RHCE-B2. 创建和运行 Ansible 临时命令

Posted 2021-10-28 白-胖-子

红帽RHCE考试下午-RHCE（RH294）

RH294任务概览

• 考试时间4个小时，6台虚拟机，15道题
• 原来通过脚本或者集群做的题现在都需要使用playbook实现
• 考试时大概有6台虚拟服务器，都已经做好了互相的免密
• 做题在ansible控制节点workstation做，但是需要去其他虚拟服务器进行验证
• 考试时需要将6台虚拟服务器在考试环境全部开启，物理机界面点击左侧按钮启动
• 考试时Ansible所有playbook都放在普通用户目录中且都以普通用户执行

1. 注意：考试时一定注意要求将playbook放在指定用户的家目录中，用指定的用户登录做题！
2. 注意：考试的判分方式通过普通用户远程执行指定目录下的playbook或者脚本，如果使用root做题，则没有权限就是零分

2. 创建和运行 Ansible 临时命令

• 作为系统管理员, 您需要在受管节点上安装软件.
• 请按照下方所述, 创建一个名为/home/student/ansible/adhoc.sh 的 shell 脚本,
• 该脚本将使用Ansible 临时命令在各个受管节点上安装 yum 存储库:
• 说白了就是用ansible命令配置yum源

任务要求

1. 存储库 1: 存储库的名称为 rh294_BASE
   描述为 rh294 base software
   存储库为开启状态
   基础URL 为 http://content.example.com/rhel8.0/x86_64/dvd/BaseOS
   GPG 签名检查为启用状态
   GPG 密钥 URL 为 http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
2. 存储库 2: 存储库的名称为 rh294_STREAM
   描述为 rh294 stream software
   存储库为开启状态
   基础URL 为 http://content.example.com/rhel8.0/x86_64/dvd/AppStream
   GPG 签名检查为启用状态
   GPG 密钥 URL 为 http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
   注意：

准备个工作

• 因为虚拟机自带 yum 源, 需要先删除, 考试时不需要操作 （可选）

[root@workstation ~]# for i in server{a..d} bastion
> do
> ssh root@$i "rm -rf /etc/yum.repos.d/*"
> done
[root@workstation ~]# su - student
[student@workstation ~]$ cd ansible/

完成步骤

• 先用ansible-doc命令搜索查看yum_repository模块的用法
  ansible-doc -l | grep yum

ansible-doc yum_repository
:/EXA #在：模式下按斜杠/，再后边输入EXA进行搜索到例子

• 在用ansible all -m yum_repository -a "<内容>"测试配置的yum仓库是否能用
  注意：第一个库和第二个库的内容基本都是一样的，就是链接和描述不太一样，注意着改一下
• 最后再将测试成功的命令写到脚本中

[student@workstation ansible]$ vim adhoc.sh 
#!/bin/bash
ansible all -m yum_repository -a "name=rh294_BASE description='rh294 base software' file=rhel_dvd baseurl=http://content.example.com/rhel8.0/x86_64/dvd/BaseOS gpgcheck=yes gpgkey=http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release enabled=yes"
ansible all -m yum_repository -a "name=rh294_STREAM description='rh294 stream software' file=rhel_dvd baseurl=http://content.example.com/rhel8.0/x86_64/dvd/AppStream gpgcheck=yes gpgkey=http://content.example.com/rhel8.0/x86_64/dvd/RPM-GPG-KEY-redhat-release enabled=yes
[student@workstation ansible]$ chmod +x adhoc.sh

注意：描述中间是有空格的，需要用单引号给引起来。

• 执行脚本

[student@workstation ansible]$./adhoc.sh

• 检查验证

for i in server{a..d} bastion
do ssh root@$i "cat /etc/yum.repos.d/rhel_dvd.repo"
done

注意：没做一道题都要验证一下子，到受控节点上装个软件试试看呗

考察的知识点

Ansible的yum_repository 模块

• 利用yum_repository 模块可以对受控主机进行yum源配置
  创建仓库

- name: Add repository
  yum_repository:
    name: epel
    description: EPEL YUM repo
    baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/

- name: Add multiple repositories into the same file (1/2)
  yum_repository:
    name: epel
    description: EPEL YUM repo
    file: external_repos
    baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/
    gpgcheck: no

- name: Add multiple repositories into the same file (2/2)
  yum_repository:
    name: rpmforge
    description: RPMforge YUM repo
    file: external_repos
    baseurl: http://apt.sw.be/redhat/el7/en/$basearch/rpmforge
    mirrorlist: http://mirrorlist.repoforge.org/el7/mirrors-rpmforge
    enabled: no

删除仓库

# Example removing a repository and cleaning up metadata cache
- name: Remove repository (and clean up left-over metadata)
  yum_repository:
    name: epel
    state: absent
  notify: yum-clean-metadata

- name: Remove repository from a specific repo file
  yum_repository:
    name: epel
    file: external_repos
    state: absent

• 常用参数

- baseurl
        URL to the directory where the yum repository's 'repodata' directory lives.
        It can also be a list of multiple URLs.
        This, the `metalink' or `mirrorlist' parameters are required if `state' is set to `present'.
        [Default: (null)]
- description
        A human readable string describing the repository. This option corresponds to the "name" property in the repo file.
        This parameter is only required if `state' is set to `present'.
        [Default: (null)]
- enabled
        This tells yum whether or not use this repository.
        [Default: yes]
        type: bool
- gpgcheck
        Tells yum whether or not it should perform a GPG signature check on packages.
        No default setting. If the value is not set, the system setting from `/etc/yum.conf' or system default of `no' will be used.
        [Default: (null)]
        type: bool

- gpgkey
        A URL pointing to the ASCII-armored GPG key file for the repository.
        It can also be a list of multiple URLs.
        [Default: (null)]
= name
        Unique repository ID. This option builds the section name of the repository in the repo file.
        This parameter is only required if `state' is set to `present' or `absent'.