运维部署三层次：
1 纯手动操作
2 一键部署脚本
3 使用自动部署工具
ansible是自动化运维工具，基于Python开发
功能：批量系统配置、批量程序部署、批量运行命令
工作原理：
1 主机清单：定义ansible要管理的对象
2 playbooks：剧本 python的yml脚本
3 功能插件(模块)：实现剧本中具体的任务
4 连接模块：ssh
5 ansible整合
-----------------------------------------------
应用场景：
安装系统的工具：
kickstart
初始化：
selinux 、iptables 、 IP 联网 、 主机名、 时间 、常用工具
部署应用：
apache 、nginx 、 tomcat 、 mysql
批量执行命令
…
--------------------------------------
准备环境：
ansible 172.20.10.6 node1 172.20.10.7 node2 172.20.10.8 [root@ansible ~]# tail -3 /etc/hosts 172.20.10.6 ansible.ysla.com ansible 172.20.10.7 node1.ysla.com node1 172.20.10.8 node2.ysla.com node2 [root@ansible ~]# scp /etc/hosts 172.20.10.7:/etc/ [root@ansible ~]# scp /etc/hosts 172.20.10.8:/etc/
--------------------------------------------------
开始部署ansible：
[root@ansible ~]# rpm -ivh epel-release-7-6.noarch.rpm //安装epel,yum也可以 [root@ansible ~]# yum install -y ansible [root@ansible ~]# rpm -ql ansible | head -20 /etc/ansible /etc/ansible/ansible.cfg ##配置文件 /etc/ansible/hosts ##主机清单文件 /etc/ansible/roles ##角色配置文件 /usr/bin/ansible-playbook ##运行剧本的命令
配置： [root@ansible ~]# cd /etc/ansible/ [root@ansible /etc/ansible]# ls ansible.cfg hosts roles [root@ansible /etc/ansible]# vim hosts 172.20.10.7
测试连接：
[root@ansible ~]# ssh 172.20.10.7
The authenticity of host '172.20.10.7 (172.20.10.7)' can't be established.
ECDSA key fingerprint is SHA256:4JUE9YLEued+tSEr4sRDz1+7hze39R8aiRHxwQaaO4A.
ECDSA key fingerprint is MD5:f7:3b:08:d7:a2:1f:19:2d:c4:98:6a:9c:d0:a8:72:8a.
Are you sure you want to continue connecting (yes/no)? yes
[root@ansible ~]# cat .ssh/known_hosts
172.20.10.7 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDHNd2TGYifRr0u1Yr94st5CdVG+NqoHVcG8Fyt/Hh2osliJmUu1N/UDTS8MvD8T+nSMYcGQ3GUvAV0YZ+uUf8Q=
需要记录节点的公钥指纹
[root@ansible /etc/ansible]# ansible 172.20.10.7 -m ping -k
SSH password:
172.20.10.7 | SUCCESS => {
[root@ansible /etc/ansible]# vim hosts
[node]
172.20.10.7
172.20.10.8
无密码连接：
[root@ansible ~]# vim /etc/ansible/hosts
[node]
172.20.10.7 ansible_ssh_user=root ansible_ssh_pass=123
172.20.10.8 ansible_ssh_user=root ansible_ssh_pass=123
[root@ansible ~]# ansible node -m ping
[root@ansible ~]# ll /etc/ansible/hosts
-rw-r--r-- 1 root root 1134 Jul 19 10:08 /etc/ansible/hosts
ssh无密码连接：
[root@ansible ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 回车
Enter passphrase (empty for no passphrase): 回车
Enter same passphrase again:回车
[root@ansible ~]# cd .ssh/
[root@ansible ~/.ssh]# ls
id_rsa id_rsa.pub
私钥 公钥
公钥发布给被连接端
[root@ansible ~]# ssh-copy-id -i .ssh/id_rsa.pub 172.20.10.7
[root@node1 ~]# cd .ssh/
[root@node1 ~/.ssh]# ls
authorized_keys
[root@node1 ~/.ssh]# cat authorized_keys
分发公钥的操作脚本化：
[root@ansible ~]# vim iplist
172.20.10.7
172.20.10.8
[root@ansible ~]# vim scp_sshpubkey.sh
#!/bin/bash
# 分发ssh的公钥
pass="123"
key="/root/.ssh/id_rsa.pub"
file="/root/iplist"
while read ip
do
sshpass -p ${pass} /usr/bin/ssh-copy-id -o StrictHostKeyChecking=no -i ${key} ${ip} &> /dev/null && echo "${ip}公钥传输成功."
