Linux中ansible自动化运维工具

Posted 2021-01-05

1.ansible简介
ansible是一款自动化运维工具，基于Python开发，集合了众多运维工具（puppet,cfengine,chef,func,fabric）的优点，实现了批量系统配置，批量 程序部署，批量运行命令等功能。
ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
（1）连接插件connection plugins：负责和被监控端实现通信；
（2）host inventory:指定操作的主机，是一个配置文件里面定义监控的主机；
（3）各种模块核心模块，command模块，自定义模块；
（4）借助于插件完成记录日志邮件等功能；
（5）playbook: 剧本执行多个任务时，非必须可以让节点一次性运行多个任务。

---

2.ansible架构图：

---

3.ansible配置
配置文件 说明
/etc/ansible/ansible.cfg ansible主配置文件
/etc/ansible/hosts 受控主机清单
受控主机清单配置方式：
分组配置
ip配置
域名配置
通配符配置
ansible通过ssh来控制远程主机，所以要配置ssh互信，否则将会提示你输入密码。

---

4.ansible常用模块使用详解
ansible常用模块有：
ping
yum
template
copy
user
group
service
raw
command
shell
script
ansible常用模块raw,command,shell的区别：
shell模块调用的/bin/sh指令执行
command模块不是调用的shell的指令，所有没有bash的环境变量
raw很多地方和 shell类似，更多的地方建议使用shell和command模块。但是如果是使用老版本python，需要用到raw,又或者是客户端是路由器，因为没有安装python模块，那就需要使用raw模块了

---

5.环境说明：

服务器	IP
ansible服务器	192.168.209.12
受控服务器	192.168.209.13

   //添加受控主机
[[email protected] ~]# vim /etc/ansible/hosts 
【lanzhiyong】
192.168.209.13

//互信秘钥
[[email protected] ~]# ssh-keygen -t rsa    
[[email protected] ~]# ssh-copy-id 192.168.209.13

---

6.ansible安装

//配置yum源
[[email protected] ~]# cd /etc/yum.repos.d/
[[email protected] yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo   
[[email protected] yum.repos.d]# sed -i ‘s/$releasever/7/g‘ /etc/yum.repos.d/163.repo 
[[email protected] yum.repos.d]# sed -i ‘s/^enabled=.*/enabled=1/g‘ /etc/yum.repos.d/163.repo 
[[email protected] ~]# yum -y install epel-release
[[email protected] ~]# yum -y install ansible ansible-doc
[[email protected] ~]# ansible --version
ansible 2.6.3
         config file = /etc/ansible/ansible.cfg
         configured module search path = [u‘/root/.ansible/plugins/modules‘, u‘/us r/share/ansible/plugins/modules‘]
         ansible python module location = /usr/lib/python2.7/site-packages/ansible 
                     executable location = /usr/bin/ansible 
                     python version = 2.7.5 (default, May 3 2017, 07:55:04) [GCC 4.8.5 201506
23 (Red Hat 4.8.5-14)]

---

7.ansible如何获取帮助
ansible通过ansible-doc命令来获取帮助信息，可以使用此命令的-s选项来获取指定模块的帮助信息。
//查询ping模块的帮助文档

[[email protected] ~]# ansible-doc -s ping
- name: Try to connect to host, verify a usable python and return `pong‘ on success
ping:
       data:                  # Data to return for the `ping‘ return value. If this
                                    parameter is set to 
                                   `crash‘, the module will
                                    cause an
                                    exception.

---

8.ansible常用模块之ping
ping模块用于检查指定节点机器是否连通，用法很简单，不涉及参数，主机如果在线。则回复pong

[[email protected] ~]# ansible lanzhiyong -m ping
192.168.209.13 | SUCCESS => {
          "changed": false,
          "ping": "pong"
 }

---

9.ansible常用模块之command
command模块用于在远程主机上执行命令，ansible默认就是使用command模块。
command模块有一个缺陷就是不能使用管道符合重定向功能。

//查看受控主机的/tmp目录内容
[[email protected] ~]# ansible lanzhiyong -a ‘ls /tmp‘
192.168.209.13 | SUCCESS | rc=0 >>
ansible_oUl4es
bad-blocks.txt
crontab.c055Bo
file1
systemd-private-8499d6b3f392482c9040befd22b10899-vgauthd.service-7NpBZS
systemd-private-8499d6b3f392482c9040befd22b10899-vmtoolsd.service-E69SWb

