ansible详解

34233

                      ansible：

   特性：

    模块化，调用特定的模块来完成特定任务；

    基于Python语言实现，由Paramiko，PyYAML和Jinja2三个关键模块实现；

    部署简单，agentless；
    主从模式；

    支持自定义模块；
    支持playbook

  （支持幂等性）
   组成部分:
    ansible core
    host inventory

    connection plugins

    modules:
        custom modules;

        core modules;

    playbooks

   配置文件：
    主配置文件：/etc/ansible/ansible.cfg

    Host Inventory:/etc/ansible/hosts

ansible命令：
     ansible  <host-pattern>  [-f forks]  [-m module_name]  [-a args]
-i PATH, --inventory=PATH：指明使用的host inventory文件路径；


注：在使用ansible命令在director主机上统一管控后端集群主机时，director基于ssh协议与后端主机进行管控，所以要提前生成director的密钥对copy给集群中需要被ansible管控的主机，使director主机与集群中的主机可以基于密钥对方式连接ssh。

在director主机中安装ansible：

1	[iyunv@localhost ~]# yum install ansible

1 2 3 4 5

[iyunv@localhost ~]# vim /etc/ansible/hosts   #在hosts文件中定义要管控的主机 [websrvs] 172.16.61.2 172.16.61.3 ...

---

常用模块：
[-a args]：
args： key=value  键值类型

    ①command：默认模块：在远程节点上运行一个命令；
-a 'COMMAND'
   注：command模块的参数非为kv格式，而是直接给出要执行的命令即可；

1 2 3 4 5 6 7 8 9 10 11 12 13

[iyunv@localhost ~]# ansible all -m command -a 'ls'  #在远程节点上运行ls命令 172.16.61.2 | success | rc=0 >> anaconda-ks.cfg 172.16.61.3 | success | rc=0 >> anaconda-ks.cfg [iyunv@localhost ~]# ansible all -a 'ls'      #command为默认模块不-m指明也能默认使用 172.16.61.3 | success | rc=0 >> anaconda-ks.cfg 172.16.61.2 | success | rc=0 >> anaconda-ks.cfg

    ②user：
-a 'name=  state={present|absent}  force=   system=  uid=  shell=  home='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

[iyunv@localhost ~]# ansible websrvs -m user -a 'name=tz state=present'  #在远程节点创建该用户 172.16.61.3 | success >> {     "changed": true,     "comment": "",     "createhome": true,     "group": 1001,     "home": "/home/tz",     "name": "tz",     "shell": "/bin/bash",     "state": "present",     "system": false,     "uid": 1001 } 172.16.61.2 | success >> {     "changed": true,     "comment": "",     "createhome": true,     "group": 1001,     "home": "/home/tz",     "name": "tz",     "shell": "/bin/bash",     "state": "present",     "system": false,     "uid": 1001 } [iyunv@localhost ~]# ansible websrvs -m user -a 'name=tz state=absent force=true' #删除该用户及家目录 172.16.61.3 | success >> {     "changed": true,     "force": true,     "name": "tz",     "remove": false,     "state": "absent" } 172.16.61.2 | success >> {     "changed": true,     "force": true,     "name": "tz",     "remove": false,     "state": "absent" }

    ③group：
-a 'name=  state={present|absent}  gid=  system='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

[iyunv@localhost ~]# ansible websrvs -m group -a 'name=grp state=present system=true' #创建grp系统组 172.16.61.2 | success >> {     "changed": true,     "gid": 992,     "name": "grp",     "state": "present",     "system": true } 172.16.61.3 | success >> {     "changed": true,     "gid": 992,     "name": "grp",     "state": "present",     "system": true }

    ④cron：
-a 'name=  state=  minute=  hour=  day=  month=  weekday=  job='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

[iyunv@localhost ~]# ansible websrvs -m cron -a "name=timesync minute='*/5' job='/usr/sbin/ntpdate 172.16.0.1 &> /dev/null'"   #在远程节点上定义周期性任务，每五分钟执行一次同步时间的操作 172.16.61.3 | success >> {     "changed": true,     "jobs": [         "timesync"     ] } 172.16.61.2 | success >> {     "changed": true,     "jobs": [         "timesync"     ] } [iyunv@localhost ~]# crontab -l    #远程节点上可以查看出该周期任务。 #Ansible: timesync */5 * * * * /usr/sbin/ntpdate 172.16.0.1 &> /dev/null [iyunv@localhost ~]# ansible websrvs -m cron -a "name=timesync state=absent"  #删除该周期性任务 172.16.61.3 | success >> {     "changed": true,     "jobs": [] } 172.16.61.2 | success >> {     "changed": true,     "jobs": [] }

    ⑤ping：
没有参数

1 2 3 4 5 6 7 8 9 10

[iyunv@localhost ~]# ansible websrvs -m ping 172.16.61.3 | success >> {     "changed": false,     "ping": "pong" } 172.16.61.2 | success >> {     "changed": false,     "ping": "pong" }

    ⑥file：
-a 'path=  mode=  owner=  group=  state={file|directory|link|hard|touch|absent}  src='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