done < $file
sshpass带入ssh被连接端的密码 [root@ansible ~]# sshpass -p 123 ssh 172.20.10.7 Last login: Thu Jul 19 10:15:12 2021 from ansible.ysla.com [root@node1 ~]# [root@ansible ~]# > .ssh/known_hosts [root@ansible ~]# sshpass -p 123 ssh -o StrictHostKeyChecking=no 172.20.10.7
介绍ansible的常用模块：
1. ping
探测对端是否存活
2. command
在节点执行命令，不支持管道|
[root@ansible ~]# ansible node -m command -a "mkdir /tmp/dir1" 返回信息： 绿 成功 红 失败 粉 警告 黄 执行成功
3. copy
将ansible的文件传输给节点。
选项： src 源文件 dest 目标文件 backup 如果目标文件已存在，覆盖之前是否要备份 owner 指定所有者 mode 指定权限 [root@ansible /etc/ansible]# mkdir files [root@ansible /etc/ansible]# ls ansible.cfg files hosts roles [root@ansible /etc/ansible]# cp /etc/hosts files/ [root@ansible /etc/ansible]# ansible node -m copy -a "src=/etc/ansible/files/hosts dest=/tmp/hosts [root@ansible /etc/ansible]# ansible node -m copy -a "src=/etc/ansible/files/hosts dest=/etc/hosts backup=yes" [root@ansible /etc/ansible]# ansible node -m command -a "useradd user1" [root@ansible /etc/ansible]# ansible node -m copy -a "src=/etc/ansible/files/hosts dest=/tmp/hosts1 owner=user1 mode=700" [root@ansible /etc/ansible]# ansible node -m command -a "ls -l /tmp/hosts1" 172.20.10.8 | CHANGED | rc=0 >> -rwx------ 1 user1 root 256 Jul 19 11:53 /tmp/hosts1 172.20.10.7 | CHANGED | rc=0 >> -rwx------ 1 user1 root 256 Jul 19 11:53 /tmp/hosts1
4. file
管理节点上的文件
选项： path 指定文件路径 state 操作 touch 创建文件 directory 创建目录 absent 删除 [root@ansible ~]# ansible node -m file -a "path=/tmp/f1 state=touch" ## == touch [root@ansible ~]# ansible node -m file -a "path=/tmp/d1 state=directory" ## == mkdir [root@ansible ~]# ansible node -m file -a "path=/tmp/f1 state=absent" ## == rm -f [root@ansible ~]# ansible node -m file -a "path=/tmp/d1 state=absent" ## == rm -fr [root@ansible ~]# ansible node -m file -a "path=/tmp/f1 mode=700 owner=user1 group=user1 state=touch" ## == touch ## == chown user1:user1 ## == chmod 700 [root@ansible ~]# ansible node -m file -a "path=/tmp/d1/d2/d3 state=directory" ## == mkdir -p [root@ansible ~]# ansible node -m file -a "path=/tmp/d1/d2/d3 mode=757 recurse=yes" ## == chmod -R 757 # vim /etc/bashrc export PS1="[\u@\[\e[32;40m\]\h \[\e[31;40m\]\w\[\e[0m\]]\\$ "
5. get_url
下载文件的
[root@ansible ~]# ansible node -m get_url -a "url=ftp://172.20.10.99/release/epel-release-7-6.noarch.rpm dest=/tmp" [root@ansible ~]# ansible node -m get_url -a "url=ftp://172.20.10.99/scripts/nginx-1.13-clean.sh dest=/tmp mode=755"
6. user
管理用户
[root@ansible ~]# ansible node -m user -a "name=zhangsan uid=2000" ## == useradd -u 2000 zhangsan [root@ansible ~]# ansible 172.20.10.7 -m user -a "name=zhangsan state=absent" ## == userdel zhangsan [root@ansible ~]# ansible 172.20.10.8 -m user -a "name=zhangsan state=absent remove=yes" ## == userdel -r zhangsan
7. group
管理组
[root@ansible ~]# ansible node -m group -a "name=group1 gid=100000" ## == groupadd -g 100000 group1 [root@ansible ~]# ansible node -m group -a "name=group1 state=absent" ## == groupdel group1
8. yum
安装rpm包
卸载： [root@ansible ~]# ansible node -m yum -a "name=lftp state=absent" 安装： [root@ansible ~]# ansible node -m yum -a "name=lftp"
9. systemd
