Ansible快速入门（一）

#1. 下载 epel 源

[root@manager ~]# wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo

[root@manager ~]# yum install ansible -y

#2. 查看版本

[root@manager ~]# ansible --version

#3. 测试是否可用

[root@manager ~]# ansible localhost -m ping

localhost | SUCCESS => {

    "changed": false, 

    "ping": "pong"

}

#1.pip 安装

[root@manager ~]# yum install python3 python3-devel python3-pip -y

[root@manager ~]# pip3 install --upgrade pip -i https://pypi.douban.com/simple/

[root@manager ~]# pip3 install ansible -i https://pypi.douban.com/simple/

[root@manager ~]# /usr/local/bin/ansible --version

#2. 查看版本

[root@manager ~]# ansible --version

#3. 测试是否可用

[root@manager ~]# ansible localhost -m ping

localhost | SUCCESS => {

    "changed": false, 

    "ping": "pong"

}

[root@web01 ~]# rpm -qc ansible

/etc/ansible/ansible.cfg   #主配置文件，配置 ansible 工作特性

/etc/ansible/hosts         #配置主机清单文件

/etc/ansible/roles/        #存放 ansible 角色的目录

#inventory      = /etc/ansible/hosts							# 主机列表配置文件

#inventory      = ./hosts										# 路径重新定义

#library        = /usr/share/my_modules/                        #库文件存放目录

#module_utils   = /usr/share/my_module_utils/                   #模块件存放目录

#remote_tmp     = ~/.ansible/tmp                                #临时 py 文件存放在远程主机目录

#local_tmp      = ~/.ansible/tmp                                #本机的临时执行目录

#plugin_filters_cfg = /etc/ansible/plugin_filters.yml

#forks          = 5												# 默认并发数				

#roles_path    = /etc/ansible/roles                             #角色存储路径

#sudo_user      = root                                          #默认 sudo 用户

#ask_sudo_pass = True                                           #每次执行是否询问 sudo 的 ssh 密码

#ask_pass      = True                                           #每次执行是否询问 ssh 密码

#remote_port    = 22                                            #远程主机端口

#host_key_checking = False                                      #检查对应服务器的 host_key，建议取消

#log_path = /var/log/ansible.log                                #ansible 日志，建议启用

[root@manager ~]# export ANSIBLE_CONFIG=/tmp/ansible.cfg

[root@manager ~]# touch /tmp/ansible.cfg

[root@manager ~]# ansible --version

[root@web01 ~]# ansible --version

ansible 2.9.27

  config file = /tmp/ansible.cfg

[root@manager ~]# unset ANSIBLE_CONFIG			# 取消

[root@manager ~]# mkdir project1

[root@manager ~]# cd project1/

[root@manager project1]# touch ansible.cfg

[root@manager project1]# ansible --version

ansible 2.9.27

  config file = /root/project1/ansible.cfg

[root@manager ~]# touch ~/.ansible.cfg

[root@manager ~]# ansible --version

ansible 2.9.27

  config file = /root/.ansible.cfg

[root@manager project1]# rm -f ~/.ansible.cfg

[root@manager ~]# ansible --version

ansible 2.9.27

  config file = /etc/ansible/ansible.cfg

[root@manager ~]# cat /etc/ansible/hosts 

[webservers]

172.16.1.7

172.16.1.8

172.16.1.9

[dbservers]

172.16.1.51	

172.16.1.41	

db[01:08].ixuyong.cn

[testservers]

test[01:99]-node.ixuyong.cn

[root@manager ~]# ansible dbservers --list-hosts 

  hosts (10):

    172.16.1.51

    172.16.1.41

    db01.ixuyong.cn

    db02.ixuyong.cn

    db03.ixuyong.cn

    db04.ixuyong.cn

    db05.ixuyong.cn

    db06.ixuyong.cn

    db07.ixuyong.cn

    db08.ixuyong.cn

[root@manager ~]# cat /etc/ansible/hosts 

[webservers]

172.16.1.7 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'

