Ansible的安装及部署

最新推荐文章于 2024-08-21 15:25:38 发布

原创最新推荐文章于 2024-08-21 15:25:38 发布 · 425 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#网络 #linux #运维

本文详细介绍了Ansible的安装过程，包括使用dnf安装和验证版本。接着讲解了主控机与被控机间如何实现免密连接，并探讨了构建Ansible清单的多种方式，如单层清单、嵌套清单及范围化操作。此外，还深入解析了Ansible的配置文件参数，包括配置文件的分类、优先级和常用参数设置，最后提到了构建用户级Ansible操作环境的方法。

1、Ansible的安装

epel源
dnf install ansible -y
ansible --viersion

ansible的基本信息:
/etc/ansible/ansible.conf ##全局配置文件,默认很少修改
/etc/ansible/hosts ##全局主机清单清单文件

dnf install sshpass-1.06-9.el8.x86_64.rpm -y
dnf install ansible-2.9.11-1.el8.noarch.rpm -y

2、主控机和被控机之间免密连接

[root@ansible111 ~]# ssh-keygen
[root@ansible111 ~]# dnf install expect -y
[root@ansible111 mnt]# cat sshkey.sh 
#!/bin/bash
AUTOSSH()
{
/usr/bin/expect << EOF
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.$i
expect {
"yes/no" { send "yes\r";exp_continue }
"password" { send "westos\r" }
}
expect eof
EOF
}
for i in 211 210
do
	AUTOSSH
done
[root@ansible111 mnt]# sh sshkey.sh 
[root@ansible111 mnt]# ssh -l root 172.25.254.210  ##可以直接免密登陆

3、构建Anisble清单

清单就是ansible控制主机的列表
/etc/ansible/hosts ##全局清单文件

1.直接书写受管主机名或ip,每行一个

node1.westos.com
node2.westos.com
172.25.254.240

2.设定受管主机的组[组名称]

#清单查看:
ansible 清单中组名称 [-i 清单文件] --list-hosts
ansible ungrouped --list-hosts
ansible all --list-hosts

单层清单

[list1]
node1.westos.com
node2.westos.com
[list2]
node2.westos.com
[list3]
172.25.254.240

嵌套清单

[westos:children]
list1
list3

3.主机规格的范围化操作

#通过指定主机名称或IP的范围可以简化Ansible主机清单
#语法:
#[start:end]
[westostest]
172.25.254.[100:108]

4.指定其他清单文件

vim inventory
172.25.254.240
[westostest]
172.25.254.100
172.25.254.200

ansible命令指定清单的正则表达式

*                ##所有
                  ##172.25.254.*
                  ##westos*
:                 ##逻辑或
                  ##westos1:linux
                  ##172.25.254.100:172.25.254.200
:&              ##逻辑与
                 ##westos1:&linux
             ##主机即在westos1清单也在linux清单中
:!               ##逻辑非
                ##westos1:!linux
                ##在westos1中不在linux中
~              ##以关键字开头
~(str1|str2)          ##以条件1或者条件2开头

4、Ansible配置文件参数详解

ansible 清单中组名称 -m 模块 -u remote_user

1.配置文件的分类与优先级

etc/ansible/ansible.cfg        #基本配置文件,找不到其他配置文件此文件生效
~/.ansible.cfg                        #用户当前目录中没有ansible.cfg此文件生效
./ansible.cfg                          #优先级最高

2.常用配置参数

#[default]                ##基本信息设定
inventory=                ##指定清单路径
remote_user=                ##在受管主机上登陆的用户名称,未指定使用当前用户
ask_pass=                ##是否提示输入SSH密码,如果公钥登陆设定为false
library=                ##库文件存放目录
local_tmp=                ##本机临时命令执行目录
remote_tmp=                ##远程主机临时py命令文件存放目录
forks=                ##默认并发数
host_key_checking=                ##第一次连接受管主机时是否要输入yes建立host_key
sudo_user=                ##默认sudo用户
ask_sudo_pass=                ##每次在受控主机执行ansible命令时是否询问sudo密码
module_name=                ##默认模块,默认使用command,可以修改为shell
log_path=                 ##日志文件路径

[privilege_escalation]         ##身份信息设定
become=                        ##连接后是否自动切换用户
become_method=        ##设定切换用户的方式,通常用sudo
become_user=                ##在受管主机中切换到的用户,通常为root
become_ask_pass               ##是否需要为become_method提示输入密码,默认为false

5、构建用户级Ansible操作环境

[root@ansible111 mnt]# vim sshkey.sh ##删除之前设置的密钥
#!/bin/bash
AUTOSSH()
{
/usr/bin/expect << EOF
spawn ssh-copy-id -i /root/.ssh/id_rsa.pub root@172.25.254.$i
expect {
"yes/no" { send "yes\r";exp_continue }
"password" { send "westos\r" }
}
expect eof
EOF
}
for i in 211 210 203
do
        ssh -l root 172.25.254.$i rm -fr /root/.ssh
done
[root@ansible111 mnt]# sh sshkey.sh

