ANSIBLE自动化工具
ansible相关文件
rpm包安装:EPEL源
配置文件
/etc/ansible/hosts #管理主机的清单
/etc/ansible/roles/ #存放角色的目录
/etc/ansible/ansible.cfg #主配置文件,配置ansible工作特性,一般默认就好
程序
/usr/bin/ansible #主程序,临时命令执行工具
/usr/bin/ansible-doc #查看配置文档,模块功能查看工具
/usr/bin/ansible-galaxy #下载/上传优秀代码或Roles模块的官网平台
/usr/bin/ansible-playbook #定制自动化任务,编排剧本工具/usr/bin/ansible-pull 远程执行命令的工具
/usr/bin/ansible-vault #文件加密工具
/usr/bin/ansible-console #基于Console界面与用户交互的执行工具
ansible命令:
ansible-doc:显示模块帮助
ansible-doc [options][module]
-a 显示所有模块的文档
-l 列出可用模块
-s 显示指定模块的playbook片段
例: ansible-doc ping
ansible-doc -l
ansible-doc -s ping
ansible
--version #显示版本
-m module #指定模块,默认command
-v #显示详细过程 -vv -vvv
--list #显示主机列表,
-C #检查,并不执行
all #表示所有清单列表的主机 ansible all -m ping
* #通配符 ansible "*" -m ping ansible 192.168.2.* -m ping
: #逻辑或 ansible "web1:web2" --list
:& #逻辑与 ansible "web1:&web2" -m ping
:! 用单引号 #逻辑非 ansible ‘web1:&web2‘ --list
https://galaxy.ansible.com
ansible-galaxy list #列出所有已安装的galaxy
ansible-galaxy install geerlingguy.redis #下载安装galaxy
ansible-galaxy remove geerlingguy.redis #删除galaxy
ansible-pull #推送至远程,提升效率
ansible-playbook
ansible-vault
功能:管理加密解密yml文件
ansible-vault [create|decrypt|edit|encrypt|rekey|view]
ansible-vault encrypt hello.yml #加密
ansible-vault decrypt hello.yml #解密
ansible-vault view hello.yml #查看
ansible-vault edit hello.yml #编辑加密文件
ansible-vault rekey hello.yml #修改口令
ansible-vault create new.yml #创建新文件
ansible常用模块
command:在远程主机执行简单命令(默认是command,可以不用m选项)
[[email protected] ~]# ansible web1 -a ‘cat /etc/issue‘
[[email protected] ~]# ansible web1 -a ‘ls -l /etc/selinux‘
shell:调用bash执行复杂命令(万能模块)
[[email protected] ~]# ansible web1 -m shell -a ‘sed -i "s/SELINUX=enforcing/SELINUX=disabled/" /etc/selinux/config
[[email protected] ~]# ansible web1 -a ‘echo $HOSTNAME‘
[[email protected] ~]# ansible web1 -m shell -a ‘tar -Jcvf /root/boot.tar.xz /boot/‘
script:在远程主机上运行ansible服务器上的脚本
[[email protected] ~]# ansible web1 -m script -a ‘/data/hello.sh‘
copy:从主控端复制文件到远程主机
[[email protected] ~]# ansible-doc -s copy
[[email protected] ~]# ansible web1 -m copy -a ‘ src=/etc/selinux/config dest=/etc/selinux/config.bak mode=600 owner=huahua group=bin‘
[[email protected] ~]# ansible web1 -m copy -a ‘ src=/etc/selinux/config dest=/etc/selinux/ backup=yes‘ #默认覆盖,加入backup=yes备份。
[[email protected] ~]# ansible web1 -m copy -a ‘content="111\n222\n333" dest=/tmp/text.txt‘ #content指定内容,直接生成目标文件。
[[email protected] ~]# ansible web1 -m copy -a ‘content="[base]\nname=base\nbaseurl=file:///mnt/cdrom\ngpgcheck=0" dest=/etc/yum.repos.d/base.repo‘ #批量创建yum源
fetch:从远程主机提取文件至主控端,copy相反,目录的话需要tar打包
[[email protected] ~]# ansible-doc -s fetch
[[email protected] ~]# ansible web1 -m fetch -a ‘src=/etc/yum.repos.d/base.repo dest=/tmp/‘ #将远程base.repo文件抓取放到本机tmp目录下
file:设置文件属性
[[email protected] ~]# ansible-doc -s file
[[email protected] ~]# ansible web1 -m file -a ‘path=/tmp/yum.log owner=huahua mode=000‘
[[email protected] ~]# ansible web1 -m file -a ‘src=/tmp/yum.log name=/tmp/yum.log.link state=link‘ #创建软连接
