Ansible batch management automation tools
1 Ansible Introduction
About 1.1 ansible
- Batch management server tools
- No need to deploy the agent, managed by ssh
- Operation and maintenance of popular automation tool: https: //github.com/ansible/ansible
1.2 Checking the installation environment
[root@ansible ~]# cat /etc/redhat-release
CentOS Linux release 7.7.1908 (Core)
[root@ansible ~]# uname -r
3.10.0-1062.4.3.el7.x86_64
#python版本需要2.6以上，不过通过centos7都会默认安装上python2.7.5
[root@ansible ~]# python -V
Python 2.7.52 configuration to achieve public and private key ssh without password
- ansible is no agent, the agent is not how batch management server? Mainly borrowed ssh to batch management server.
- ssh default login password is required, so that management is too much trouble, this lesson is to introduce the ssh without password.
- ssh without password realized later, using ansible batch management server becomes simple
| CPU name | IP |
|---|---|
| ansible | 192.168.200.27 |
| web01 | 192.168.200.28 |
| web02 | 192.168.200.29 |
2.1 generate a key pair
[root@ansible ~]# ssh-keygen -t rsa -f ~/.ssh/id_rsa -P ""
Generating public/private rsa key pair.
Created directory '/root/.ssh'.
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:g2QJQiBD4PRiGYf1ARed89NGH4CnceXzRP/VCJEJq9w root@ansible
The key's randomart image is:
+---[RSA 2048]----+
|B*=+o+o . oo== . |
|+o=.o..= o =+o..o|
| = . .+ o O .oo.+|
|. . o o * o .+ o|
| . S E ..|
| . |
| |
| |
| |
+----[SHA256]-----+2.2 respectively distribute keys to the Web01 and Web02
[root@ansible ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub "-o StrictHostKeyChecking=no" 192.168.200.28
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 123.123
Number of key(s) added: 1
Now try logging into the machine, with: "ssh -o ' StrictHostKeyChecking=no' '192.168.200.28'"
and check to make sure that only the key(s) you wanted were added.2.3 be password-free login test
[root@ansible ~]# hostname -I
192.168.200.27
[root@ansible ~]# ssh 192.168.200.28
Last login: Sun Dec 22 18:28:34 2019 from 192.168.200.1
[root@web01 ~]# hostname -I
192.168.200.28 3. Install Ansible
yum install 3.1 ansible software
[root@ansible ~]# yum -y install ansible
#查看ansible的版本
[root@ansible ~]# ansible --version
ansible 2.4.2.0
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Aug 7 2019, 00:51:29) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)]3.2 Modifying ansible profile (single node)
[root@ansible ~]# cd /etc/ansible/
[root@ansible ansible]# vim hosts
[root@ansible ansible]# cat hosts
[Web01]
192.168.200.28
[Web02]
192.168.200.293.3 ansible execute commands remotely test
[root@ansible ansible]# ansible Web01 -m ping
192.168.200.28 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible ansible]# ansible Web02 -m ping
192.168.200.29 | SUCCESS => {
"changed": false,
"ping": "pong"
}[root@ansible ansible]# ansible Web01 -a "uname -r"
192.168.200.28 | SUCCESS | rc=0 >>
3.10.0-1062.el7.x86_643.4 ansible modify configuration files (multi-node)
[root@ansible ansible]# vim hosts
[root@ansible ansible]# tail -3 hosts
[all]
192.168.200.28
192.168.200.293.5 ansible carried out remotely execute commands test
[root@ansible ansible]# ansible all -a "uname -r"
192.168.200.28 | SUCCESS | rc=0 >>
3.10.0-1062.el7.x86_64
192.168.200.29 | SUCCESS | rc=0 >>
3.10.0-1062.4.3.el7.x86_644. Ansible command module
4.1 ansible module command (does not support the pipeline does not support redirection, not recommended)
Parameters -m: module name
parameter -a: directly with the command (Command is not supported)
#command支持直接回显命令的执行结果
[root@ansible ~]# ansible all -m command -a "pwd"
192.168.200.28 | SUCCESS | rc=0 >>
/root
192.168.200.29 | SUCCESS | rc=0 >>
/root#command模块不支持重定向操作
[root@ansible ~]# ansible all -m command -a "echo ywb >> /tmp/hyx"
192.168.200.28 | SUCCESS | rc=0 >>
ywb >> /tmp/hyx
192.168.200.29 | SUCCESS | rc=0 >>
ywb >> /tmp/hyx#command模块不支持管道符操作
[root@ansible ~]# ansible all -m command -a "echo ywb | grep w"
192.168.200.28 | SUCCESS | rc=0 >>
ywb | grep w
192.168.200.29 | SUCCESS | rc=0 >>
ywb | grep w[root@ansible ~]# ansible all -a 'tail -1 /etc/passwd'
192.168.200.29 | SUCCESS | rc=0 >>
chrony:x:998:996::/var/lib/chrony:/sbin/nologin
192.168.200.28 | SUCCESS | rc=0 >>
chrony:x:998:996::/var/lib/chrony:/sbin/nologin4.2 ansible module shell (support pipes, support redirection)
#shell支持重定向
[root@ansible ~]# ansible all -m shell -a "echo ywb >> /tmp/hyx"
192.168.200.29 | SUCCESS | rc=0 >>
192.168.200.28 | SUCCESS | rc=0 >>#shell模块支持管道符
[root@ansible ~]# ansible all -m shell -a "echo ywb | grep w"
192.168.200.28 | SUCCESS | rc=0 >>
ywb
192.168.200.29 | SUCCESS | rc=0 >>
ywb4.3 ping module
#ping，模块是用来检测指定主机的连通性。
[root@ansible ~]# ansible all -m ping
192.168.200.28 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.200.29 | SUCCESS => {
"changed": false,
"ping": "pong"
}4.4 cron module
cron module is used to define the mission plan. Wherein there are two states (state): present represents added (not default state), absent represents removed.
