Ansible变量

今天摘太阳

已于 2022-10-30 22:44:48 修改

阅读量542

点赞数

文章标签： ansible

于 2022-10-30 22:44:33 首次发布

本文链接：https://blog.csdn.net/weixin_72900594/article/details/127606354

版权

ansible变量

定义变量规则：由字母/数字/下划线组成，变量需要以字母开头，ansible内置的关键字不能作为变量名。
ansible中，可以将变量简化为三个范围 Global范围（高）：从命令行和ansible配置设置的变量 play范围（中）：在play和相关结构中设置的变量 Host范围（低）：inventory、facts或register的变量，在主机组和个别主机上设置的变量三个范围的变量优先级依次降低，如果变量重复定义，则以优先级高的为准

注册和定义变量的各种方式

ansible中定义变量的方式有很多种，大致有：
(1) 将模块的执⾏结果注册为变量；
(2) 直接定义字典类型的变量；
(3) role中⽂件内定义变量；
(4) 命令⾏传递变量；
(5) 借助with_items迭代将多个task的结果赋值给⼀个变量；
(6) inventory中的主机或主机组变量；
(7) 内置变量。

vars定义变量

[root@ansible]# su - student
[student@ansible]$ cd ansible/
[student@ansible ansible]$ pwd
/home/student/ansible

[student@ansible ansible]$ vim zhan.yml
--- 
- name: vars变量
  hosts: dev
  vars: 
    - aa: 11
    - bb: 22
    - cc: 
        a1: c31
        a2: c32
  tasks: 
    - name: create debug
      debug: 
        msg: "{{ aa }}" 
    - name: create debug2
      debug:
        msg: "{{ bb }}"
    - name: create debug3
      debug:
       msg: "{{ cc.a1 }}"
    - name: create debug4
      debug:
       msg: "{{ cc.a2 }}"
       
[student@ansible ansible]$ ansible-playbook sb.yml -C

PLAY [vars变量] **********************************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [create debug] ************************************************************
ok: [node1] => {
    "msg": 11
}

TASK [create debug2] ***********************************************************
ok: [node1] => {
    "msg": 22
}

TASK [create debug] ************************************************************
ok: [node1] => {
    "msg": "c31"
}

TASK [create debug4] ***********************************************************
ok: [node1] => {
    "msg": "c32"
}

PLAY RECAP *********************************************************************
node1                      : ok=5    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[student@ansible ansible]$

Vars_files定义变量

student@ansible ansible]$ vim var.yml 
aa: 11
bb: 22
cc: 
  a1: c31
  a2: c32

[student@ansible ansible]$ vim sb.yml 
--- 
- name: vars_files变量
  hosts: dev
  vars_files: /home/student/ansible/var.yml 
  tasks: 
    - name: create debug
      debug: 
        msg: "{{ aa }}" 
    - name: create debug2
      debug:
        msg: "{{ bb }}"
    - name: create debug3
      debug:
        msg: "{{ cc.a1 }}"
    - name: create debug4
      debug:
        msg: "{{ cc.a2 }}"

[student@ansible ansible]$ ansible-playbook zhan.yml -C

PLAY [vars_files变量] ************************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [create debug] ************************************************************
ok: [node1] => {
    "msg": 11
}

TASK [create debug2] ***********************************************************
ok: [node1] => {
    "msg": 22
}

TASK [create debug3] ***********************************************************
ok: [node1] => {
    "msg": "c31"
}

TASK [create debug4] ***********************************************************
ok: [node1] => {
    "msg": "c32"
}

PLAY RECAP *********************************************************************
node1                      : ok=5    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[student@ansible ansible]$ ls
ansible.cfg  inventory  zhan.yml
httpd.yml    roles      var.yml

set_fact定义变量

set_fact和register的功能很相似，也是将值赋值给变量。它更像shell中变量的赋值⽅式，可以将某个变量的值赋值给另⼀个变量，也可以将字符串赋值给变量

通过ansible node1 -m setup 可以查询node1主机所有的事实变量

student@ansible ansible]$ vim zhan.yml 
---
- name: 查找dev主机组中主机的名称
  hosts: dev
  tasks: 
    - name: hostname
      debug: 
        msg: "{{ ansible_fqdn }}"
[student@ansible ansible]$ ansible-playbook sb.yml 