[[email protected] ~]# ansible web1 -m file -a ‘src=/tmp/yum.log name=/tmp/yum.log.hard state=hard‘ #创建硬链接
[[email protected] ~]# ansible web1 -m file -a ‘path=/tmp/dir1 state=directory‘ #创建文件夹
[[email protected] ~]# ansible web1 -m file -a ‘path=/tmp/f1.log state=touch‘ #创建空文件
[[email protected] ~]# ansible web1 -m file -a ‘path=/tmp/f1.log state=absent‘ #删除文件(目录)
[[email protected] ~]# ansible web1 -m shell -a ‘rm -rf /tmp/*‘
hostname:管理主机名
[[email protected] ~]# ansible-doc -s hostname
[[email protected] ~]# ansible 192.168.2.20 -m hostname -a ‘name=centos7.6‘ #更改主机名
cron:计划任务
[[email protected] ~]# ansible-doc -s cron
[[email protected] ~]# ansible web2 -m cron -a ‘name=synctime minute=*/5 job="/usr/sbin/ntpdate 192.168.2.10 &> /dev/null"‘
[[email protected] ~]# ansible web2 -a ‘crontab -l‘
yum:管理包
[[email protected] ~]# ansible-doc -s yum
[[email protected] ~]# ansible web1 -m yum -a ‘name=httpd state=present‘
[[email protected] ~]# ansible web1 -m yum -a ‘name=httpd state=absent‘
service:管理服务
[[email protected] ~]# ansible-doc -s service
[[email protected] ~]# ansible web1 -m service -a ‘name=named state=started enabled=true‘
[[email protected] ~]# ansible web1 -m service -a ‘name=named state=stopped‘
user:管理用户
[[email protected] ~]# ansible-doc -s user
[[email protected] ~]# ansible web1 -a ‘getent passwd‘
[[email protected] ~]# ansible web1 -m user -a ‘name=mysql system=yes shell=/sbin/nologin‘
[[email protected] ~]# ansible web1 -m user -a ‘name=mysql state=absent‘
[[email protected] ~]# ansible web1 -m user -a ‘name=mysql state=absent remove=yes‘
YAML语言
1、第一行写“---” 最后一行“...” (建议不要省略)
2、第二行建议写明功能用#注释
3、缩进必须是统一的,不能空格和tab混用
4、缩进的级别也必须是一致的,同样的缩进代表同样的级别,程序判断配置的级别是通过缩进结合换行来实现的
5、YAML文件内容是区分大小写的,k/v的值均大小写敏感
6、一个完整的代码块功能需要最少元素需包括name和task
7、一个name只能包括一个task
8、YAML文件扩展名通常为yml和yaml
List:列表,所有元素均使用“-”打头
Dictionary:字典,由多个key和value组成
ksy:value
playbook的核心元素:
hosts:playbook配置文件作用的主机
tasks:任务列表
variables:变量
templates:包含模板语法的文本文件
handlers:由特定条件触发的任务
roles:用于层次性、结构化地组织playbook。roles能够根据层次结构自动装载变量文件、tasks以及handlers
运行playbook的方式:
ansible-playbook <filename.yml> ... [options]
常见选项
--check -C #只检测可能会发生的改变,但不真正执行操作
--list-hosts #列出运行任务的主机
--list-tags #列出tag
--list-tasks #列出task
--limit #主机列表 只针对主机列表中的主机执行
-v -vv -vvv #显示过程
[[email protected] ansible]# vim http.yml
---
#install httpd
- hosts: web1
remote_user: root
tasks:
- name: install package
yum: name=httpd
- name: cofig file
copy: src=/tmp/httpd.conf dest=/etc/httpd/conf/ backup=yes
- name: service
service: name=httpd state=started enabled=yes
[[email protected] ansible]# ansible-playbook -C http.yml
[[email protected] ansible]# ansible-playbook http.yml
触发handlers (handlers由notify触发)
---
#install httpd
- hosts: web1
remote_user: root
tasks:
- name: install package
yum: name=httpd
- name: cofig file
copy: src=/tmp/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service
- name: service
service: name=httpd state=started enabled=yes
handlers:
- name: restart service
service: name=httpd state=restarted