172.16.1.8 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'

[dbservers]

172.16.1.51 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'	

172.16.1.41 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'

[root@manager ~]# ansible webservers -m ping

172.16.1.7 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

172.16.1.8 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

[root@manager ~]# cat /etc/ansible/hosts 

[webservers]

172.16.1.7 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'

172.16.1.8 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass='talent'

[dbservers]

172.16.1.51

172.16.1.41

[dbservers:vars]

ansible_ssh_port=22

ansible_ssh_user=root

ansible_ssh_pass='talent'

[root@manager ~]# ansible dbservers -m ping

172.16.1.41 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

172.16.1.51 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

[root@manager ~]# ssh-keygen 

[root@manager ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.7

[root@manager ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.8

[root@manager ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.41

[root@manager ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.51

[root@manager ~]# cat /etc/ansible/hosts 

[webservers]

172.16.1.7

172.16.1.8

[dbservers]

172.16.1.51

172.16.1.41

[root@manager ~]# ansible all -m ping

172.16.1.41 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

172.16.1.7 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

172.16.1.51 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

172.16.1.8 | SUCCESS => {

    "ansible_facts": {

        "discovered_interpreter_python": "/usr/bin/python"

    }, 

    "changed": false, 

    "ping": "pong"

}

#1. 指定操作所有的组

ansible all -m ping

#2. 通配符

ansible "*" -m ping

ansible web* -m ping

#3. 与：在 webservers 组；并且在 dbsservers 中的主机；

ansible "webservers:&dbservers" -m ping

#4. 或：在 webservers 组，或者在 appservers 中的主机；

ansible "webservers:appservers" -m ping

#5. 非：在 webservers 组，但不在 apps 组中的主机

ansible 'webservers:!apps' -m ping

#6. 正则表达式；

ansible "~(web|db).*\.oldxu\.com" -m ping

[root@manager ~]# useradd xuyong

[root@manager ~]# echo "talent" | passwd --stdin xuyong

[root@manager ~]# su xuyong

[xuyong@manager root]$ ssh-keygen 

[xuyong@manager root]$ ssh-copy-id -i ~/.ssh/id_rsa.pub xuyong@172.16.1.7

[xuyong@manager root]$ ssh-copy-id -i ~/.ssh/id_rsa.pub xuyong@172.16.1.8

[root@web01 ~]# vim /etc/sudoers

xuyong  ALL=(ALL)       NOPASSWD: ALL

# 检查语法

[root@web01 ~]# visudo -csf /etc/sudoers

/etc/sudoers: parsed OK

[root@manager ~]# vim /etc/ansible/ansible.cfg

[privilege_escalation]

become=True

become_method=sudo

become_user=root

become_ask_pass=False

[xuyong@manager root]$ ansible webservers -m shell -a "mkdir /opt/test"

[WARNING]: Consider using the file module with state=directory rather than running 'mkdir'.  If you need to use command because

file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of

this message.

172.16.1.7 | CHANGED | rc=0 >>

172.16.1.8 | CHANGED | rc=0 >>

[root@web01 ~]# ll /opt/

drwxr-xr-x 2 root root 6 Oct 22 20:56 test

[root@web02 ~]# ll /opt/

drwxr-xr-x 2 root root 6 Oct 22 20:56 test

[root@manager ~]# ansible-doc yum

[root@manager project]# ansible webservers -m command -a "creates=/tmp/log ifconfig ens192"

[root@manager ~]# ansible webservers -m command -a 'creates=/data/file ifconfig ens192'

[root@manager ~]# ansible webservers -m command -a 'removes=/data/file ifconfig ens192'

[root@manager ~]# ansible webservers -m shell -a "ifconfig ens192 | awk 'NR==2'"

192.168.1.8 | CHANGED | rc=0 >>

        inet 192.168.1.8  netmask 255.255.255.0  broadcast 192.168.1.255

192.168.1.7 | CHANGED | rc=0 >>

        inet 192.168.1.7  netmask 255.255.255.0  broadcast 192.168.1.255

[root@manger ~]# ansible webservers -m yum -a "name=httpd state=present"

