerep
2.copy模块
以Apache服务为例
1.远程复制Apache主配置文件
scp /etc/httpd/conf/httpd.conf root@192.168.142.142:/root/project1/
2.修改主配置文件listen为非80端口(例:9999)
vim httpd
listen 9999
示例1:将本地的http.conf文件Listen端口修改为9999,然后推送到远端服务
ansible mahaohui -m copy -a “src=./httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=644” -i hosts
示例2:将本地的http.conf文件Listen端口修改为9090,然后推送到远端,检查远端是否存在上一次的备份文件
ansible mahaohui -m copy -a “src=./httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=644 backup=yes” -i hosts
PS:只有配置文件不一样才会备份
示例3:往远端的主机文件中写入内容
ansible mahaohui -m copy -a “content=HttpSever… dest=/var/www/html/index.html” -i hosts
关闭selinux:vim /etc/selinux/confing
SELINUX=disable
PS:
src(源)
dest(目标)
owner(所属主)
group(所属组)
mode(权限)
backup(备份)
content(内容)
3.get—url模块
示例1:下载互联网的软件至本地
http://fj.xuliangwei.com/public/ip.txt
ansible mahaohui -m get_url “url=http://fj.xuliangwei.com/public/ip.txt dest=/var/www/html” -i hosts
示例2:下载互联网文件并进行MD5校验
(1)拿到md5校验值
cd /var/www/html
md5sum ip.txt
(2)
ansible mahaohui -m get_url -a “url=http://fj.xuliangwei.com/public/ip.txt dest=/var/www/html checksum=md5:7b86f423757551574a7499f0aa9d9c2e” -i hosts
4.file模块
示例1:创建文件,并设定属主,属组,权限
ansible mahaohui -m file -a “path=/var/www/html/mahaohui.html state=touch owner=apache group=apache mode=644” -i hosts
示例2:创建目录,并设定属主,属组,权限
ansible mahaohui -m file -a “path=/var/www/html/mahaohui state=directory owner=apache group=apache mode=755” -i hosts
示例3:递归授权目录的方式
(1)递归:ansible mahaohui -m file -a “path=/var/www/html/ owner=apache group=apache mode=755 recurse=yes” -i hosts
(2)未递归:ansible mahaohui -m file -a “path=/var/www/html/ owner=apache group=apache” -i hosts
5.service模块
示例1:启动httpd服务
ansible mahaohui -m service -a “name=httpd state=started” -i hosts
示例2:重载httpd服务
ansible mahaohui -m service -a “name=httpd state=reloaded” -i hosts
示例3:重启httpd服务
ansible mahaohui -m service -a “name=httpd state=restarted” -i hosts
示例4:停止httpd服务
ansible mahaohui -m service -a “name=httpd state=stoped” -i hosts
示例5:启动httpd服务,并加入开机自启/关闭
ansible mahaohui -m service -a “name=httpd state=started enabled=yes/no” -i hosts
PS:
[root@localhost html]# systemctl is-enabled httpd
disabled
6.group模块
示例1:创建news基本组,制定GID为9999
ansible mahaohui -m group -a “name=news gid=9999 state=present” -i hosts
PS:state=present是默认的
示例2:创建http系统组,指定GID8888
ansible mahaohui -m group -a “name=http gid=8888 state=present system=yes” -i hosts
示例3:删除news基本组
ansible mahaohui -m group -a “name=news state=absent” -i hosts
7.user模块
示例1:创建joh用户,UID是1040,主要的组是adm
ansible mahaohui -user -a “name=joh uid=1040 group=adm” -i hosts
示例2:创建joh用户,登录shell是/sbin/nologin,追加bin,sys两个组
ansible mahaohui -user -a “name=joh shell=/sbin/nologin groups=bin,sys” -i hosts
示例3:创建jsm用户,为其添加123作为登录密码,并且创建家目录
(1)生成秘钥
ansible localhost -m debug -a “msg={{‘123’ | password_hash(‘sha512’,‘salt’)}}”
[root@localhost project1]# ansible localhost -m debug -a “msg={{‘123’ | password_hash(‘sha512’,‘salt’)}}”
localhost | SUCCESS => {
“msg”: “
6
6
