学习记录： 安装配置自动化工具ansible

学习记录：  安装配置ansible

更新日期: 2016-11-30

系统环境    ：centos6.5 本机ip        ：192.168.233.123 被管理机ip ：192.168.233.124 ————————————————————————————————————— py版本       ：   默认python2.6 ansible版本：ansible 1.7.2

ansible参数:             -m  模块名(执行命令)              -a  模块参数               -i  目录清单(/etc/ansible/hosts)               ansible-doc -l  显示所有自带模块

1.安装相关模块

(1)、setuptools模块安装

# wget https://pypi.python.org/packages/source/s/setuptools/setuptools-7.0.tar.gz --no-check-certificate # tar zvxf setuptools-7.0.tar.gz # cd setuptools-7.0 # python setup.py install

(2)、PyYAML模块安装

# wget http://pyyaml.org/download/libyaml/yaml-0.1.5.tar.gz # tar zvxf yaml-0.1.5.tar.gz # cd yaml-0.1.5 # ./configure --prefix=/usr/local/ # make && make install

# wget https://pypi.python.org/packages/source/P/PyYAML/PyYAML-3.11.tar.gz --no-check-certificate # tar zvxf PyYAML-3.11.tar.gz # cd PyYAML-3.11 # python setup.py install

(3)、Jinja2模块安装

# wget https://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.7.3.tar.gz --no-check-certificate # tar zvxf Jinja2-2.7.3.tar.gz # cd Jinja2-2.7.3 # python setup.py install

(4)、paramiko模块安装

# wget https://pypi.python.org/packages/source/p/paramiko/paramiko-1.15.1.tar.gz --no-check-certificate # tar zvxf paramiko-1.15.1.tar.gz # cd paramiko-1.15.1 # python setup.py install

2.安装ansible

# wget http://releases.ansible.com/ansible/ansible-1.7.2.tar.gz #  tar zvxf ansible-1.7.2.tar.gz  # cd ansible-1.7.2/ # python setup.py install

3.配置免密钥登录

(1)生成秘钥

[[email protected] ~]# cd ~/.ssh/ [[email protected] .ssh]# ssh-keygen Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa):    (保存路径空) Enter passphrase (empty for no passphrase):    (ssh密码空) Enter same passphrase again:     (ssh密码空)

(2)将公钥传输到被管理机

[[email protected] .ssh]# ssh-copy-id -i /root/.ssh/id_rsa.pub [email protected]

(3)测试免密钥登录

[[email protected] .ssh]# ssh [email protected] Last login: Wed Nov 23 10:09:58 2016 from 192.168.233.1 [[email protected] ~]# exit logout Connection to 192.168.233.124 closed.

4. 配置ansible

(1) 创建ansible目录，将生成的ansible.cfg、hosts 文件拷贝到此目录

[[email protected] ]# mkdir /etc/ansible/ [[email protected] ]# cd examples/ [[email protected] examples]# cp ansible.cfg hosts /etc/ansible/

(2)设置环境变量

[[email protected] examples]# export ANSIBLE_SUDO_USER=root

(3)修改配置文件相应参数

[[email protected] examples]# cd /etc/ansible/ [[email protected] ansible]# vim ansible.cfg 14 inventory       = /etc/ansible/hosts 15 library        = /usr/share/ansible 18 forks          = 5 20 sudo_user      = root 24 remote_port    = 22 39 host_key_checking = False 48 timeout = 60 56 log_path = /var/log/ansible.log

(4)查看版本

[[email protected] ansible]# ansible --version ansible 1.7.2

5. 添加主机并测试

(1) 添加host

[[email protected] ansible]# vim hosts  ......省略以上 [test] 192.168.233.124

(2)测试主机连通性

[[email protected] ansible]# ansible test -m ping 192.168.233.124 | success >> { "changed": false, "ping": "pong" }

• shell模块

[[email protected] ansible]# ansible test -m shell -a ‘/bin/echo hello ansible!‘ -i hosts  192.168.233.124 | success | rc=0 >> hello ansible!

• command模块

[[email protected] ansible]# ansible test -m command -a ‘/bin/echo hello ansible!‘ -i hosts  192.168.233.124 | success | rc=0 >> hello ansible!