[root@manger ~]# ansible webservers -m yum -a "name=httpd state=present enablerepo=epel"

[root@manger ~]# ansible webservers -m yum -a "name=https://xx.rpm state=present"

[root@manger ~]# ansible webservers -m yum -a "name=httpd state=latest"

[root@manger ~]# ansible webservers -m yum -a "name=* state=latest exclude=kernel"

[root@manger ~]# ansible webservers -m yum -a "name=httpd state=absent"

[root@manger ~]# ansible webservers -m copy -a "src=./httpd.conf dest=/etc/httpd/conf/httpd.conf

owner=root group=root mode=644"

[root@manger ~]# ansible webservers -m copy -a "src=./httpd.conf dest=/etc/httpd/conf/httpd.conf

owner=root group=root mode=644 backup=yes"

[root@manger ~]# ansible webservers -m copy -a 'content="oldxu.net123" dest=/etc/rsync.pass owner=root group=root mode="0600" backup=yes

[root@manager project]# cat sudoers.yaml 

- hosts: webservers

  tasks:

  - name: Copy a "sudoers" file on the remote machine for editing

    copy:

      src: ./sudoers

      dest: /etc/sudoers

      validate: /usr/sbin/visudo -csf %s

[root@manager project]# ansible-playbook sudoers.yaml

[root@manger ~]# ansible webservers -m systemd -a "name=httpd state=started"

[root@manger ~]# ansible webservers -m systemd -a "name=httpd state=reloaded"

[root@manger ~]# ansible webservers -m systemd -a "name=httpd state=restarted"

[root@manger ~]# ansible webservers -m systemd -a "name=httpd state==stopped"

[root@manger ~]# ansible webservers -m systemd -a "name=httpd state=started enabled=yes"

[root@manger ~]# ansible webservers -m file -a 'path=/data owner=www group=www mode="0755" state=directory recurse=yes'

[root@manger ~]# ansible webservers -m file -a 'path=/data/books owner=www group=www mode="0644" state=touch'

[root@manger ~]# ansible webservers -m group -a 'name=www gid=666 state=present'

[root@manger ~]# ansible webservers -m group -a 'name=mysqldb system=yes state=present'

[root@manger ~]# ansible webservers -m group -a "name=mysqldb state=absent"

[root@manager project]# ansible webservers -m user -a 'name=www uid=666 group=www shell=/sbin/nologin create_home=no'

[root@manager project]# ansible webservers -m user -a 'name=db group=root groups=adm,sys append=yes shell=/bin/bash create_home=yes'

[root@manager project]# ansible webservers -m user -a 'name=devops password=$6$salt$MUVhjPhKyI2uE9sPg7185PcBQFlDwLGPbVTx.CsD6GXQbRGsUfmjsSfb9e9ej2.vLgmBI5CtgFq1plbD0a6tM. shell=/bin/bash create_home=yes'

[root@manager project]# ansible webservers -m user -a 'name=dev generate_ssh_key=yes ssh_key_bits=2048 ssh_key_file=~/.ssh/id_rsa'

[root@manager ~]# ansible webservers -m user -a "name=db remove=yes state=absent"

[root@manager ~]# ansible 172.16.1.8 -m mount -a 'src=172.16.1.7:/data path=/opt fstype=nfs opts=defaults state=mounted'

[root@manager ~]# ansible webservers -m mount -a "src=172.16.1.61:/ops path=/opt fstype=nfs opts=defaults state=unmounted"

[root@manager ~]# ansible webservers -m mount -a "src=172.16.1.61:/ops path=/opt fstype=nfs opts=defaults state=absent"

[root@manager ~]# ansible webservers -m cron -a 'name="backups app data scripts" hour=03 minute=00 job="/bin/bash /scripts/client_push_data_server.sh &>/dev/null"'