[[email protected] ansible]# ansible-playbook http.yml
tags标签(根据tags来实现部分功能)
---
#install httpd
- hosts: web1
remote_user: root
tasks:
- name: install package
yum: name=httpd
- name: cofig file
copy: src=/tmp/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service
tags: config
- name: service
service: name=httpd state=started enabled=yes
tags: service
handlers:
- name: restart service
service: name=httpd state=restarted
[[email protected] ansible]# ansible-playbook -t config http.yml
[[email protected] ansible]# ansible-playbook -t config,service http.yml #选择多个标签
ansible初步准备
[[email protected] ~]# yum -y install ansible
[[email protected] ~]# vim /etc/ansible/hosts #加入清单列表
[web1]
192.168.2.20
192.168.2.30
[web2]
192.168.2.30
192.168.2.40
[[email protected] ~]# vim /etc/ansible/ansible.cfg
log_path = /var/log/ansible.log #开启日志
module_name = shell #修改默认模块
host_key_checking = False #取消对应服务器host_key的检查
基于ksy验证,实现无密钥登录管理
[[email protected] ~]# ssh-keygen
[[email protected] ~]# ssh-copy-id 192.168.2.20
[[email protected] ~]# ssh-copy-id 192.168.2.30
[[email protected] ~]# ssh-copy-id 192.168.2.40
测试连通
[[email protected] ~]# ansible web1 -m ping
192.168.2.20 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.2.30 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[[email protected] ~]# ansible web2 -m ping
192.168.2.30 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.2.40 | SUCCESS => {
"changed": false,
"ping": "pong"
}
playbook变量使用
[[email protected] ansible]# ansible all -m setup #查看所有变量
[[email protected] ansible]# ansible-playbook -e port=6869 file.yml #命令行指定变量,优先级最高
ansible_hostname
ansible_memtotal_mb
调用ansible_hostname变量
---
# file var
- hosts: web1
remote_user: root
tasks:
- name: file
file: name=/tmp/{{ansible_hostname}}.log state=touch
在清单里定义变量port和mark
[[email protected] ansible]# vim /etc/ansible/hosts
[web2]
192.168.2.30 port=80
192.168.2.40 port=8080
[web2:vars]
mark="_"
调用变量
---
# file var
- hosts: web1
remote_user: root
tasks:
- name: file
file: name=/tmp/{{ ansible_hostname }}{{ mark }}{{ port }}.log state=touch
在playbook定义变量
---
# file var
- hosts: web1
remote_user: root
vars_files:
- vars.yml #调用vars.yuml变量文件
---
# file var
- hosts: web1
remote_user: root
vars:
- port: 1989 #文件内定义
模板template
文本文件,嵌套有脚本(使用模板编程语言编写)
Jinja2语言,使用字面量,有下面形式
字符串:使用单引号或双引号
数字:整数,浮点数
列表:[item1, item2, ...]
元组:(item1, item2, ...)
字典:{key1:value1, key2:value2, ...}
布尔型:true/false
算术运算:+, -, *, /, //, %, **
比较操作:==, !=, >, >=, <, <=
逻辑运算:and,or,not
流表达式:For,If,When
template功能:根据模块文件动态生成对应的配置文件
template文件必须存放于templates目录下,且命名为 .j2 结尾
yaml/yml 文件需和templates目录平级,目录结构如下:
./
├── temnginx.yml
└── templates
└── nginx.conf.j2
---
#nginx
- hosts: web2
remote_user: root
tasks:
- name: package
yum: name=nginx
- name: config
template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
notify: restart
- name: service
service: name=nginx state=started enabled=yes
handlers:
- name: restart
service: name=nginx state=restarted
[[email protected] ansible]# tree
.