#添加任务计划
[root@ansible ~]# ansible Web01 -m cron -a 'minute="*/1" job="/bin/echo heihei" name="ceshi"'
192.168.200.28 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"ceshi"
]
}
#检查是否添加成功
[root@ansible ~]# ansible Web01 -a "crontab -l"
192.168.200.28 | SUCCESS | rc=0 >>
#Ansible: ceshi
*/1 * * * * /bin/echo heihei
#查看Wbe01组的主机查看
[root@ansible ~]# ansible Web01 -a "tail -2 /var/spool/mail/root "
192.168.200.28 | SUCCESS | rc=0 >>
heihei#移除任务计划
[root@ansible ~]# ansible Web01 -m cron -a 'name="ceshi" state=absent'
192.168.200.28 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
#检查定时任务是否移除成功
[root@ansible ~]# ansible Web01 -a "crontab -l"
192.168.200.28 | SUCCESS | rc=0 >>4.5 user module
user module is used to create new users and to change, delete existing users. Where name option is used to specify the user name created. The request is useradd, userdel, usermod three instructions
#创建用户
[root@ansible ~]# ansible Web01 -m user -a 'name="ywb"'
192.168.200.28 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 1000,
"home": "/home/ywb",
"name": "ywb",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 1000
}
#检查用户是否创建成功
[root@ansible ~]# ansible Web01 -a 'id ywb'
192.168.200.28 | SUCCESS | rc=0 >>
uid=1000(ywb) gid=1000(ywb) 组=1000(ywb)#删除用户
[root@ansible ~]# ansible Web01 -m user -a 'name="ywb" state=absent'
192.168.200.28 | SUCCESS => {
"changed": true,
"force": false,
"name": "ywb",
"remove": false,
"state": "absent"
}
#检查用户是否删除成功
[root@ansible ~]# ansible Web01 -a 'id ywb'
192.168.200.28 | FAILED | rc=1 >>
id: ywb: no such usernon-zero return code4.6 group module
group means for managing user groups. The request is groupadd, groupdel, groupmod three instructions.
#创建用户组
[root@ansible ~]# ansible Web01 -m group -a 'name=hyx gid=306 system=yes'
192.168.200.28 | SUCCESS => {
"changed": true,
"gid": 306,
"name": "hyx",
"state": "present",
"system": true
}
#检查是否创建成功
[root@ansible ~]# ansible Web01 -a 'tail -1 /etc/group'
192.168.200.28 | SUCCESS | rc=0 >>
hyx:x:306:#将用户ywb添加到hyx组中
[root@ansible ~]# ansible Web01 -m user -a 'name=ywb uid=306 system=yes group=hyx'
192.168.200.28 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 306,
"home": "/home/ywb",
"name": "ywb",
"shell": "/bin/bash",
"state": "present",
"system": true,
"uid": 306
}
#查看用户ywb是否添加到hyx组中
[root@ansible ~]# ansible Web01 -a 'tail -1 /etc/passwd'
192.168.200.28 | SUCCESS | rc=0 >>
ywb:x:306:306::/home/ywb:/bin/bash4.7 copy module
copy module is used for file replication and batch issued a document. Wherein src file path to define the local source, dest defined using managed host file path is used to generate the target content file by specifying the content.
