在生产中使用Ansible Roles进行新服务（一对一）部署

我们在运维生产环境中，经常会遇到服务的迁移部署，在完成服务初始化及免密登录之后，我们就需要将程序和数据同步到新的机器上，以下是我们在生产中使用 ansible playbook 编写的脚本，由于线上环境的复杂性，我们采用一对一进行新机器环境的部署工作，在实际使用 ansible playbook 的过程中，我们重点使用了 ansible 的变量，此文可能并非最优方案，只希望能做到抛砖引玉的作用，欢迎大佬指正

1 目录结构如下

[@bjyf_50_20 roles]# pwd
/search/ansible/roles
[@bjyf_50_20 roles]# tree
.
|-- adtech
|   |-- files
|   |-- handlers
|   |-- tasks
|   |   |-- check.yml
|   |   |-- cron.yml
|   |   |-- group.yml
|   |   |-- hadoop_client.yml
|   |   |-- main.yml
|   |   |-- monitor.yml
|   |   |-- pkg_install.yml
|   |   |-- rsync_data.yml
|   |   |-- rsync_lib64.yml
|   |   |-- rsync_sysconf.yml
|   |   `-- user.yml
|   |-- templates
|   `-- vars
|       `-- main.yml
`-- init
    `-- tasks
        |-- main.yml
        `-- ssh_key.yml

8 directories, 14 files
[@bjyf_50_20 roles]#

2 免密初始化

此脚本有一个缺憾，那就是机器的密码相同，当然如果密码不同也可以定义在 hosts 中，不过为了提高效率，我们写了一个 shell 脚本（查看脚本）

# 免密文件
cat /search/ansible/roles/init/tasks/ssh_key.yml
---
- debug: msg="user=root state=present key={{ lookup('file', '/root/.ssh/id_rsa.pub') }}"

- name: ssh-key copy
  authorized_key: user=root state=present key="{{ lookup('file', '/root/.ssh/id_rsa.pub') }}"
  
#入口文件 
cat /search/ansible/roles/init/tasks/main.yml
- include: ssh_key.yml

# hosts文件
cat /etc/ansible/hosts
[rs]
10.162.39.66
10.162.39.64
10.162.49.44
10.162.49.41
10.162.49.42
10.162.49.40
10.162.47.29
10.162.42.60
10.162.38.85
10.162.38.133
10.162.42.58
[rs:vars]
ansible_ssh_pass="noSafeNoWork@2020"

#执行文件
cat /search/ansible/rs.yml
- hosts: rs
  remote_user: root
  gather_facts: no

  roles:
    - role: init

#语法检查
ansible-playbook -C rs.yml

#执行
ansible-playbook rs.yml

#效果验证
ansible all -m shell -a 'whoami'
  

3 task任务

1. 环境检查

cat /search/ansible/roles/adtech/tasks/check.yml
---

- debug: msg="rsync {{ src_ip }}::root{{ item }}"
  with_items: "{{ src_path }}"

- name: Get IP address
  shell: hostname -I |awk '{print $1}'
  register: remoteIP

- name: Whether in Caesar or not
  shell: curl -s "http://www.test.com/php/ip_search_exec.php?user_name=song&search_ip={{ remoteIP.stdout }}"|grep -ow "{{ remoteIP.stdout }}"
  register: caesar
  failed_when: caesar.rc == 0

- name: check directory
  shell: "rsync {{ src_ip }}::root{{ item }}"
  with_items: "{{ src_path }}"
  register: result
  failed_when: result.rc != 0

- debug: msg="check ok"

2. 创建组

cat /search/ansible/roles/adtech/tasks/group.yml
---
- name: create op_biz group
  group: name=op_biz system=yes state=present

- name: create hermes group
  group: name=hermes system=yes state=present

3. 创建用户

cat /search/ansible/roles/adtech/tasks/user.yml
---
- name: Create a username and password
  user: name={{ item.name }} password={{ item.pass | password_hash('sha512') }} update_password=always group={{ item.group }} home={{ item.home }}
  with_items:
    - { name: 'op_biz', pass: 'op_biz2020', group: 'op_biz', home: '/search/odin' }
    - { name: 'hermes', pass: 'hermes2020', group: 'hermes', home: '/home/hermes' }
    - { name: 'adpc', pass: 'adpc2020', group: 'op_biz', home: '/home/adpc' }
    - { name: 'adwl', pass: 'adwl2020', group: 'op_biz', home: '/home/adwl' }

- name: rsync passwd file
  shell: rsync -aP {{ src_ip }}::root/etc/passwd /tmp
  register: passDone
  ignore_errors: True

- name: Check the user home directory
  shell: awk 'BEGIN{FS=":"}/op_biz/{print $6}' /tmp/passwd
  when: passDone.rc == 0
  register: userHome
  ignore_errors: True

#- name: print variable
#  debug: msg="{{ userHome }}"

- name: usermod op_biz
  shell: usermod -d {{ userHome.stdout }} op_biz
  register: result
  failed_when: result.rc != 0
  ignore_errors: True

- debug: msg="useradd done"

4. 同步监控脚本

cat /search/ansible/roles/adtech/tasks/monitor.yml
---
- debug: msg="rsync -aP {{ src_ip }}::root/opt/monitor/ /opt/monitor/"