//在受控主机的/tmp目录下新建一个文件test
[[email protected] ~]# ansible lanzhiyong -a ‘touch /tmp/test‘
[WARNING]: Consider using the file module with state=touch rather than running touch.  If you
need to use command because file is insufficient you can add warn=False to this command task or
set command_warnings=False in ansible.cfg to get rid of this message.
192.168.209.13 | SUCCESS | rc=0 >>

 //command模块不支持管道符，不支持重定向
[[email protected] ~]# ansible lanzhiyong -a ‘echo "I Love china" > /tmp/test‘
192.168.209.13 | SUCCESS | rc=0 >>
I Love china > /tmp/test
[[email protected] ~]# ansible lanzhiyong -a ‘cat /tmp/test‘
192.168.209.13 | SUCCESS | rc=0 >>
[[email protected] ~]# ansible lanzhiyong -a ‘ps -ef|grep ssh‘
192.168.209.13 | FAILED | rc=1 >>
error: unsupported SysV option
Usage:
    ps [options]
    Try ‘ps --help <simple|list|output|threads|misc|all>‘
       or ‘ps --help <s|l|o|t|m|a>‘
    for additional help text.
For more details see ps(1).non-zero return code

---

10.ansible常用模块之raw
raw模块用于在远程主机上执行命令，其支持管道符与重定向

//支持重定向
[[email protected] ~]# ansible lanzhiyong -m raw -a ‘echo "I Love china" > /tmp/test‘
192.168.209.13 | SUCCESS | rc=0 >>
Shared connection to 192.168.209.13 closed.
[[email protected] ~]# ansible lanzhiyong -a ‘cat /tmp/test‘
192.168.209.13 | SUCCESS | rc=0 >>
I Love china

//支持管道符
[[email protected] ~]# ansible lanzhiyong -m raw -a ‘ps -ef|grep ssh‘
192.168.209.13 | SUCCESS | rc=0 >>
root       3287      1  0 07:54 ?        00:00:00 /usr/sbin/sshd -D
root       7688   3287  0 14:07 ?        00:00:00 sshd: [email protected]/1
root       8461   3287 23 16:40 ?        00:00:00 sshd: [email protected]/0
root       8464   8461  0 16:40 pts/0    00:00:00 bash -c ps -ef|grep ssh
root       8476   8464  0 16:40 pts/0    00:00:00 grep ssh
Shared connection to 192.168.209.13 closed.

---

11.ansible常用模块之shell
shell模块用于在受控上执行受控机上的脚本，亦可直接在受控机上执行命令
shell模块亦支持管道与重定向

//查看受控机上的脚本
[[email protected] ~]# mkdir /scripts
[[email protected] ~]# vim /scripts/test.sh
#!/bin/bash
for i in $(seq 10);do
           echo $i
done
[[email protected] ~]# ll /scripts/
总用量 4
-rw-r--r--. 1 root root 49 9月  10 16:53 test.sh

//使用shell模块在ansible主服务器上执行受控服务器上 的脚本
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘/bin/bash /scripts/test.sh‘
192.168.209.13 | SUCCESS | rc=0 >>
1
2
3
4
5
6
7
8
9
10

---

12.ansible常用模块之script
script模块用于在受控机上执行ansible主控机上的脚本

[[email protected] ~]# mkdir /scripts
[[email protected] ~]# vim /scripts/lan.sh
#!/bin/bash
for i in $(cat /etc/passwd);do
          echo $i
          echo ‘---------------‘
done
[[email protected] ~]# ansible lanzhiyong -m script -a ‘/scripts/lan.sh &> /tmp/lan‘
192.168.209.13 | SUCCESS => {
          "changed": true,
          "rc": 0,
          "stderr": "Shared connection to 192.168.209.13 closed.
",
          "stderr_lines": [
                  "Shared connection to 192.168.209.13 closed."
          ],
           "stdout": "",
           "stdout_lines": []
   }