├── nginx.yml
└── templates
└── nginx.conf.j2
when条件判断
---
#install httpd
- hosts: web1
remote_user: root
tasks:
- name: install package
yum: name=httpd
- name: config file
template: src=templates/httpd.conf6.j2 dest=/etc/httpd/conf/httpd.conf
when: ansible_distribution_major_version == "6"
notify: restart service
- name: config file
template: src=templates/httpd.conf7.j2 dest=/etc/httpd/conf/httpd.conf
when: ansible_distribution_major_version == "7"
- name: service
service: name=httpd state=started enabled=yes
tags: service
handlers:
- name: restart service
service: name=httpd state=restarted
迭代:with_items
---
# file var
- hosts: web1
remote_user: root
tasks:
- name: file
file: name=/tmp/{{item}}.log state=touch
with_items:
- abc
- qwe
- 798
---
- hosts: web1
remote_user: root
tasks:
- name: create user
user: name={{item}}
with_items:
- huahua
- lili
- yangyang
---
- hosts: web1
remote_user: root
tasks:
- name: create group
group: name={{item}}
with_items:
- agroup
- bgroup
- cgroup
- name: create user
user: name={{item.name}} group={{item.group}}
with_items:
- {name: "huahua",group: "agroup"}
- {name: "lili",group: "bgroup"}
- {name: "yangyang",group: "cgroup"}
template for if
1
[[email protected] templates]# pwd
/tmp/ansible/templates
[[email protected] templates]# vim test.j2 #模板文件
{%for i in ports %}
server{
listen {{i}}
server_name www.a.com
root /app/log/
}
{%endfor%}
[[email protected] ansible]# pwd
/tmp/ansible
[[email protected] ansible]# vim test.yml #YAML文件调用
---
- hosts: web1
remote_user: root
vars:
ports:
- 81
- 82
- 83
tasks:
- name: template
template: src=test.j2 dest=/tmp/test.conf
[[email protected] ansible]# ansible-playbook -C test.yml
[[email protected] ansible]# ansible-playbook test.yml
[[email protected] ansible]# ansible web1 -a ‘cat /tmp/test.conf‘
192.168.2.20 | CHANGED | rc=0 >>
server{
listen 81
server_name www.a.com
root /app/log/
}
server{
listen 82
server_name www.a.com
root /app/log/
}
server{
listen 83
server_name www.a.com
root /app/log/
}
...
2
[[email protected] templates]# pwd
/tmp/ansible/templates
[[email protected] templates]# vim test2.j2
{%for i in vhosts %}
server{
listen {{i.port}}
server_name {{i.name}}
root {{i.dir}}
}
{%endfor%}
[[email protected] ansible]# pwd
/tmp/ansible
[[email protected] ansible]# vim test2.yml
---
- hosts: web1
remote_user: root
vars:
vhosts:
- web1:
port: 81
name: www.a.com
dir: /tmp/webs
- web1:
port: 82
name: www.b.com
dir: /tmp/webs
- web1:
port: 83
name: www.c.com
dir: /tmp/webs
tasks:
- name: template
template: src=test2.j2 dest=/tmp/test2.conf
[[email protected] ansible]# ansible-playbook -C test2.yml
[[email protected] ansible]# ansible-playbook test2.yml
[[email protected] ansible]# ansible web1 -a "cat /tmp/test2.conf"
192.168.2.30 | CHANGED | rc=0 >>
server{
listen 81
server_name www.a.com
root /tmp/webs
}
server{
listen 82
server_name www.b.com
root /tmp/webs
}
server{
listen 83
server_name www.c.com
root /tmp/webs
}
...
3
[[email protected] templates]# pwd
/tmp/ansible/templates
[[email protected] templates]# vim test3.j2
{%for i in vhosts %}
server{
listen {{i.port}}
{% if i.name is defined %}
server_name {{i.name}}
{% endif %}
root {{i.dir}}
}
{%endfor%}
[[email protected] ansible]# pwd
/tmp/ansible
[[email protected] ansible]# vim test3.yml
---
- hosts: web1
remote_user: root
vars:
vhosts:
- web1:
port: 81
# name: www.a.com
dir: /tmp/webs
- web1:
port: 82
name: www.b.com
dir: /tmp/webs
- web1:
port: 83
#name: www.c.com
dir: /tmp/webs
tasks:
- name: template
template: src=test3.j2 dest=/tmp/test3.conf
[[email protected] ansible]# ansible-playbook -C test3.yml
[[email protected] ansible]# ansible-playbook test3.yml
[[email protected] ansible]# ansible web1 -a ‘cat /tmp/test3.conf‘
192.168.2.30 | CHANGED | rc=0 >>
server{
listen 81
root /tmp/webs
}
server{
listen 82
server_name www.b.com
root /tmp/webs
}
server{
listen 83
root /tmp/webs
}
Roles角色
/roles/project/ :项目名称,有以下子目录
files/ :存放由copy或script模块等调用的文件
templates/:template模块查找所需要模板文件的目录
tasks/:定义task,role的基本元素,至少应该包含一个名为main.yml的文件;
其它的文件需要在此文件中通过include进行包含
handlers/:至少应该包含一个名为main.yml的文件;其它的文件需要在此
文件中通过include进行包含
vars/:定义变量,至少应该包含一个名为main.yml的文件;其它的文件需要
在此文件中通过include进行包含
meta/:定义当前角色的特殊设定及其依赖关系,至少应该包含一个名为
main.yml的文件,其它文件需在此文件中通过include进行包含
default/:设定默认变量时使用此目录中的main.yml文件
创建role的步骤
(1) 创建以roles命名的目录
(2) 在roles目录中分别创建以各角色名称命名的目录,如webservers等
(3) 在每个角色命名的目录中分别创建files、handlers、meta、tasks、
templates和vars目录;用不到的目录可以创建为空目录,也可以不创建
(4) 在playbook文件中,调用各角色
安装httpd
目录结构
[[email protected] ansible]# tree
.