管理节点上的服务 开启或关闭
centos7
centos6是service模块
[root@ansible ~]# ansible node -m yum -a "name=httpd" [root@ansible ~]# ansible node -m systemd -a "name=httpd state=started" [root@ansible ~]# ansible node -m systemd -a "name=httpd state=stopped" [root@ansible ~]# ansible node -m systemd -a "name=httpd state=restarted" [root@ansible ~]# ansible node -m systemd -a "name=httpd enabled=yes"
10. shell
在节点执行shell脚本
[root@ansible ~]# ansible node -m shell -a "/usr/bin/bash /tmp/nginx-1.13-clean.sh"
11. cron
在远程节点配置计划任务
每隔5分钟，执行一次关闭firewalld的命令： */5 * * * * systemctl stop firewalld 分 minute 时 hour 日 day 月 month 周 weekday 命令 job [root@ansible ~]# ansible node -m cron -a 'name="stop firewalld" minute=*/5 job="systemctl stop firewalld"' [root@node1 /tmp]# crontab -l #Ansible: stop firewalld */5 * * * * systemctl stop firewalld
=======================================
写剧本：
[root@ansible /etc/ansible]# mkdir playbooks [root@ansible /etc/ansible]# cd playbooks/ [root@ansible /etc/ansible/playbooks]# vim apache.yml - name: install and config apache hosts: node user: root tasks: - name: install apache yum: name=httpd - name: config apache copy: src=files/httpd.conf dest=/etc/httpd/conf/httpd.conf backup=yes notify: restart httpd - name: create index.html copy: src=files/index.html dest=/var/www/html/index.html handlers: - name: restart httpd systemd: name=httpd state=restarted enabled=yes [root@ansible /etc/ansible/playbooks]# mkdir files [root@ansible /etc/ansible/playbooks]# yum install -y httpd [root@ansible /etc/ansible/playbooks]# cp /etc/httpd/conf/httpd.conf files/ [root@ansible /etc/ansible/playbooks]# echo "test-ansible" > files/index.html [root@ansible /etc/ansible/playbooks]# vim files/httpd.conf 加一些注释符号 [root@ansible /etc/ansible/playbooks]# ansible-playbook apache.yml 虚拟主机： - name: config apache hosts: node user: root tasks: - name: config apache copy: src=files/httpd.conf dest=/etc/httpd/conf/httpd.conf backup=yes notify: restart httpd - name: create a'directory file: path=/var/www/html/a state=directory - name: create b'directory file: path=/var/www/html/b state=directory - name: create a'index.html copy: src=files/aindex.html dest=/var/www/html/a/index.html - name: create b'index.html copy: src=files/bindex.html dest=/var/www/html/b/index.html handlers: - name: restart httpd systemd: name=httpd state=restarted enabled=yes
写一个ftp部署剧本：
[root@ansible /etc/ansible/playbooks]# vim ftp.yml - name: install and config vsftpd hosts: node user: root tasks: - name: install vsftpd yum: name=vsftpd - name: create upload dir file: path=/var/ftp/upload owner=ftp state=directory - name: config vsftpd copy: src=files/vsftpd.conf dest=/etc/vsftpd/vsftpd.conf backup=yes notify: restart vsftpd handlers: - name: restart vsftpd systemd: name=vsftpd state=restarted enabled=yes [root@ansible /etc/ansible/playbooks]# yum install -y vsftpd [root@ansible /etc/ansible/playbooks]# cp /etc/vsftpd/vsftpd.conf files/ [root@ansible /etc/ansible/playbooks]# vim files/vsftpd.conf
来自 “ ITPUB博客 ” ，链接：https://blog.itpub.net/69990629/viewspace-2787041/ ，如需转载，请注明出处，否则将追究法律责任。
请登录后发表评论
登录
全部评论
