Use Ansible make your system management automation
https://linux.cn/article-9331-1.html
| 2018-02-10 12:11 Favorite: 4
Sophisticated system management capabilities and your Linux skills and learn how to set up tools to simplify the management of multiple machines.
Do you want to brush up on your Linux system management capabilities and skills? Maybe run something on your local network, and you want to live a little easier - that's how to do it? In this article, I will show you how to set up tools to simplify the management of multiple machines.
There are a lot of remote management tools, SaltStack, Puppet, Chef, and Ansible are very popular choice. In this article, I will focus on Ansible and explain how it is to help you, whether you have five or 1,000 virtual machines.
Let's multi-machine (whether these machines are virtual or physical) of the basic management began. I assume you know what to do with the foundation of Linux administration skills (at least to have the ability to perform each task can find specific steps). I will show you how to use this tool, but whether it is up to you.
What is Ansible?
Ansible will explain the site as "a super simple IT automation engine, can be automatically fed cloud, configuration management, application deployment, service interior layout, as well as many other IT needs." By the set in a central position well defined server , Ansible can perform the same tasks on multiple servers.
If you Bash's for circulation is very familiar with, you will find Ansible operation is very similar with this. The difference is that Ansible curtain is like idempotent. Popular, Ansible is generally only perform the requested action if you actually change. For example, suppose you run a Bash for loop to create multiple user machines, like this:
for server in serverA serverB serverC; do ssh ${server} "useradd myuser"; done
This creates on serverA, serverB, and serverC myuser user; however, regardless of whether the user exists, will be executed each time you run the for loop useradd command. A screen, such as the system will first check if the user exists only in the absence of the will to create it. Of course, this example is very simple, but the benefits of tools such as curtain will over time become more and more apparent.
How Ansible works?
Ansible will Ansible playbooks converted into a command run by SSH, which has many advantages in the management of UNIX-like environment:
- The vast majority of UNIX-like machines are opened by default SSH.
- SSH remote host does not need to rely on proxy means.
- All without having to install additional software in most cases, Ansible need 2.6 or later Python. The vast majority of Linux distributions are the default version (or later) of Python installed.
- Ansible do not need to master. He can run on any host computer equipped with Ansible and through SSH access.
- Although you can run from cron Ansible, but by default, Ansible will run without your explicit requirements.
Configuring SSH key authentication
One common method is to use Ansible do not need to configure SSH key login password in order to facilitate management. (Ansible Vault can be used to provide protection for sensitive information such as passwords, but this is beyond the scope of this article). Now only need to use the following command to generate a SSH keys, as shown in Example 1.
[09:44 user ~]$ ssh-keygenGenerating public/private rsa key pair。Enter file in which to save the key (/home/user/.ssh/id_rsa):Created directory '/home/user/.ssh'。Enter passphrase (empty for no passphrase):Enter same passphrase again:Your identification has been saved in /home/user/.ssh/id_rsa。Your public key has been saved in /home/user/.ssh/id_rsa.pub。The key fingerprint is:SHA256:TpMyzf4qGqXmx3aqZijVv7vO9zGnVXsh6dPbXAZ+LUQ user@user-fedoraThe key's randomart image is:+---[RSA 2048]----+| || || E || o . .。|| . + S o+。|| . .o * . .+ooo|| . .+o o o oo+。*||。.ooo* o。* .*+|| . o+*BO.o+ .o|+----[SHA256]-----+
Example 1: SSH key to generate a
In Example 1, a direct press Enter to accept the default. Any non-privileged users can generate an SSH key to the remote system can be installed in any user's SSH authorized_keys file. After generating the keys, it also needs to be copied to the remote host up, run the following command:
ssh-copy-id root@servera
Note: do not need root privileges to run Ansible itself; however, if you use a non-root user, you need to configure the appropriate permissions sudo for the task to be performed.
Servera enter the root password, this command will install your SSH key to the remote host up. After installing the SSH keys, and then through the SSH login remote host will no longer need to enter the root password.
Installation Ansible
Ansible mounted on that host needs SSH key generation in the example 1. If you are using Fedora, enter the following command:
sudo dnf install ansible -y
If you are running CentOS, you need to configure additional package for EPEL Warehouse:
sudo yum install epel-release -y
Then use yum to install Ansible:
sudo yum install ansible -y
For Ubuntu based systems can be installed from the Ansible PPA:
sudo apt-get install software-properties-common -ysudo apt-add-repository ppa:ansible/ansiblesudo apt-get updatesudo apt-get install ansible -y
If you are using macOS, it is recommended to install by Python PIP:
sudo pip install ansible
For other distributions, see Ansible installation documentation .
Ansible Inventory
Ansible use an INI style file to track the server to be managed, this file is called inventory Inventory. By default, this file is located /etc/ansible/hosts. In this paper, I use the example shown in the inventory Ansible 2 to operate the required host (for brevity has been cut):
[arch]nextcloudprometheusdesktop1desktop2vm-host15[fedora]netflix[centos]conanconfluence7-repovm-server1gitlab[ubuntu]trusty-mirrornwnkids-tvmedia-centrenas[satellite]satellite[ocp]lb00ocp_dnsmaster01app01infra01
Example 2: Ansible host file
Each packet identification and group names enclosed within brackets (like this [group1] ), is applied to a group of any group name server. A server can exist in more than one group, no problem. In this case, I have a packet of the operating system ( arch, , ubuntu, centos), fedorabut also packet based server function ( ocp, satellite). Ansible host file can handle more complex than this case. For details, please refer to the inventory documents .