PLAY [查找dev主机组中主机的名称] ***********************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [hostname] ****************************************************************
ok: [node1] => {
    "msg": "node1"
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[student@ansible ansible]$ vim sb.yml 
---
- name: 查找dev主机组中node1d 的信息
  hosts: dev
  tasks: 
    - name: test
      debug: 
        msg: "my name is {{ ansible_nodename }} or {{ ansible_ens33.ipv4.address }}"

[student@ansible ansible]$ ansible-playbook sb.yml 

PLAY [查找dev主机组中node1d 的信息] *****************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [test] ********************************************************************
ok: [node1] => {
    "msg": "my name is node1 or 192.168.181.181"
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

通过命令传入变量

[student@ansible ansible]$ vim sb.yml 
---
- name: 通过命令传入变量
  hosts: dev
  tasks: 
    - name: test
      debug: 
        msg: my name is {{zlh }}
    - name: debug test
      debug: 
        msg: my name is {{ zhan }}

[student@ansible ansible]$ ansible-playbook zhan.yml -e 'zlh=zhanlonghui zhan=long'

PLAY [通过命令传入变量] ****************************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [test] ********************************************************************
ok: [node1] => {
    "msg": "my name is zhanlonghui"
}

TASK [debug test] **************************************************************
ok: [node1] => {
    "msg": "my name long"
}

PLAY RECAP *********************************************************************
node1                      : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

主机清单中的变量

[student@ansible ansible]$ vim inventory 
[dev]
node1
[test]
node2
[prod]
node3
[dev:vars]
vars1='hi'
vars2='hello'

[student@ansible ansible]$ vim zhan.yml 
---
- name: 主机清单中的变量
  hosts: dev
  tasks: 
    - name: test
      debug: 
        msg: my name is {{ vars1 }}
    - name: debug test
      debug: 
        msg: my name is {{ vars2 }}
[student@ansible ansible]$ ansible-playbook zhan.yml 

PLAY [主机清单中的变量] ****************************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [test] ********************************************************************
ok: [node1] => {
    "msg": "my name is hi"
}

TASK [debug test] **************************************************************
ok: [node1] => {
    "msg": "my name is hello"
}

PLAY RECAP *********************************************************************
node1                      : ok=3    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

内置变量

ansible_version

[student@ansible ansible]$ vim zhan.yml 
---
- name: 内置变量ansible_version
  hosts: dev
  tasks: 
    - name: debug
      debug: 
        msg: "{{ ansible_version }}"
[student@ansible ansible]$ ansible-playbook zhan.yml 

PLAY [内置变量ansible_version] *****************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
    "msg": {
        "full": "2.9.27",
        "major": 2,
        "minor": 9,
        "revision": 27,
        "string": "2.9.27"
    }
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

inventory_hostname

[student@ansible ansible]$ vim sb.yml

name: 内置变量inventory_hostname
hosts: dev
tasks:
- name: debug
  debug:
  msg: “{{ inventory_hostname }}”
  [student@ansible ansible]$ ansible-playbook sb.yml

PLAY [内置变量inventory_hostname] **************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
“msg”: “node1”
}

PLAY RECAP *********************************************************************
node1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

play_hosts

[student@ansible ansible]$ vim zhan.yml 
---
- name: 内置变量play_hosts 
  hosts: dev
  tasks: 
    - name: debug
      debug: 
        msg: "{{ play_hosts }}"

[student@ansible ansible]$ ansible-playbook sb.yml 

PLAY [内置变量play_hosts] **********************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
    "msg": [
        "node1"
    ]
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

groups

[student@ansible ansible]$ cat zhan.yml 
---
- name: 内置变量groups
  hosts: dev
  tasks: 
    - name: debug
      debug: 
        msg: "{{ groups }}"
[student@ansible ansible]$ ansible-playbook zhan.yml 

PLAY [内置变量groups] **************************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
    "msg": {
        "all": [
            "node1",
            "node2",
            "node3"
        ],
        "dev": [
            "node1"
        ],
        "prod": [
            "node3"
        ],
        "test": [
            "node2"
        ],
        "ungrouped": [],
        "webservers": []
    }
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

group_names

[student@ansible ansible]$ vim zhan.yml 
---
- name: 内置变量group_names
  hosts: dev
  tasks: 
    - name: debug
      debug: 
        msg: "{{ group_names }}"
[student@ansible ansible]$ ansible-playbook sb.yml 