[root@manager ~]# ansible webservers -m cron -a 'name="backups app data scripts" hour=03 minute=00 job="/bin/bash /scripts/client_push_data_server.sh &>/dev/null" state=absent'

[root@manager ~]# ansible webservers -m cron -a 'name="backups app data scripts" hour=03 minute=00 job="/bin/bash /scripts/client_push_data_server.sh &>/dev/null" disabled=yes'

[root@manager ~]# ansible webservers -m get_url -a 'url=http://fj.ixuyong.cn/config_vpn_new.zip dest=/tmp mode=0666'

[root@manager ~]# md5sum /tmp/config_vpn_new.zip

7107b0e2e01facb067842a6c4c7ffa31 /tmp/config_vpn_new.zip

[root@manager ~]# ansible webservers -m get_url -a 'url=http://fj.ixuyong.cn/config_vpn_new.zip dest=/opt mode=0666 checksum=md5:7107b0e2e01facb067842a6c4c7ffa31'

[root@manager ~]# ansible webservers -m archive -a 'path=/var/log dest=/opt/log.tar.gz format=gz'

[root@manager ~]# ansible webservers -m unarchive -a 'src=/root/php.zip dest=/tmp/'

[root@manager ~]# ansible webservers -m unarchive -a 'src=/log.tar.gz dest=/tmp/ remote_src=yes'

[root@manager ~]# ansible webservers -m selinux -a "state=enforcing"

[root@manager ~]# ansible webservers -m selinux -a "state=disabled"

[root@manager ~]# ansible webservers -m firewalld -a "service=http immediate=yes permanent=yes

state=enabled"

[root@manager ~]# ansible webservers -m firewalld -a "port=8080-8090/tcp immediate=yes permanent=yes

state=enabled"

[root@manager ~]# ansible webservers -m iptables -a 'table=filter chain=INPUT source=192.168.1.1/32 destination=1.1.1.1 destination_port=80 protocol=tcp jump=DROP action=insert'

[root@manager ~]# ansible webservers -m iptables -a 'table=nat chain=PREROUTING protocol=tcp destination=1.1.1.1 destination_port=80 jump=DNAT to_destination="2.2.2.2:8800"'

[root@manager ~]# ansible webservers -m iptables -a 'table=nat chain=PREROUTING protocol=tcp destination=1.1.1.1 destination_port=81 jump=DNAT to_destination="3.3.3.3:8800" action=insert'

[root@manager ~]# ansible webservers -m iptables -a 'table=nat chain=POSTROUTING source=172.16.2.0/24 jump=SNAT to_source=6.6.6.6'

[root@manager ~]# ansible webservers -m iptables -a 'table=nat chain=POSTROUTING source=172.16.3.0/24 jump=SNAT to_source=7.7.7.7 action=insert'

[root@manager ~]# ansible webservers -m yum_repository -a 'name=ansible_nginx description=nginx_yum baseurl="http://nginx.org/packages/centos/$releasever/$basearch/" gpgcheck=yes gpgkey="https://nginx.org/keys/nginx_signing.key"'

[root@manager ~]# ansible webservers -m hostname -a 'name=ansible-hostname'

[root@manager ~]# ansible webservers -m sysctl -a 'name=net.ipv4.ip_forward value=1 state=present'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/selinux/config regexp='^SELINUX='

line=SELINUX=disabled'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/httpd/conf/httpd.conf regexp="^Listen" line="Listen 8080"'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/sudoers regexp='^%wheel' state=absent'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/hosts regex='^127\.0\.0\.1' line="127.0.0.1 ansible.ixuyong.com"'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/sysconfig/network-scripts/ifcfg-eth1 line="GATEWAY=172.16.1.200"'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/sysconfig/network-scripts/ifcfg-eth1 insertafter="ONBOOT=yes" line="GATEWAY=172.16.1.200"'

[root@manager ~]# ansible webservers -m lineinfile -a 'path=/etc/sysconfig/network-scripts/ifcfg-eth1 insertbefore="ONBOOT=yes" line="test=172.16.1.200"'