Run command
After your SSH keys copied to all servers in the inventory list, you can start using the Ansible. Ansible a basic function is to run a specific command. The syntax is:
ansible -a "some command"
For example, suppose you want to upgrade all of CentOS server, you can run:
ansible centos -a 'yum update -y'
Note: It is not necessary to be grouped according to the server operating system. I will mention below, Ansible Facts can be used to collect this information; however, the use of Facts, then run specific commands will become very complicated, so if you manage a heterogeneous environment, then for the sake of convenience, I Some recommend created the operating system to divide the group.
It will traverse centos all servers in the group and install all updates. A more useful commands should be Ansible of the ping module, and can be used to verify that the server is ready to accept commands:
ansible all -m ping
This will make Ansible try to log inventory of all servers in via SSH. 3 can be seen in the example ping command output section.
nwn | SUCCESS => {"changed":false，"ping":"pong"}media-centre | SUCCESS => {"changed":false，"ping":"pong"}nas | SUCCESS => {"changed":false，"ping":"pong"}kids-tv | SUCCESS => {"changed":false，"ping":"pong"}...
Example 3: Ansible ping command output
The ability to run the specified command helps to quickly complete the task (LCTT Annotation: should refer to the kind of one-time task), but also in the future if I want to run the same tasks in the same way that how to do it? Ansible playbooks is used to do this.
Complex tasks Ansible playbooks
Ansible play playbook is YAML file format contains Ansible instructions. I'm not going to explain these relatively similar Roles and Templates profound content. Are interested, please read Ansible document .
In the previous chapter, I recommend that you use the ssh-copy-id command to transfer your SSH keys; however, this article focuses on how a consistent, repeatable way to accomplish the task. 4 shows one example of offerings like manner, even if the SSH key already exists on the target host can ensure the correctness of the implementation.
---- hosts:allgather_facts:falsevars:ssh_key:'/root/playbooks/files/laptop_ssh_key'tasks:- name:copy ssh keyauthorized_key:key:"{{ lookup('file'，ssh_key) }}"user:root
Example 4: Ansible Script "push ssh keys.yaml"
- hosts: Line identifies the play should be performed on the host group. In this example, it checks the inventory in all hosts.
gather_facts: Whether line indicates Ansible to search for detailed information on each host. I will do a more detailed check again later. Now in order to save time, we set gather_facts to false.
vars: Part, by definition, the script is used to define the variables used. In this brief example 4, the script is not really necessary, but traditionally we set a variable.
Finally, the tasks: mark of this section, is the main place to store instructions. Each task has a -name:. Ansbile this name will be displayed when you run the script.
authorized_key: The script is used Ansible module name. Can command ansible-doc -a to query relevant information Ansible module; but viewed through a web browser documentation may be more convenient. authorized_key module has many good reference examples. To run the example 4 script, just run ansible-playbook the command on the line:
ansible-playbook push_ssh_keys.yaml
If this is the first time to add SSH keys, SSH will prompt you to enter the root password.
Now SSH key has been transmitted to the server to go, you can do something interesting happened.
Use Ansible collect information
Ansible be able to collect all kinds of information about the target system. If many of your number of hosts, that it will be particularly time-consuming. According to my experience, each host will probably take a 1-2 seconds, or even longer; however, sometimes collecting information is good. Consider this script, it disables the root user password remotely log into the system:
---- hosts:allgather_facts:truevars:tasks:- name:Enabling ssh-key only root accesslineinfile:dest:/etc/ssh/sshd_configregexp:'^PermitRootLogin'line:'PermitRootLogin without-password'notify:- restart_sshd- restart_sshhandlers:- name:restart_sshdservice:name:sshdstate:restartedenabled:truewhen:ansible_distribution == 'RedHat'- name:restart_sshservice:name:sshstate:restartedenabled:truewhen:ansible_distribution == 'Debian'
Example 5: Lock SSH root access
In Example 5, sshd_config modify the file there is a condition , and that's only done in the case of a match is found in the release. In this case, Red Hat-based distributions based on Debian release naming SSH service is not the same, this is also where the purpose of the use of conditional statements. Although there are other ways to achieve the same effect, but this is a good example demonstrates the effect of Ansible information. If you want to see all the information collected Ansible default, you can run locally setup modules:
ansible localhost -m setup |less
All information gathered can be used for Ansible judgment, just like the example 4 vars: as part of the presentation. The difference is, Ansible information is seen as built-in variables without defined by the system administrator.
One step closer
You can now begin to explore and create their own basic Ansible a. Ansible is a rich depth, complexity and flexibility of the tool, an article alone can not put it thoroughly publicize. Hopefully this article can arouse your interest and encourage you to explore the Ansible function. In the next article, I will talk about Copy, systemd, service, apt, yum, virt, and user modules. We can combine these modules in the script, you can also create a simple Git server to store all of these scripts.