6salt$jkHSO0tOjmLW0S1NFlw5veSIDRAVsiQQMTrkOKy4xdCCLPNIsHhZkIRlzfzIvKyXeGdOfCBoW1wJZPLyQ9Qx/1”
}
PS:
salt:言,也可以是salt123等其他的
(2)执行
ansible mahaohui -m user -a ‘name=jsm password=
6
6
6salt$jkHSO0tOjmLW0S1NFlw5veSIDRAVsiQQMTrkOKy4xdCCLPNIsHhZkIRlzfzIvKyXeGdOfCBoW1wJZPLyQ9Qx/1 create_home=yes’ -i hosts
示例4:移除joh用户
ansible mahaohui -m user -a “name=joh state=absent remove=yes” -i hosts
PS:remove是删不删除家目录
示例5:创建http用户,并为该用户创建2048字节的私钥,存放在~/http/.ssh/id_rsa
ansible mahaohui -m user -a “name=http generate_ssh_key=yes ssh_key_bits=2048 ssh_key_file=.ssh/id_rsa” -i hosts
PS:
generate_ssh_key:是否创建秘钥
ssh_key_bits:秘钥长度
ssh_key_file:存放路径
8.cron模块
示例1:添加定时任务。每分钟执行一次ls 。* * * * * ls >/dev/null
ansible mahaohui -m cron -a “name=job1 job=‘ls >/dev/null’” -i hosts
PS:* * * * *分时日月周
示例2:添加定时任务,每天凌晨2点和凌晨5点执行一次ls。“0 5,2 * * ls >/dev/null”
ansible mahaohui -m cron -a “name=job2 minute=0 hour=2,5 job=‘ls >/dev/null’” -i hosts
示例3:关闭定时任务,使定时任务失效
ansible mahaohui -m cron -a “name=job2 minute=0 hour=2,5 job=‘ls >/dev/null’ disabled=yes” -i hosts
PS:停止时,任务怎么定义的命令原封不动打上去
9.mount模块
环境准备:
(1)将192.168.142.135作为nfs服务端,192.168.142.142作为nfs客户端进行挂载
ansible mahaohui -m yum -a “name=nfs-utils state=present”
或者先在客户端上下好服务:
yum install -y nfs-utils rpcbind(rpcbind是nfs的依赖)
(2)创建要共享的目录
mkdir /data
(3)编写nfs配置文件
vim /etc/exports
/data 192.168.142.142/24(rw,sync,all_squash)
(4)重启服务
systemctl restart nfs-server
present 开机挂载,仅将挂载配置写入/etc/fstab
mounted 挂载设备,并将挂载配置写入/etc/fstab
absent 卸载设备,会清除 /etc/fstab写入的配置
unmounted 卸载设备,不会清除 /etc/fstab写入的配置
PS:
src:本地或远程设备的路径
path:设备挂载至本地的路径
fstype:文件系统类型
opts:挂载的参数(defaults/默认,rw/读写等)
state:挂载的状态
示例1:挂载nfs存储至本地的/opt目录,并实现开机自动挂载
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=present” -i hosts
示例2:临时卸载nfs的挂载,但不会清理/etc/fstab
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=unmounted” -i hosts
示例3:永久卸载nfs的挂载,会清理/etc/fstab
ansible mahaohui -m mount -a “src=192.168.142.135:/data path=/opt fstype=nfs opts=defaults state=absent” -i hosts
10.selinux模块
示例:关闭selinux
ansinle mahaohui -m selinux -a “state=disabled” -i hosts
11.firewalld模块
1.启动防火墙
ansible mahaohui -m service -a “name=firewalld state=started” -i hosts
示例1:永久放行https的流量,只有重启才会生效
ansible mahaohui -m firewalld -a “zone=public service=https permanent=yes state =enabled” -i hosts
示例2:永久放行8080端口的流量,只有重启才会生效
ansible mahaohui -m firewalld -a “zone=public port=8080/tcp permanent=yes state=enabled” -i hosts
示例3:放行8080-8090的所有tcp端口流量,临时和永久都生效
ansible mahaohui -m firewalld -a “zone=public port=8080-8090/tcp permanent=yes immediate=yes state=enabled” -i hosts
permanent:永久的
immediate:立即
测试:
(1)安装http服务
ansible mahaohui -m yum -a “name=httpd state=latest” -i hosts
(2)编写简单网页测试内容
ansible mahaohui -m copy -a “content=马浩珲你真帅 dest=/var/www/html/index.html” -i hosts
(3)启动服务并加入开机自启
ansible mahaohui -m service -a “name=httpd state=started enabled=yes” -i hosts
(4)放行firewalld对应的端口
ansible mahaohui -m firewalld -a “zone=public port=9090/tcp permanent=yes immediate=yes state=enabled” -i hosts