├── role-httpd.yml
└── roles
└── httpd
├── files
│?? ├── httpd.conf
│?? └── index.html
└── tasks
├── conf.yml
├── data.yml
├── install.yml
├── main.yml
└── service.yml
[[email protected] tasks]# cat conf.yml
- name: config
copy: src=httpd.conf dest=/etc/httpd/conf/httpd.conf
[[email protected] tasks]# cat data.yml
- name: copy data file
copy: src=index.html dest=/var/www/html/index.html
[[email protected] tasks]# cat install.yml
- name: install package
yum: name=httpd
[[email protected] tasks]# cat service.yml
- name: service
service: name=httpd state=started enabled=yes
[[email protected] tasks]# cat main.yml
- include: install.yml
- include: conf.yml
- include: data.yml
- include: service.yml
[[email protected] ansible]# cat role-httpd.yml
---
#test httpd role
- hosts: web1
roles:
- role: httpd
[[email protected] ansible]# ansible-playbook role-httpd.yml
nginx安装
目录结构
[[email protected] ansible]# tree
.
├── role-httpd.yml
├── role-nginx.yml
└── roles
├── httpd
│?? ├── files
│?? │?? ├── httpd.conf
│?? │?? └── index.html
│?? └── tasks
│?? ├── conf.yml
│?? ├── data.yml
│?? ├── install.yml
│?? ├── main.yml
│?? └── service.yml
└── nginx
├── files
│?? └── index.html
├── handlers
│?? └── main.yml
├── tasks
│?? ├── config.yml
│?? ├── data.yml
│?? ├── group.yml
│?? ├── install.yml
│?? ├── main.yml
│?? ├── service.yml
│?? └── user.yml
├── templates
│?? └── nginx.conf.j2
└── vars
└── main.yml
[[email protected] handlers]# cat main.yml
- name: restart service
service: name=nginx state=restarted
[[email protected] tasks]# cat config.yml
- name: config
template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
notify: restart service
[[email protected] tasks]# cat data.yml
- name: copy data file
copy: src=index.html dest=/usr/share/nginx/html/index.html
[[email protected] tasks]# cat group.yml
- name: group
group: name=nginx system=yes gid=77
[[email protected] tasks]# cat user.yml
- name: user
user: name=nginx system=yes uid=77 group=nginx
[[email protected] tasks]# cat install.yml
- name: install
yum: name=nginx
[[email protected] tasks]# cat service.yml
- name: service
service: name=nginx state=started enabled=yes
[[email protected] nginx]# cat tasks/main.yml
- include: group.yml
- include: user.yml
- include: install.yml
- include: config.yml
- include: data.yml
- include: service.yml
[[email protected] ansible]# cat role-nginx.yml
---
#test nginx role
- hosts: web2
roles:
- role: nginx
tags标签和when判断
---
#test httpd role
- hosts: web1:web3
roles:
- role: httpd
tags: web
when: ansible_distribution_major_version == "6"
- role: nginx
tags: web2
when: ansible_distribution_major_version == "7"
[[email protected] ansible]# ansible-playbook -t web1 role-httpd-nginx.yml
原文地址:https://blog.51cto.com/14230743/2385508
时间: 2024-11-13 06:18:38