PLAY [内置变量group_names] *********************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
    "msg": [
        "dev"
    ]
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

inventory_dir

[student@ansible ansible]$ vim zhan.yml 
---
- name: 内置变量inventory_dir
  hosts: dev
  tasks: 
    - name: debug
      debug: 
        msg: "{{ inventory_dir }}"
[student@ansible ansible]$ ansible-playbook sb.yml 

PLAY [内置变量inventory_dir] *******************************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [debug] *******************************************************************
ok: [node1] => {
    "msg": "/home/student/ansible"
}

PLAY RECAP *********************************************************************
node1                      : ok=2    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

With_items叠加变量—可以给一个变量赋予多个值

[student@ansible ansible]$ vim zhan.yml 
---
- name: With_items叠加变量---可以给一个变量赋予多个值
  hosts: dev
  tasks: 
    - name: abc
      shell: echo "{{ item }}"
      with_items:
        - haha
        - heihei
        - hehe
      register: hi_var

    - name: debug1
      debug:
        var: hi_var.results[0].stdout

    - name: debug2
      debug:
        var: hi_var.results[1].stdout

    - name: debug3
      debug:
        var: hi_var.results[2].stdout

[student@ansible ansible]$ ansible-playbook zhan.yml 

PLAY [With_items叠加变量---可以给一个变量赋予多个值] *******************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [abc] *********************************************************************
changed: [node1] => (item=haha)
changed: [node1] => (item=heihei)
changed: [node1] => (item=hehe)

TASK [debug1] ******************************************************************
ok: [node1] => {
    "hi_var.results[0].stdout": "haha"
}

TASK [debug2] ******************************************************************
ok: [node1] => {
    "hi_var.results[1].stdout": "heihei"
}

TASK [debug3] ******************************************************************
ok: [node1] => {
    "hi_var.results[2].stdout": "hehe"
}

PLAY RECAP *********************************************************************
node1                      : ok=5    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

[student@ansible ansible]$ vim zhan.yml 
---
- name: With_items叠加变量---可以给一个变量赋予多个值
  hosts: dev
  tasks: 
    - name: test
      shell: echo "{{ item }}"
      with_items:
        - haha
        - heihei
        - hehe
      register: hi_var

    - name: debug1
      debug:
        msg: "{{ hi_var }}"

[student@ansible ansible]$ ansible-playbook zhan.yml 

PLAY [With_items叠加变量---可以给一个变量赋予多个值] *******************************************

TASK [Gathering Facts] *********************************************************
ok: [node1]

TASK [test] ********************************************************************
changed: [node1] => (item=haha)
changed: [node1] => (item=heihei)
changed: [node1] => (item=hehe)

TASK [debug1] ******************************************************************
ok: [node1] => {
    "msg": {
        "changed": true,
        "msg": "All items completed",
        "results": [
            {
                "ansible_loop_var": "item",
                "changed": true,
                "cmd": "echo \"haha\"",
                "delta": "0:00:00.003308",
                "end": "2022-10-28 01:05:36.635480",
                "failed": false,
                "invocation": {
                    "module_args": {
                        "_raw_params": "echo \"haha\"",
                        "_uses_shell": true,
                        "argv": null,
                        "chdir": null,
                        "creates": null,
                        "executable": null,
                        "removes": null,
                        "stdin": null,
                        "stdin_add_newline": true,
                        "strip_empty_ends": true,
                        "warn": true
                    }
                },
                "item": "haha",
                "rc": 0,
                "start": "2022-10-28 01:05:36.632172",
                "stderr": "",
                "stderr_lines": [],
                "stdout": "haha",
                "stdout_lines": [
                    "haha"
                ]
            },
            {
                "ansible_loop_var": "item",
                "changed": true,
                "cmd": "echo \"heihei\"",
                "delta": "0:00:00.002888",
                "end": "2022-10-28 01:05:37.106682",
                "failed": false,
                "invocation": {
                    "module_args": {
                        "_raw_params": "echo \"heihei\"",
                        "_uses_shell": true,
                        "argv": null,
                        "chdir": null,
                        "creates": null,
                        "executable": null,
                        "removes": null,
                        "stdin": null,
                        "stdin_add_newline": true,
                        "strip_empty_ends": true,
                        "warn": true
                    }
                },
                "item": "heihei",
                "rc": 0,
                "start": "2022-10-28 01:05:37.103794",
                "stderr": "",
                "stderr_lines": [],
                "stdout": "heihei",
                "stdout_lines": [
                    "heihei"
                ]
            },
            {
                "ansible_loop_var": "item",
                "changed": true,
                "cmd": "echo \"hehe\"",
                "delta": "0:00:00.003453",
                "end": "2022-10-28 01:05:37.583345",
                "failed": false,
                "invocation": {
                    "module_args": {
                        "_raw_params": "echo \"hehe\"",
                        "_uses_shell": true,
                        "argv": null,
                        "chdir": null,
                        "creates": null,
                        "executable": null,
                        "removes": null,
                        "stdin": null,
                        "stdin_add_newline": true,
                        "strip_empty_ends": true,
                        "warn": true
                    }
                },
                "item": "hehe",
                "rc": 0,
                "start": "2022-10-28 01:05:37.579892",
                "stderr": "",
                "stderr_lines": [],
                "stdout": "hehe",
                "stdout_lines": [
                    "hehe"
                ]
            }
        ]
    }
}