#将本地文件/etc/fstab复制到被管理主机上的/tmp/fstab.bak,将所有者设置为root，权限设置为644.
[root@ansible ~]# ansible Web01 -m copy -a 'src=/etc/fstab dest=/tmp/fstab.bak owner=root mode=644'
192.168.200.28 | SUCCESS => {
"changed": true,
"checksum": "aa95f6ca1f678dcfadb671a29a3cfcc5610ac5b9",
"dest": "/tmp/fstab.bak",
"gid": 0,
"group": "root",
"md5sum": "6bd26227e6a9b79520d2e4c55e232780",
"mode": "0644",
"owner": "root",
"size": 473,
"src": "/root/.ansible/tmp/ansible-tmp-1578033751.3-3069697382672/source",
"state": "file",
"uid": 0
}
#查看是否存在复制的文件
[root@ansible ~]# ansible Web01 -a "ls -d /tmp/fstab.bak"
192.168.200.28 | SUCCESS | rc=0 >>
/tmp/fstab.bak#将hello写入/tmp/fstab.back
[root@ansible ~]# ansible Web01 -m copy -a 'content="hello" dest=/tmp/fstab.bak'
192.168.200.28 | SUCCESS => {
"changed": true,
"checksum": "aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d",
"dest": "/tmp/fstab.bak",
"gid": 0,
"group": "root",
"md5sum": "5d41402abc4b2a76b9719d911017c592",
"mode": "0644",
"owner": "root",
"size": 5,
"src": "/root/.ansible/tmp/ansible-tmp-1578033973.42-101266898343089/source",
"state": "file",
"uid": 0
}
#查看内容是否写入
[root@ansible ~]# ansible Web01 -a 'cat /tmp/fstab.bak'
192.168.200.28 | SUCCESS | rc=0 >>
hello4.8 file module
file module to set the file attributes. Specify a file path where path is used to define the source file path src, dest using a name or a symbolic link is created to replace the file.
#设置文件/tmp/fstab.back的所属主为ywb，所属组为hyx，权限为755.
[root@ansible ~]# ansible Web01 -m file -a 'owner=ywb group=hyx mode=755 path=/tmp/fstab.bak'
192.168.200.28 | SUCCESS => {
"changed": true,
"gid": 306,
"group": "hyx",
"mode": "0755",
"owner": "ywb",
"path": "/tmp/fstab.bak",
"size": 5,
"state": "file",
"uid": 306
}
#查看文件的属性
[root@ansible ~]# ansible Web01 -a 'ls -l /tmp/fstab.bak'
192.168.200.28 | SUCCESS | rc=0 >>
-rwxr-xr-x 1 ywb hyx 5 1月 3 14:46 /tmp/fstab.bak#设置/tmp/fstab.link为/tmp/fstab.bak的链接文件
[root@ansible ~]# ansible Web01 -m file -a 'path=/tmp/fstab.bak.link src=/tmp/fstab.bak state=link'
192.168.200.28 | SUCCESS => {
"changed": true,
"dest": "/tmp/fstab.bak.link",
"gid": 0,
"group": "root",
"mode": "0777",
"owner": "root",
"size": 14,
"src": "/tmp/fstab.bak",
"state": "link",
"uid": 0
}
#检查软连接是否创建成功
[root@ansible ~]# ansible Web01 -a 'ls -l /tmp/fstab.bak /tmp/fstab.bak.link'
192.168.200.28 | SUCCESS | rc=0 >>
-rwxr-xr-x 1 ywb hyx 5 1月 3 14:46 /tmp/fstab.bak
lrwxrwxrwx 1 root root 14 1月 4 17:51 /tmp/fstab.bak.link -> /tmp/fstab.bak#删除文件/tmp/fstab.bak
[root@ansible ~]# ansible Web01 -m file -a "path=/tmp/fstab.bak state=absent"
192.168.200.28 | SUCCESS => {
"changed": true,
"path": "/tmp/fstab.bak",
"state": "absent"
}#创建文件/tmp/test
[root@ansible ~]# ansible Web01 -m file -a "path=/tmp/test state=touch"
192.168.200.28 | SUCCESS => {
"changed": true,
"dest": "/tmp/test",
"gid": 0,
"group": "root",
"mode": "0644",
"owner": "root",
"size": 0,
"state": "file",
"uid": 0
}4.9 script module
script module can copy the script to be run locally on the managed host. It should be noted that the use of a relative path to specify the script.