• copy文件到.124主机

[[email protected] ansible]# ansible test -m copy -a "src=/root/history dest=/root mode=655" 192.168.233.124 | success >> { "changed": true, "dest": "/root/history", "gid": 0, "group": "root", "md5sum": "2e88c32c0c8c54869253563dfcfb90e9", "mode": "0655", "owner": "root", "path": "/root/history", "secontext": "system_u:object_r:admin_home_t:s0", "size": 78415, "state": "file", "uid": 0 }

• 修改所传文件history所属主

[[email protected] ansible]# ansible test -m file -a "path=/root/history owner=centos" 192.168.233.124 | success >> { "changed": true, "gid": 0, "group": "root", "mode": "0655", "owner": "centos", "path": "/root/history", "secontext": "system_u:object_r:admin_home_t:s0", "size": 78415, "state": "file", "uid": 1001 } ———————————————————————————————————— 被管理机：192.168.233.124 [[email protected] ~]# ls -l -rw-------. 1 root   root  1263 8月   9 18:01 anaconda-ks.cfg -rw-r-xr-x. 1 centos root 78415 11月 28 14:38 history

• 在存在的目录/test下创建新文件1.txt  [state 定义目标状态]

[[email protected] ansible]# ansible test -m file -a "path=/test/1.txt state=directory" 192.168.233.124 | success >> { "changed": true, "gid": 0, "group": "root", "mode": "0755", "owner": "root", "path": "/test/1.txt", "secontext": "unconfined_u:object_r:default_t:s0", "size": 6, "state": "directory", "uid": 0 }

• 每五分钟同步一次时间

[[email protected] ansible]# ansible test -m cron -a "minute=‘*/5‘ job=‘/usr/sbin/ntpdate 192.168.233.123 &> /dev/null‘ name=‘sync time‘" 192.168.233.124 | success >> { "changed": true, "jobs": [ "sync time" ] } ————————————————————————————————————— 被管理机：192.168.233.124 [[email protected] test]# crontab -l #Ansible: sync time */5 * * * * /usr/sbin/ntpdate 192.168.233.123 &> /dev/null

6. 初写playbook

(1) playbook都以.yaml结尾

[[email protected] ~]# vim test.yaml - hosts: test remote_user: root tasks: - name: copy authorized_keys copy: src=/root/.ssh/id_rsa.pub dest=/root/.ssh/authorized_keys - name: restart iptables service: name=iptables state=restarted - name: iptables shell: iptables -A INPUT -p icmp -j REJECT - name: iptables shell: iptables -A INPUT -p tcp -s 192.168.100.1 --dport 22 -j ACCEPT

(2) ansible-playbook 加上文件即可执行

[[email protected] ~]# ansible-playbook  test.yaml PLAY [test] ******************************************************************* GATHERING FACTS *************************************************************** ok: [192.168.233.124] TASK: [copy authorized_keys] ************************************************** changed: [192.168.233.124] TASK: [restart iptables] ****************************************************** changed: [192.168.233.124] TASK: [iptables] ************************************************************** changed: [192.168.233.124] TASK: [iptables] ************************************************************** changed: [192.168.233.124]

7. 使用playbook安装salt-minion

- hosts: test remote_user: root tasks: - name: copy authorized_keys template: src=~/.ssh/id_rsa.pub dest=/root/.ssh/authorized_keys #    - name: iptables    ##将iptables11行对应内容替换 #        shell: sed -i ‘11s/REJECT/ACCEPT/‘ /etc/sysconfig/iptables - name: backup shell: cd /etc/yum.repos.d/ && mkdir bak && mv epel.repo yum.repo bak/ - name: Download epel get_url: url=https://repo.saltstack.com/yum/redhat/salt-repo-latest-1.el6.noarch.rpm dest=/etc/yum.repos.d/salt-repo-latest-1.el6.noarch.rpm - name: Install epel shell: rpm -ivh /etc/yum.repos.d/salt-repo-latest-1.el6.noarch.rpm creates=/etc/yum.repos.d/salt.repo - name: Clean cache shell: yum clean all - name: shell: yum makecache - name: Install salt-minion yum: name=salt-minion state=latest - name: copy salt conf file  (##拷贝的文件在本机创建好，并改好配置) copy: src=/etc/ansible/files/minion dest=/etc/salt/minion ## ALLOW RELATED,ESTABLISHED - iptables: chain=INPUT ctstate=RELATED,ESTABLISHED jump=ACCEPT ## ALLOW IP - iptables: chain=INPUT in_interface=eth0 protocol=tcp match=tcp source=192.168.233.124 destination_port=22 jump=ACCEPT ## REJECT icmp - iptables: chain=INPUT in_interface=eth0 protocol=icmp jump=REJECT - iptables: chain=FORWARD in_interface=eth0 protocol=icmp jump=REJECT ## REJECT lo - iptables: chain=INPUT in_interface=lo jump=ACCEPT - name: save iptables command: service iptables save - name: iptables restart shell: /etc/init.d/iptables restart

可登录到被管理机验证。