添加用户，添加清单

[root@ansible111 ~]# useradd devops
[root@ansible111 ~]# su - devops
[devops@ansible111 ~]$ ls
[devops@ansible111 ~]$ mkdir .ansible
[devops@ansible111 ~]$ cd .ansible/
[devops@ansible111 .ansible]$ vim inventory  ##建立清单
[westos]
172.25.254.211
~                                                                               [devops@ansible111 .ansible]$ logout

修改之前的主配置文件，删除之前的设置。写用户的配置文件

[root@ansible111 ~]# vim /etc/ansible/hosts  ##修改之前的主配置文件，删除之前的设置
[root@ansible111 ~]# su - devops 
Last login: Fri Nov 26 14:37:59 CST 2021 on pts/1


[devops@ansible111 .ansible]$ vim ansible.cfg
                                                                                    
[defaults]
inventory    = ~/.ansible/inventory
host_key_checking = False
remote_user = root
module_name = shell

[privilege_escalation]
#become=True
#become_method=sudo
#become_user=root
#become_ask_pass=False

在主控机给被控机创建用户

[devops@ansible111 .ansible]$ ansible 172.25.254.211 -m shell -a 'useradd devops' -k -u root ##建立用户
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>

[devops@ansible111 .ansible]$ ansible 172.25.254.211 -m shell -a 'echo westos | passwd --stdin devops' -k -u root  ##修改密码
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>
Changing password for user devops.
passwd: all authentication tokens updated successfully.

[devops@ansible111 .ansible]$ ansible 172.25.254.211 -m shell -a 'echo "devops ALL=(root) NOPASSWD: ALL" >> /etc/sudoers' -k -u root ##设置sudo时不用输入密码
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>

[devops@ansible111 .ansible]$ vim ansible.cfg 

[defaults]
inventory    = ~/.ansible/inventory
host_key_checking = False
remote_user = devops
module_name = shell

[privilege_escalation]
#become=True
#become_method=sudo
#become_user=root
#become_ask_pass=False



[devops@ansible111 .ansible]$ ansible westos -m shell -a 'whoami' -k
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>
devops

devops@ansible111 .ansible]$ ansible westos -m shell -a 'whoami' -k
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>
devops


[devops@ansible111 .ansible]$ vim ansible.cfg ##去掉注释，登陆的是devops  sudo到root 

[defaults]
inventory    = ~/.ansible/inventory
host_key_checking = False
remote_user = devops
module_name = shell

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False
[devops@ansible111 .ansible]$ ansible westos -m shell -a 'whoami' -k
SSH password: 
172.25.254.211 | CHANGED | rc=0 >>
root

[devops@ansible111 .ansible]$ ansible westos -m shell -a 'mkdir -p /home/devops/.ssh' -k  ##建立密钥用户
SSH password: 
[WARNING]: Consider using the file module with state=directory rather than
running 'mkdir'.  If you need to use command because file is insufficient you
can add 'warn: false' to this command task or set 'command_warnings=False' in
ansible.cfg to get rid of this message.
172.25.254.211 | CHANGED | rc=0 >>

[devops@ansible111 .ansible]$ ansible westos -m shell -a 'chown devops.devops /home/devops/.ssh' -k  ##更改所有人和所有组
SSH password: 
[WARNING]: Consider using the file module with owner rather than running
'chown'.  If you need to use command because file is insufficient you can add
'warn: false' to this command task or set 'command_warnings=False' in
ansible.cfg to get rid of this message.
172.25.254.211 | CHANGED | rc=0 >>

[devops@ansible111 .ansible]$ ansible westos -m shell -a 'chmod 700 /home/devops/.ssh' -k   ##更改权限
SSH password: 
[WARNING]: Consider using the file module with mode rather than running
'chmod'.  If you need to use command because file is insufficient you can add
'warn: false' to this command task or set 'command_warnings=False' in
ansible.cfg to get rid of this message.
172.25.254.211 | CHANGED | rc=0 >>

[devops@ansible111 .ansible]$ ansible westos -m copy -a 'src=/home/devops/.ssh/id_rsa.pub dest=/home/devops/.ssh/authorized_keys mode=0600 owner=devops group=devops' -k  ##复制密钥
SSH password: 
172.25.254.211 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": true,
    "checksum": "2c0b47b02c780dce7c3fd89ace281ffe1a0e85d8",
    "dest": "/home/devops/.ssh/authorized_keys",
    "gid": 1001,
    "group": "devops",
    "md5sum": "ffdacd640ae7f4e8301e028bd46ae941",
    "mode": "0600",
    "owner": "devops",
    "secontext": "unconfined_u:object_r:ssh_home_t:s0",
    "size": 582,
    "src": "/home/devops/.ansible/tmp/ansible-tmp-1637913887.458308-33950-98330280400164/source",
    "state": "file",
    "uid": 1001
}

[devops@ansible111 .ansible]$ ansible westos -m ping ##不需要密码可执行模块
172.25.254.211 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/libexec/platform-python"
    },
    "changed": false,
    "ping": "pong"
}