[iyunv@localhost ~]# ansible websrvs -m file -a 'path=/tmp/test state=touch mode=600'  #在远程节点上/tmp目录下创建权限为600，名称为test的文件 172.16.61.3 | success >> {     "changed": true,     "dest": "/tmp/test",     "gid": 0,     "group": "root",     "mode": "0600",     "owner": "root",     "secontext": "unconfined_u:object_r:user_tmp_t:s0",     "size": 0,     "state": "file",     "uid": 0 } 172.16.61.2 | success >> {     "changed": true,     "dest": "/tmp/test",     "gid": 0,     "group": "root",     "mode": "0600",     "owner": "root",     "secontext": "unconfined_u:object_r:user_tmp_t:s0",     "size": 0,     "state": "file",     "uid": 0 } [iyunv@localhost ~]# ansible websrvs -m file -a 'path=/tmp/test state=absent' #删除该文件 172.16.61.3 | success >> {     "changed": true,     "path": "/tmp/test",     "state": "absent" } 172.16.61.2 | success >> {     "changed": true,     "path": "/tmp/test",     "state": "absent" } [iyunv@localhost ~]# ansible websrvs -m file -a 'path=/tmp/test state=link src=/etc/fstab' #在远程节点上创建/etc/fstab的符号链接指向/tmp/test 172.16.61.3 | success >> {     "changed": true,     "dest": "/tmp/test",     "gid": 0,     "group": "root",     "mode": "0777",     "owner": "root",     "secontext": "unconfined_u:object_r:user_tmp_t:s0",     "size": 10,     "src": "/etc/fstab",     "state": "link",     "uid": 0 } 172.16.61.2 | success >> {     "changed": true,     "dest": "/tmp/test",     "gid": 0,     "group": "root",     "mode": "0777",     "owner": "root",     "secontext": "unconfined_u:object_r:user_tmp_t:s0",     "size": 10,     "src": "/etc/fstab",     "state": "link",     "uid": 0 }

    ⑦copy：把管理端的文件给远程节点各复制一份
-a 'dest=  src=\'#\'"   owner=  group=  mode='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32

[iyunv@localhost ~]# ansible websrvs -m copy -a 'src=/etc/fstab dest=/tmp/fstab mode=660' #将本地主机/etc/fstab文件复制到远程节点的/tmp目录下，权限为660 172.16.61.3 | success >> {     "changed": true,     "checksum": "37ed7ee7a0cb241d01cf18351d2c541d12003937",     "dest": "/tmp/fstab",     "gid": 0,     "group": "root",     "md5sum": "8c466190fc6993d65baeeb0beff52de4",     "mode": "0660",     "owner": "root",     "secontext": "unconfined_u:object_r:admin_home_t:s0",     "size": 619,     "src": "/root/.ansible/tmp/ansible-tmp-1454251002.67-64682182817600/source",     "state": "file",     "uid": 0 } 172.16.61.2 | success >> {     "changed": true,     "checksum": "37ed7ee7a0cb241d01cf18351d2c541d12003937",     "dest": "/tmp/fstab",     "gid": 0,     "group": "root",     "md5sum": "8c466190fc6993d65baeeb0beff52de4",     "mode": "0660",     "owner": "root",     "secontext": "unconfined_u:object_r:admin_home_t:s0",     "size": 619,     "src": "/root/.ansible/tmp/ansible-tmp-1454251002.66-162169360284592/source",     "state": "file",     "uid": 0 }

    ⑧yum：
-a 'name=  conf_file=  state={present|latest|absent}  enablerepo= disablerepo='

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

[iyunv@localhost ~]# ansible websrvs -m yum -a 'name=httpd state=present'  #在远程节点上安装httpd程序 172.16.61.2 | success >> {     "changed": false,     "msg": "",     "rc": 0,     "results": [         "httpd-2.4.6-31.el7.centos.x86_64 providing httpd is already installed" #提示已经被安装了     ] } 172.16.61.3 | success >> {     "changed": false,     "msg": "",     "rc": 0,     "results": [         "httpd-2.4.6-31.el7.centos.x86_64 providing httpd is already installed"     ] }

     
    ⑨service：启动远程节点的服务
      -a  'name=  state={started|stopped|restarted}  enabled=  runlevel='

1 2 3 4 5 6 7 8 9 10 11 12 13 14

[iyunv@localhost ~]# ansible websrvs -m service -a 'name=httpd state=started enabled=true' #开启远程节点的httpd服务，并且设定开机启动 172.16.61.2 | success >> {     "changed": true,     "enabled": true,     "name": "httpd",     "state": "started" } 172.16.61.3 | success >> {     "changed": true,     "enabled": true,     "name": "httpd",     "state": "started" }

    ⑩shell：在shell环境中运行命令
      -a  'COMMAND'

1 2 3 4 5 6 7 8

[iyunv@localhost ~]# ansible websrvs -m shell -a 'echo "tianzhuang" | passwd --stdin user1' 172.16.61.3 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully. 172.16.61.2 | success | rc=0 >> Changing password for user user1. passwd: all authentication tokens updated successfully.

     

            

            script：将主机上的脚本复制到远程节点上并运行

            -a  '/PATH/TO/SCRIPT'

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

[iyunv@localhost ~]# vim hello.sh  #在本地创建一个脚本 #!/bin/bash echo "hello" [iyunv@localhost ~]# ansible websrvs -m script -a '/root/hello.sh' #在远程节点上运行该脚本 172.16.61.2 | success >> {     "changed": true,     "rc": 0,     "stderr": "OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 56: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: mux_client_request_session: master session id: 2\r\nShared connection to 172.16.61.2 closed.\r\n",     "stdout": "hello\r\n" } 172.16.61.3 | success >> {     "changed": true,     "rc": 0,     "stderr": "OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 56: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: mux_client_request_session: master session id: 2\r\nShared connection to 172.16.61.3 closed.\r\n",     "stdout": "hello\r\n" }

                               

                    setup：

           获取指定主机的facts；

       注： ansible-doc命令：获取模块列表，及模块使用格式；               

                 ansible-doc  -l

             ansible-doc  -s  module_name

---

ansible playbooks：

核心元素：

        Tasks

        Variables

        Templates

        Handlers

        Roles

  组织格式：YAML

    语法：

    列表：-

    字典：k:v数据，键值对