#例如，编辑一个本地脚本test.sh，复制到被管理主机上运行。
[root@ansible ~]# vim /tmp/test.sh
[root@ansible ~]# cat /tmp/test.sh
#!/bin/bash
echo "hello" > /tmp/script.txt
[root@ansible ~]# chmod +x /tmp/test.sh
[root@ansible ~]# ll -d /tmp/test.sh
-rwxr-xr-x 1 root root 43 1月 4 18:04 /tmp/test.sh
[root@ansible ~]# ansible Web01 -m script -a '/tmp/test.sh'
192.168.200.28 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.200.28 closed.\r\n",
"stdout": "",
"stdout_lines": []
}
#查看脚本实现
[root@ansible ~]# ansible Web01 -a "cat /tmp/script.txt"
192.168.200.28 | SUCCESS | rc=0 >>
hello4.10 ansible module raw, most primitive way to run command (not rely python, only be achieved by ssh)
#清除yum缓存
[root@ansible ~]# ansible all -m raw -a "yum -y clean all"
192.168.200.29 | SUCCESS | rc=0 >>
已加载插件：fastestmirror
正在清理软件源： base extras updates
Shared connection to 192.168.200.29 closed.
192.168.200.28 | SUCCESS | rc=0 >>
已加载插件：fastestmirror
正在清理软件源： base extras updates
Shared connection to 192.168.200.28 closed.#建立yum缓存
[root@ansible ~]# ansible all -m raw -a "yum makecache"
192.168.200.29 | SUCCESS | rc=0 >>
已加载插件：fastestmirror
Determining fastest mirrors
* base: mirrors.huaweicloud.com
* extras: mirrors.huaweicloud.com
* updates: mirror.bit.edu.cn
base | 3.6 kB 00:00
extras | 2.9 kB 00:00
updates | 2.9 kB 00:00
(1/10): base/7/x86_64/group_gz | 165 kB 00:00
(2/10): extras/7/x86_64/filelists_db | 207 kB 00:01
(3/10): extras/7/x86_64/other_db | 100 kB 00:00
(4/10): extras/7/x86_64/primary_db | 153 kB 00:01
(5/10): base/7/x86_64/other_db | 2.6 MB 00:03
(6/10): base/7/x86_64/primary_db | 6.0 MB 00:05
(7/10): updates/7/x86_64/filelists_db | 3.3 MB 00:03
(8/10): updates/7/x86_64/primary_db | 5.8 MB 00:07
(9/10): base/7/x86_64/filelists_db | 7.3 MB 00:21
(10/10): updates/7/x86_64/other_db | 363 kB 00:24
元数据缓存已建立
Shared connection to 192.168.200.29 closed.
192.168.200.28 | SUCCESS | rc=0 >>
已加载插件：fastestmirror
Determining fastest mirrors
* base: mirrors.neusoft.edu.cn
* extras: mirrors.neusoft.edu.cn
* updates: mirrors.njupt.edu.cn
base | 3.6 kB 00:00
extras | 2.9 kB 00:00
updates | 2.9 kB 00:00
(1/10): extras/7/x86_64/filelists_db | 207 kB 00:01
(2/10): base/7/x86_64/other_db | 2.6 MB 00:01
(3/10): extras/7/x86_64/other_db | 100 kB 00:00
(4/10): extras/7/x86_64/primary_db | 153 kB 00:00
(5/10): base/7/x86_64/group_gz | 165 kB 00:04
(6/10): updates/7/x86_64/other_db | 363 kB 00:00
(7/10): base/7/x86_64/primary_db | 6.0 MB 00:04
(8/10): updates/7/x86_64/filelists_db | 3.3 MB 00:07
(9/10): updates/7/x86_64/primary_db | 5.8 MB 00:17
(10/10): base/7/x86_64/filelists_db | 7.3 MB 00:39
元数据缓存已建立
Shared connection to 192.168.200.28 closed.4.11 yum module
yum responsible for multiplexing module is installed on the management host and unloading packages in which to install the package name specified using the specified state a state of the installation package, present, latest installation to represent, expressed Absent unloaded.