- name: rsync monitor
  shell: rsync -aP {{ src_ip }}::root/opt/monitor/ /opt/monitor/
  register: result
  failed_when: result.rc != 0

- debug: msg="rsync done"

5. 同步cron任务

cat /search/ansible/roles/adtech/tasks/cron.yml
---
- name: Turn off the cron service
  service: name=crond state=stopped

- debug: msg="rsync -aP {{ src_ip }}::root/var/spool/cron/ /var/spool/cron/"

- name: rsync cron
  shell: rsync -aP {{ src_ip }}::root/var/spool/cron/ /var/spool/cron/
  register: result
  failed_when: result.rc != 0

- debug: msg="rsync done"

6. 同步hadoop客户端

cat /search/ansible/roles/adtech/tasks/hadoop_client.yml
---
- debug: msg="rsync -aP {{ src_ip }}::root/opt/hadoop-client /opt/"

- name: rsync hadoop-client
  shell: rsync -aP {{ src_ip }}::root/opt/hadoop-client /opt/
  register: result
  failed_when: result.rc != 0

- name: insert op_biz slave user
  copy: content='slave,slave\n' dest=/search/odin/ugi_config

- name: insert root slave user
  copy: content='slave,slave\n' dest=/root/ugi_config

- debug: msg="rsync done"

7. 同步数据和代码

cat /search/ansible/roles/adtech/tasks/rsync_data.yml
---
- debug: msg="rsync -aP {{ src_ip }}::root{{ item }} {{ item }}"
  with_items: "{{ src_path }}"

- name: rsync dir
  shell: rsync -aP {{ src_ip }}::root{{ item }} {{ item }} --include='*/' --exclude='*'
  with_items: "{{ src_path }}"
  register: result
  failed_when: result.rc != 0

- debug: msg="rsync -aP {{ src_ip }}::root{{ item }} {{ item }} --exclude={{ ext_data }}"
  with_items: "{{ src_path }}"

- name: rsync data
  shell: rsync -aP {{ src_ip }}::root{{ item }} {{ item }} --exclude={{ ext_data }}
  with_items: "{{ src_path }}"
  register: result
  failed_when: result.rc != 0

- debug: msg="rsync done"

8. 拉取sysconf配置

cat /search/ansible/roles/adtech/tasks/rsync_sysconf.yml
---
- debug: msg="rsync -aP {{ src_ip }}::root/etc/sysctl.conf /etc/"

- name: rsync sysctl.conf
  shell: rsync -aP {{ src_ip }}::root/etc/sysctl.conf /etc/
  register: result
  failed_when: result.rc != 0

- name: reload sysconf
  shell: sysctl -p
  register: result
  failed_when: result.rc != 0
  ignore_errors: True   #忽略命令执行的错误

- debug: msg="rsync done"

9. 拉取lib库文件（请注意不同的操作系统版本不能进行此操作，否则将会导致系统出现错误）

cat /search/ansible/roles/adtech/tasks/rsync_lib64.yml
---
- debug: msg="rsync -aP {{ src_ip }}::root/usr/lib64/{{ lib_file }} /usr/lib64/"

- name: Whether the biddingServer
  shell: /usr/bin/ls /search/odin/bin/lead_server
  register: isBidding
  ignore_errors: True

#- name: print isBidding
#  debug: msg="{{ isBidding }}"

- name: rsync /usr/lib64/{{ lib_file }}
  shell: rsync -aP {{ src_ip }}::root/usr/lib64/{{ lib_file }} /usr/lib64/
  when: isBidding.rc == 0
  register: result
  failed_when: result.rc != 0
  ignore_errors: True

- debug: msg="rsync done"

10. 入口文件（按顺序执行）

cat /search/ansible/roles/adtech/tasks/main.yml
- include: check.yml
- include: group.yml
- include: user.yml
- include: monitor.yml
- include: cron.yml
- include: hadoop_client.yml
- include: rsync_data.yml
- include: rsync_sysconf.yml
- include: rsync_lib64.yml

11. 变量定义

cat /search/ansible/roles/adtech/vars/main.yml
src_path: ["/search/", "/home/"]
ext_data: "{'log/*','bak/*','*core*','update_data/index/*','update_data/data/*','debug/*','backup/*'}"
lib_file: "{'libcurl*','libhiredis*','libboost_regex*','libboost_thread*','libboost_date*','libboost_filesystem*'}"
pkg_name: ["jemalloc", "htop"]

4. 运行play-book

1. 引入roles

cat /search/ansible/deployment.yml
---
- hosts: "{{ server }}"
  remote_user: root
  gather_facts: no

  roles:
    - role: init      # init是免密文件夹名（做过免密之后可注释此项）
    - role: adtech    # adtech是tasks文件夹名

2. 一对一同步hosts

cat /etc/ansible/hosts 
[bidding]
10.162.39.63 src_ip=10.134.57.126   # 前面是旧机器IP，后面是新机器IP
10.162.42.59 src_ip=10.134.49.40    
10.162.38.82 src_ip=10.134.49.41
10.162.39.84 src_ip=10.134.57.86
10.162.42.55 src_ip=10.134.57.34
10.162.42.54 src_ip=10.134.57.35    # 同上

3. 执行playbook

cd /search/ansible/roles

ansible-playbook deployment.yml -e 'server=bidding'