PLAY RECAP *********************************************************************
node1                      : ok=3    changed=1    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

管理机密

Ansible可能需要访问密码或者API密钥等敏感数据，以便配置受控主机。通常，此信息可能以纯文本形式存储在清单变量或其他ansible文件中。但若如此，任何有权访问ansible文件的用户或者存储这些ansible文件的版本控制系统都能够访问此敏感数据。这显然存在安全风险。
使用ansible随附的ansible vault 可以加密和解密任何由ansible使用的结构化数据文件。若要使用ansible vault，可通过一个名为ansible-vault的命令行工具创建、编辑、加密、解密和查看文件。Ansible vault可以加密任何由ansible使用的结构化数据文件。这可能包括清单变量、playbook中含有的变量文件、在执行playbook时作为参数传递的变量文件，或者ansible角色中定义的变量。

创建加密的文件

要创建新的加密文件，使用ansible-vault create filename命令，默认使用vi编辑

[student@ansible ansible]$ ansible-vault create zhan.yml
New Vault password: 1
Confirm New Vault password: 1
---
- name: test1
  hosts: node1
  tasks:
    - name: create user2
      user:
        name: user2
        state: present

默认使用ansile-playbook test.yml会执行失败

[student@ansible ansible]$ ansible-playbook zhan.yml 
ERROR! Attempting to decrypt but no vault secrets found

查看加密的文件

[student@ansible ansible]$ ansible-vault view zhan.yml 
Vault password: 1
---
- name: test1
  hosts: node1
  tasks:
    - name: create user2
      user:
        name: user2
        state: present

编辑现有的加密文件

[student@ansible ansible]$ ansible-vault edit zhan.yml 
Vault password: 1

加密现有的文件

[student@ansible ansible]$ ansible-vault encrypt zhan.yml  
New Vault password: 1
Confirm New Vault password: 1

解密现有的文件

现有的加密文件可以通过ansible-vault decrypt filename命令永久解密。在解密单个文件时，可使用–output选项以其他名称保存解密文件。
1、直接解密

[student@ansible ansible]$ ansible-vault decrypt zhan.yml  
Vault password: 
Decryption successful
[student@ansible ansible]$ cat zhan.yml 
---
- name: test1
  hosts: node1
  tasks:
    - name: create user2
      user:
        name: user2
        state: present

2、解密文件并存放为其他名称，原文件仍然处于加密状态(其中原文件a.yml仍处于加密状态，a-secret.yml处于解密状态)

[student@ansible ansible]$ ansible-vault  decrypt  a.yml  --output=a-secret.yml

更改加密文件的密码

ansible-vault rekey filename命令可以修改

[student@ansible ansible]$ ansible-vault rekey zhan.yml 
Vault password: 1
New Vault password: 2
Confirm New Vault password: 2
Rekey successful

加密后的文件直接用playbook执行会报错，那么该使用什么命令呢？
使用选项–vault-id @prompt或者–ask-vault-pass都可

[student@ansible ansible]$ ansible-vault create jj.yml
New Vault password:
Confirm New Vault password:
[student@ansible ansible]$ ansible-playbook --ask-vault-pass jj.yml
Vault password:

PLAY [查找dev主机组中主机的名称] ***************************************************************************************

TASK [Gathering Facts] **************************************************************************************
ok: [node1]

TASK [hostname] *********************************************************************************************
ok: [node1] => {
“msg”: “node1”
}

PLAY RECAP **************************************************************************************************
node1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

[student@ansible ansible]$ ansible-playbook --vault-id @prompt jj.yml -C
Vault password (default):

PLAY [查找dev主机组中主机的名称] ***************************************************************************************

TASK [Gathering Facts] **************************************************************************************
ok: [node1]

TASK [hostname] *********************************************************************************************
ok: [node1] => {
“msg”: “node1”
}

PLAY RECAP **************************************************************************************************
node1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

拓展
创建Web内容目录
按照下方所述，创建一个名为 /home/student/ansible/sb.yml 的 playbook：
该 playbook 在 dev 主机组中的受管节点上运行
创建符合下列要求的目录 /webdev：
所属组为 devops 组
具有常规权限：owner=read+write+execute，group=read+write+execute，other=read+execute
具有特殊权限: set group ID
用符号链接将/webdev目录链接到/var/www/html/webdev
创建文件 /webdev/index.html，其中包含如下所示的单行文本：Development
在 dev 主机组中主机上浏览此目录（例如 http://node1.example.com/webdev/ ）将生成以下输出：
Development


[student@ansible ansible]$ pwd
/home/student/ansible
[student@ansible ansible]$ vim zhan.yml
[student@ansible ansible]$ ansible-playbook zhan.yml 
[student@ansible ansible]$ cat zhan.yml 
---
- name: web站点
  hosts: dev
  tasks: 
    - name: mount mnt
      mount: 
        src: /dev/sr0
        fstype: iso9660
        path: /mnt
        state: mounted
    - name: cteate yum repo-1
      yum_repository: 
        file: zhan
        name: oo
        description: kjknkolnkl
        baseurl: file:///mnt/AppStream
        enabled: yes
        gpgcheck: no

    - name: cteate yum repo-2
      yum_repository: 
        file: zhan
        name: pp
        description: hjkajhkj
        baseurl: file:///mnt/BaseOS
        enabled: yes
        gpgcheck: no
     
    - name: 安装httpd
      yum: 
        name: httpd
        state: present

    - name: create user=devops
      user: 
        name: devops
        state: present

    - name: create /webdev
      file: 
        path: /webdev
        group: devops
        mode: 2775
        state: directory

    - name: create  /webdev/index.html 文本：Development
      copy: 
        content: "Development\n"
        dest: /webdev/index.html

    - name: set firewalld
      firewalld: 
        service: http
        permanent: yes
        immediate: yes
        state: enabled
    
    - name: link
      file: 
        src: /webdev
        dest: /var/www/html/webdev 
        state: link

    - name: set context
      sefcontext: 
        target: /webdev/index.html
        setype: httpd_sys_content_t
        state: present
    - name: set -R
      shell: restorecon -Rv /webdev/index.html

    - name: started httpd service
      service: 
        name: httpd
        state: restarted
        enabled: yes


PLAY [web站点] ************************************************************************************************

TASK [Gathering Facts] **************************************************************************************
ok: [node1]

TASK [mount mnt] ********************************************************************************************
changed: [node1]

TASK [cteate yum repo-1] ************************************************************************************
changed: [node1]

TASK [cteate yum repo-2] ************************************************************************************
changed: [node1]

TASK [安装httpd] **********************************************************************************************
changed: [node1]

TASK [create user=devops] ***********************************************************************************
changed: [node1]

TASK [create /webdev] ***************************************************************************************
changed: [node1]

TASK [create  /webdev/index.html 文本：Development] ************************************************************
changed: [node1]

TASK [set firewalld] ****************************************************************************************
changed: [node1]

TASK [link] *************************************************************************************************
changed: [node1]

TASK [set context] ******************************************************************************************
changed: [node1]

TASK [set -R] ***********************************************************************************************
changed: [node1]

TASK [started httpd service] ********************************************************************************
changed: [node1]

PLAY RECAP **************************************************************************************************
node1                      : ok=13   changed=12   unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   
[root@node1 ~]# curl http://node1/webdev/
Development
[root@node1 ~]# curl http://node1/webdev/
Development