//查看受控机上的/tmp/lan文件是否存在
[[email protected] ~]# ansible lanzhiyong -a ‘cat /tmp/lan‘
192.168.209.13 | SUCCESS | rc=0 >>
root:x:0:0:root:/root:/bin/bash
---------------
bin:x:1:1:bin:/bin:/sbin/nologin
---------------
daemon:x:2:2:daemon:/sbin:/sbin/nologin
---------------
adm:x:3:4:adm:/var/adm:/sbin/nologin
---------------
………………此处省略

---

13.ansible常用模块之template
template模块用于生成一个模块，并可将其传输至远程主机上

//下载一个163的yum源文件并开启此源
[[email protected] ~]# cd /etc/yum.repos.d/
[[email protected] yum.repos.d]# curl -o 163.repo http://mirrors.163.com/.help/CentOS7-Base-163.repo 
[[email protected] yum.repos.d]# sed -i ‘s/$releasever/7/g‘ /etc/yum.repos.d/163.repo 
[[email protected] yum.repos.d]# sed -i ‘s/^enabled=.*/enabled=1/g‘ /etc/yum.repos.d/163.repo 

//将设置好的163源传到受控主机
[[email protected] ~]# ansible lanzhiyong -m template -a ‘src=/etc/yum.repos.d/163.repo dest=/etc/yum.repos.d/163.repo‘

//查看受控机上是否有163源
[[email protected] ~]# ls /etc/yum.repos.d/
163.repo  lanzhiyong.repo

---

14.ansible常用模块之yum
yum模块用于在指定节点机器上通过yum管理软件，其支持的参数主要有两个
name:要管理的包名
state：要进行的操作
state常用的值：
latest:安装软件
installed:安装软件
present:安装软件
removed:卸载软件
absent:卸载软件
若想使用yum来管理软件，请确保受控机上的yum源无异常。

//在受控机上查询看vsftpd软件是否安装
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘rpm -qa|grep vsftpd‘
[WARNING]: Consider using the yum, dnf or zypper module rather than running rpm.  If you need
to use command because yum, dnf or zypper is insufficient you can add warn=False to this
command task or set command_warnings=False in ansible.cfg to get rid of this message.
192.168.209.13 | FAILED | rc=1 >>
non-zero return code

//在ansible主机上使用yum模块在受控机上安装vsftpd
[[email protected] ~]# ansible lanzhiyong -m yum -a ‘name=vsftpd state=present‘
192.168.209.13 | SUCCESS => {
            "changed": true,
            "msg": "",
            "rc": 0,
            "results": [

//查看受控机是否安装了vsftpd
[[email protected] ~]# rpm -qa|grep vsftpd
vsftpd-3.0.2-22.el7.x86_64

---

15.ansible常用模块之copy
copy模块用于复制文件之远程受控机

[[email protected] ~]# ls /etc/ansible/scripts/
a.sh
[[email protected] ~]# ansible lanzhiyong -m copy -a ‘src=/etc/ansible/scripts/a.sh dest=/scripts/‘
192.168.209.13 | SUCCESS => {
         "changed": false,
         "checksum": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
         "dest": "/scripts/a.sh",
         "gid": 0,
         "group": "root",
         "mode": "0644",
         "owner": "root",
         "path": "/scripts/a.sh",
         "secontext": "system_u:object_r:default_t:s0",
         "size": 0,
         "state": "file",
         "uid": 0
 }

//查看受控机是否复制过去了
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘ls /scripts‘
192.168.209.13 | SUCCESS | rc=0 >>
a.sh
test.sh

---

16.ansible常用模块之group
group模块用于在受控机上添加或删除组

//在受控机上添加系统组，其gid为306，组名为mysql
[[email protected] ~]# ansible lanzhiyong -m group -a ‘name=mysql system=yes gid=306 state=present‘
192.168.209.13 | SUCCESS => {
        "changed": false,
        "gid": 306,
        "name": "mysql",
        "state": "present",
        "system": true
}
[[email protected] ~]# ansible lanzhiyong -a ‘grep mysql /etc/group‘
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:306:

//删除受控机上的mysql组
[[email protected] ~]# ansible lanzhiyong -m group -a ‘name=mysql state=absent‘
192.168.209.13 | SUCCESS => {
       "changed": false,
       "name": "mysql",
       "state": "absent"
 }
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘grep mysql /etc/group‘
192.168.209.13 | FAILED | rc=1 >>
non-zero return code