#安装zsh软件包（zsh命令参考链接https://zhuanlan.zhihu.com/p/63585679）
[root@ansible ~]# ansible Web01 -m yum -a 'name=zsh'
192.168.200.28 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror\nLoading mirror speeds from cached hostfile\n * base: mirrors.aliyun.com\n * extras: mirrors.huaweicloud.com\n * updates: mirrors.aliyun.com\nResolving Dependencies\n--> Running transaction check\n---> Package zsh.x86_64 0:5.0.2-33.el7 will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n zsh x86_64 5.0.2-33.el7 base 2.4 M\n\nTransaction Summary\n================================================================================\nInstall 1 Package\n\nTotal download size: 2.4 M\nInstalled size: 5.6 M\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n Installing : zsh-5.0.2-33.el7.x86_64 1/1 \n Verifying : zsh-5.0.2-33.el7.x86_64 1/1 \n\nInstalled:\n zsh.x86_64 0:5.0.2-33.el7 \n\nComplete!\n"
]
}
#查看是否安装成功
[root@ansible ~]# ansible Web01 -a 'rpm -q zsh'
[WARNING]: Consider using yum, dnf or zypper module rather than running rpm
192.168.200.28 | SUCCESS | rc=0 >>
zsh-5.0.2-33.el7.x86_64#卸载zsh软件包
[root@ansible ~]# ansible Web01 -m yum -a 'name=zsh state=absent'
192.168.200.28 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"已加载插件：fastestmirror\n正在解决依赖关系\n--> 正在检查事务\n---> 软件包 zsh.x86_64.0.5.0.2-33.el7 将被 删除\n--> 解决依赖关系完成\n\n依赖关系解决\n\n================================================================================\n Package 架构 版本 源 大小\n================================================================================\n正在删除:\n zsh x86_64 5.0.2-33.el7 @base 5.6 M\n\n事务概要\n================================================================================\n移除 1 软件包\n\n安装大小：5.6 M\nDownloading packages:\nRunning transaction check\nRunning transaction test\nTransaction test succeeded\nRunning transaction\n 正在删除 : zsh-5.0.2-33.el7.x86_64 1/1 \n 验证中 : zsh-5.0.2-33.el7.x86_64 1/1 \n\n删除:\n zsh.x86_64 0:5.0.2-33.el7 \n\n完毕！\n"
]
}4.12 service module
service modules for controlling the operation of state management services. Which enabled indicates whether the boot from the start, the value is true or false, use the name defined service name, specify the use of state service status, the value is started, respectively, stoped, restarted.
#启动httpd服务并设置开机自启动。
[root@ansible ~]# ansible Web01 -m service -a 'enabled=true name=httpd state=started'
192.168.200.28 | SUCCESS => {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started",
"status": {
"ActiveEnterTimestampMonotonic": "0",
"ActiveExitTimestampMonotonic": "0",
"ActiveState": "inactive",
"After": "tmp.mount nss-lookup.target -.mount system.slice network.target remote-fs.target systemd-journald.socket basic.target",
"AllowIsolate": "no",
"AmbientCapabilities": "0",
#以下省略若干。。。
#查看httpd的状态
[root@ansible ~]# ansible Web01 -a 'systemctl status httpd'
192.168.200.28 | SUCCESS | rc=0 >>
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since 日 2020-01-05 16:28:58 CST; 1min 9s ago
Docs: man:httpd(8)
man:apachectl(8)
Main PID: 1673 (httpd)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
CGroup: /system.slice/httpd.service
├─1673 /usr/sbin/httpd -DFOREGROUND
├─1674 /usr/sbin/httpd -DFOREGROUND
├─1675 /usr/sbin/httpd -DFOREGROUND
├─1676 /usr/sbin/httpd -DFOREGROUND
├─1677 /usr/sbin/httpd -DFOREGROUND
└─1678 /usr/sbin/httpd -DFOREGROUND
1月 05 16:28:52 web01 systemd[1]: Starting The Apache HTTP Server...
1月 05 16:28:56 web01 httpd[1673]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::20c:29ff:feb5:5280. Set the 'ServerName' directive globally to suppress this message
1月 05 16:28:58 web01 systemd[1]: Started The Apache HTTP Server.4.13 setup module
setup module to collect, view the managed host of facts. Before each managed host access and run administrative commands, will own information (operating system, IP address) is sent to the control panel
#例如，查看Web01组的facts信息
root@ansible ~]# ansible Web01 -m setup
192.168.200.28 | SUCCESS => {
"ansible_facts": {
"ansible_all_ipv4_addresses": [
"192.168.200.28"
],
"ansible_all_ipv6_addresses": [
"fe80::20c:29ff:feb5:5280"
],
"ansible_apparmor": {
"status": "disabled"
},
"ansible_architecture": "x86_64",
"ansible_bios_date": "07/02/2015",
"ansible_bios_version": "6.00",
"ansible_cmdline": {
"BOOT_IMAGE": "/vmlinuz-3.10.0-1062.el7.x86_64",
"LANG": "zh_CN.UTF-8",
"crashkernel": "auto",
"quiet": true,
"rd.lvm.lv": "centos_ywb/swap",
"rhgb": true,
"ro": true,
"root": "/dev/mapper/centos_ywb-root"
},
#以下省略若干。。。