学习记录： 安装配置自动化工具ansible

Posted 2020-09-17

学习记录：  安装配置ansible

更新日期: 2016-11-30

系统环境    ：centos6.5 本机ip        ：192.168.233.123 被管理机ip ：192.168.233.124 ————————————————————————————————————— py版本       ：   默认python2.6 ansible版本：ansible 1.7.2

ansible参数:             -m  模块名(执行命令)              -a  模块参数               -i  目录清单(/etc/ansible/hosts)               ansible-doc -l  显示所有自带模块

 1.安装相关模块

       (1)、setuptools模块安装

# wget https://pypi.python.org/packages/source/s/setuptools/setuptools-7.0.tar.gz --no-check-certificate # tar zvxf setuptools-7.0.tar.gz  # cd setuptools-7.0 # python setup.py install

       (2)、PyYAML模块安装

# wget http://pyyaml.org/download/libyaml/yaml-0.1.5.tar.gz   # tar zvxf yaml-0.1.5.tar.gz    # cd yaml-0.1.5   # ./configure --prefix=/usr/local/   # make && make install

# wget https://pypi.python.org/packages/source/P/PyYAML/PyYAML-3.11.tar.gz --no-check-certificate # tar zvxf PyYAML-3.11.tar.gz  # cd PyYAML-3.11 # python setup.py install

       (3)、Jinja2模块安装

# wget https://pypi.python.org/packages/source/J/Jinja2/Jinja2-2.7.3.tar.gz --no-check-certificate  # tar zvxf Jinja2-2.7.3.tar.gz  # cd Jinja2-2.7.3 # python setup.py install

       (4)、paramiko模块安装

# wget https://pypi.python.org/packages/source/p/paramiko/paramiko-1.15.1.tar.gz --no-check-certificate # tar zvxf paramiko-1.15.1.tar.gz  # cd paramiko-1.15.1 # python setup.py install

2.安装ansible

# wget http://releases.ansible.com/ansible/ansible-1.7.2.tar.gz #  tar zvxf ansible-1.7.2.tar.gz  # cd ansible-1.7.2/ # python setup.py install

3.配置免密钥登录

(1)生成秘钥

[[email protected] ~]# cd ~/.ssh/ [[email protected] .ssh]# ssh-keygen  Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa):    (保存路径空) Enter passphrase (empty for no passphrase):    (ssh密码空) Enter same passphrase again:     (ssh密码空)

        (2)将公钥传输到被管理机

[[email protected] .ssh]# ssh-copy-id -i /root/.ssh/id_rsa.pub [email protected]

        (3)测试免密钥登录

[[email protected] .ssh]# ssh [email protected] Last login: Wed Nov 23 10:09:58 2016 from 192.168.233.1 [[email protected] ~]# exit logout Connection to 192.168.233.124 closed.

4. 配置ansible

(1) 创建ansible目录，将生成的ansible.cfg、hosts 文件拷贝到此目录

[[email protected] ]# mkdir /etc/ansible/ [[email protected] ]# cd examples/ [[email protected] examples]# cp ansible.cfg hosts /etc/ansible/

         (2)设置环境变量

[[email protected] examples]# export ANSIBLE_SUDO_USER=root

         (3)修改配置文件相应参数 

[[email protected] examples]# cd /etc/ansible/ [[email protected] ansible]# vim ansible.cfg   14 inventory       = /etc/ansible/hosts  15 library        = /usr/share/ansible  18 forks          = 5  20 sudo_user      = root  24 remote_port    = 22  39 host_key_checking = False  48 timeout = 60  56 log_path = /var/log/ansible.log

         (4)查看版本

[[email protected] ansible]# ansible --version ansible 1.7.2

 5. 添加主机并测试

         (1) 添加host       

[[email protected] ansible]# vim hosts  ......省略以上 [test] 192.168.233.124

          (2)测试主机连通性

[[email protected] ansible]# ansible test -m ping 192.168.233.124 | success >> {     "changed": false,      "ping": "pong" }

• shell模块
  

[[email protected] ansible]# ansible test -m shell -a ‘/bin/echo hello ansible!‘ -i hosts  192.168.233.124 | success | rc=0 >> hello ansible!

• command模块
  

[[email protected] ansible]# ansible test -m command -a ‘/bin/echo hello ansible!‘ -i hosts   192.168.233.124 | success | rc=0 >> hello ansible!