---

17.ansible常用模块之user
user 模块用于管理受控机的用户账号

//在受控机上添加一个系统用户，用户名为mysql，uid为306，设置其shell为/sbin/nologin，无家目录
[[email protected] ~]# ansible lanzhiyong -m user -a ‘name=mysql uid=306 system=yes create_home=no shell=/sbin/nologin state=present‘
192.168.209.13 | SUCCESS => {
        "changed": true,
        "comment": "",
        "create_home": false,
        "group": 306,
        "home": "/home/mysql",
        "name": "mysql",
        "shell": "/sbin/nologin",
        "state": "present",
        "system": true,
        "uid": 306
}
[[email protected] ~]# ansible lanzhiyong -m shell-a ‘grep mysql /etc/passwd‘
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:306:306::/home/mysql:/sbin/nologin

//修改mysql用户uid为386
[[email protected] ~]# ansible lanzhiyong -m user -a ‘name=mysql uid=386‘
192.168.209.13 | SUCCESS => {
         "append": false,
         "changed": true,
         "comment": "",
         "group": 306,
         "home": "/home/mysql",
         "move_home": false,
         "name": "mysql",
         "shell": "/sbin/nologin",
         "state": "present",
         "uid": 386
}
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘grep mysql /etc/passwd‘
192.168.209.13 | SUCCESS | rc=0 >>
mysql:x:386:306::/home/mysql:/sbin/nologin

//删除受控机上的mysql用户
[[email protected] ~]# ansible lanzhiyong -m user -a ‘name=mysql state=absent‘
192.168.209.13 | SUCCESS => {
       "changed": true,
       "force": false,
       "name": "mysql",
       "remove": false,
       "state": "absent"
}
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘grep mysql /etc/passwd‘
192.168.209.13 | FAILED | rc=1 >>
non-zero return code

---

18.ansible常用模块之service
service 模块用于管理受控机上的服务

 //查看受控机上的vsftpd服务是否启动
[[email protected] ~]#  ansible lanzhiyong -m shell -a ‘systemctl is-active vsftpd‘
192.168.209.13 | FAILED | rc=3 >>
 unknownnon-zero return code

//启动受控机上的vsftpd服务
[[email protected] ~]# ansible lanzhiyong -m service -a ‘name=vsftpd state=started‘
192.168.209.13 | SUCCESS => {
        "changed": true,
        "name": "vsftpd",
        "state": "started",
        "status": {
                    "ActiveEnterTimestampMonotonic": "0",
                      ……此处省略

    //查看受控机上的vsftpd服务是否启动
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘systemctl is-active vsftpd‘
192.168.209.13 | SUCCESS | rc=0 >>
active

//查看受控机上的vsftpd服务是否开机自动启动
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘systemctl is-enabled vsftpd‘
192.168.209.13 | SUCCESS | rc=0 >>
enabled

//设置受控机上的vsftpd服务开机自动启动
[[email protected] ~]# ansible lanzhiyong -m service -a ‘name=vsftpd enabled=yes‘
192.168.209.13 | SUCCESS => {
        "changed": false,
         "enabled": true,
         "name": "vsftpd",
         "status": {
                  "ActiveEnterTimestamp": "一 2018-09-10 19:43:22 CST",

//停止受控机上的vsftpd服务
[[email protected] ~]# ansible lanzhiyong -m service -a ‘name=vsftpd state=stopped‘
192.168.209.13 | SUCCESS => {
        "changed": true,
        "name": "vsftpd",
        "state": "stopped",
        "status": {
        "ActiveEnterTimestamp": "一 2018-09-10 19:43:22 CST",

//查看是否停止vsftpd服务
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘systemctl is-active vsftpd‘
192.168.209.13 | FAILED | rc=3 >>
inactivenon-zero return code
[[email protected] ~]# ansible lanzhiyong -m shell -a ‘ss -antl‘
192.168.209.13 | SUCCESS | rc=0 >>
State      Recv-Q Send-Q Local Address:Port               Peer Address:Port
LISTEN     0      128          *:111                      *:*
LISTEN     0      128          *:22                       *:*
LISTEN     0      64           *:40154                    *:*
LISTEN     0      64           *:2049                     *:*
LISTEN     0      128         :::111                     :::*
LISTEN     0      128         :::22                      :::*
LISTEN     0      64          :::2049                    :::*