• copy文件到.124主机
  

[[email protected] ansible]# ansible test -m copy -a "src=/root/history dest=/root mode=655" 192.168.233.124 | success >> {     "changed": true,      "dest": "/root/history",      "gid": 0,      "group": "root",      "md5sum": "2e88c32c0c8c54869253563dfcfb90e9",      "mode": "0655",      "owner": "root",      "path": "/root/history",      "secontext": "system_u:object_r:admin_home_t:s0",      "size": 78415,      "state": "file",      "uid": 0 }

• 修改所传文件history所属主
  

[[email protected] ansible]# ansible test -m file -a "path=/root/history owner=centos" 192.168.233.124 | success >> {     "changed": true,      "gid": 0,      "group": "root",      "mode": "0655",      "owner": "centos",      "path": "/root/history",      "secontext": "system_u:object_r:admin_home_t:s0",      "size": 78415,      "state": "file",      "uid": 1001 } ———————————————————————————————————— 被管理机：192.168.233.124 [[email protected] ~]# ls -l -rw-------. 1 root   root  1263 8月   9 18:01 anaconda-ks.cfg -rw-r-xr-x. 1 centos root 78415 11月 28 14:38 history

• 在存在的目录/test下创建新文件1.txt  [state 定义目标状态] 

[[email protected] ansible]# ansible test -m file -a "path=/test/1.txt state=directory" 192.168.233.124 | success >> {     "changed": true,      "gid": 0,      "group": "root",      "mode": "0755",      "owner": "root",      "path": "/test/1.txt",      "secontext": "unconfined_u:object_r:default_t:s0",      "size": 6,      "state": "directory",      "uid": 0 }

• 每五分钟同步一次时间
  

[[email protected] ansible]# ansible test -m cron -a "minute=‘*/5‘  job=‘/usr/sbin/ntpdate 192.168.233.123 &> /dev/null‘ name=‘sync time‘" 192.168.233.124 | success >> {     "changed": true,      "jobs": [         "sync time"     ] } ————————————————————————————————————— 被管理机：192.168.233.124 [[email protected] test]# crontab -l #Ansible: sync time */5 * * * * /usr/sbin/ntpdate 192.168.233.123 &> /dev/null

 6. 初写playbook

(1) playbook都以.yaml结尾

[[email protected] ~]# vim test.yaml  - hosts: test   remote_user: root   tasks:      - name: copy authorized_keys         copy: src=/root/.ssh/id_rsa.pub dest=/root/.ssh/authorized_keys      - name: restart iptables         service: name=iptables state=restarted      - name: iptables         shell: iptables -A INPUT -p icmp -j REJECT      - name: iptables         shell: iptables -A INPUT -p tcp -s 192.168.100.1 --dport 22 -j ACCEPT

(2) ansible-playbook 加上文件即可执行

[[email protected] ~]# ansible-playbook  test.yaml  PLAY [test] *******************************************************************  GATHERING FACTS ***************************************************************  ok: [192.168.233.124] TASK: [copy authorized_keys] **************************************************  changed: [192.168.233.124] TASK: [restart iptables] ******************************************************  changed: [192.168.233.124] TASK: [iptables] **************************************************************  changed: [192.168.233.124] TASK: [iptables] **************************************************************  changed: [192.168.233.124]

7. 使用playbook安装salt-minion

- hosts: test   remote_user: root     tasks:      - name: copy authorized_keys        template: src=~/.ssh/id_rsa.pub                 dest=/root/.ssh/authorized_keys      #    - name: iptables    ##将iptables11行对应内容替换 #        shell: sed -i ‘11s/REJECT/ACCEPT/‘ /etc/sysconfig/iptables               - name: backup        shell: cd /etc/yum.repos.d/ && mkdir bak && mv epel.repo yum.repo bak/      - name: Download epel        get_url: url=https://repo.saltstack.com/yum/redhat/salt-repo-latest-1.el6.noarch.rpm dest=/etc/yum.repos.d/salt-repo-latest-1.el6.noarch.rpm        - name: Install epel        shell: rpm -ivh /etc/yum.repos.d/salt-repo-latest-1.el6.noarch.rpm creates=/etc/yum.repos.d/salt.repo        - name: Clean cache        shell: yum clean all       - name:        shell: yum makecache         - name: Install salt-minion        yum: name=salt-minion state=latest         - name: copy salt conf file  (##拷贝的文件在本机创建好，并改好配置)        copy: src=/etc/ansible/files/minion dest=/etc/salt/minion        ## ALLOW RELATED,ESTABLISHED      - iptables: chain=INPUT ctstate=RELATED,ESTABLISHED jump=ACCEPT       ## ALLOW IP             - iptables: chain=INPUT in_interface=eth0 protocol=tcp match=tcp source=192.168.233.124 destination_port=22 jump=ACCEPT       ## REJECT icmp      - iptables: chain=INPUT in_interface=eth0 protocol=icmp jump=REJECT      - iptables: chain=FORWARD in_interface=eth0 protocol=icmp jump=REJECT           ## REJECT lo      - iptables: chain=INPUT in_interface=lo jump=ACCEPT      - name: save iptables        command: service iptables save      - name: iptables restart        shell: /etc/init.d/iptables restart

        

可登录到被管理机验证。

本文出自 “一个Linux小白-学习运维” 博客，请务必保留此出处http://zhaojia.blog.51cto.com/12886290/1923407