LINUX学习------5.4 Linux中Ansible中的变量及加密

5.4.1 Ansible中的变量

1.变量命名和级别

变量命名：

        变量是{{  }}
        非变量{  }
        只能包含数字，下划线，字母
        只能用下划线或字母开头

变量级别：      

         全局:    从命令行或配置文件中设定的
        paly:    在play和相关结构中设定的
        主机:    由清单，事实收集或注册的任务

变量优先级设定：
        狭窄范围有限与广域范围

2. 变量设定和使用方式

1.在playbook中直接定义变量

---
- name: test var
  hosts: all
  vars:
    USER: westosfile

  tasks:
  - name: create user
    user:
      name: "{{ USER }}"

2.在文件中定义变量

---
USER: westosfile

---
- name: test var
  hosts: all
  vars_files:
    - ./user_list.yml

  tasks:
  - name: create user
    user:
      name: "{{ USER }}"

练习：

安装ftp和http服务

---
- service:
  - vsftpd
  - httpd

- services:
  - ftp
  - http

---
- name: test
  hosts: all
  vars_files:
    - ./user_list.yml

  tasks:
  - name: install
    dnf:
      name: "{{ service }}"    ##当模组可以执行多个组件时，不需item循环
      state: latest

  - name: start
    service:
      name: "{{ item }}"    ##当模组不可以执行多个组件时，需要item循环
      state: restarted
      enabled: yes
    loop:
      "{{ service }}"

  - name: configure firewall
    firewalld:
      service: "{{ item }}"
      permanent: yes
      state: enabled
      immediate: yes
    loop:
      "{{ services }}"

3.设定主机变量和清单变量

定义主机变量和清单变量时使用

vim inventory
    [westos_list1]
    172.25.22.10
    172.25.22.20

    [westos_list2]
    172.25.22.20

    [westos_list3]
    172.25.22.30

    [westos_group:children]
    westos_list2
    westos_list3

    [westos_list1:vars]
    USER=westos1

    [westos_group:vars]
    USER=westos2

---
  - name: test
    hosts: westos_group    ##只需改变hosts名单
    tasks:
      - name: user
        user:
          name: "{{ USER }}"
          state: present

目录设定变量

group_vars    ##清单变量,目录中的文件名称与主机清单名称一致
host_vars    ##主机变量，目录中的文件名称与主机名称一致

---
  - name: test
    hosts: westos
    tasks:
      - name: user
        user:
          name: "{{ USER }}"
          state: absent

mkdir group_vars        #当使用清单变量不能使用主机变量
cd group_vars
  vim westos
	USER: westos1
cd ..

mkdir host_vars            #当使用主机变量时不能使用清单变量
cd host_vars
  vim 172.25.254.222
	USER: westos2
cd ..

用命令覆盖变量

        ansible-playbook user.yml -e "USER='hello linux'"

---
  - name: test
    hosts: westos
    vars:
      USER: hello word
    tasks:
      - name: user
        debug:
          msg: "{{ USER }}"

使用数组设定变量

vim user_list.yml
    ---
    LIST:
      - name: user1
        path: /home/user1
      - name: user2
        path: /home/user2

vim test.yml
    ---
    - name:
      vars_files:
        - ./user_list.yml
      hosts: westos
      tasks:
        - name:
          debug:
            msg: "{{item.name}} {{item.path}}"
          loop:
            "{{LIST}}"

注册变量

        register 把模块输出注册到指定字符串中

---
- name: test
  hosts: westos
  tasks:
    - name: shell
      shell: echo hello word
      register: westos   	##将shell内容传入westos中
    - debug:
        msg: "{{westos['stdout']}}"

事实变量

        事实变量是ansible在受控主机中自动检测出的变量
        事实变量中还有与主机相关的信息

        当需要使用主机相关信息时不需要采集赋值，直接调用即可
        因为变量信息为系统信息所以不能随意设定仅为采集信息，故被成为事实变量

        ansible westos -m setup | less            ##事实变量查看

        gather_facts: no     ##在playbook中关闭事实变量收集

eg：

---
- name: test register
  hosts: 172.25.0.254
  tasks:
    - name: show messages
      debug:
        msg: "{{ansible_facts['architecture']}}"

魔法变量

        hostvars:                   ##ansible软件的内部信息
#eg:

ansible localhost -m debug -a "var=hostvars"

---

        group_names:        ##当前受管主机所在组
#eg:

ansible localhost -m debug -a "var=group_names"

---

        groups:                    ##列出清单中所有的组和主机
#eg:

ansible localhost -m debug -a "var=groups"

---

        inventory_hostname:    ##包含清单中配置的当前授管主机的名称    
#eg:

ansible localhost -m debug -m "var=inventory_hostname"

---

JINJA2模板

介绍
        Jinja2是Python下一个被广泛应用的模版引擎
        他的设计思想来源于Django的模板引擎，
        并扩展了其语法和一系列强大的功能。
        其中最显著的一个是增加了沙箱执行功能和可选的自动转义功能

 j2模板书写规则

vim test.j2
    {# /etc/hosts line #}		##注释说明文件用途
				
    {{ ansible_facts['all_ipv4_addresses'] }}	{{ansible_facts['fqdn']}} 	
             ##使用事实变量                            ##文件内容

ansible-playbook test.yml	        ##调用
vim test.yml
	---
	- name: test j2
	  hosts: westos
	  tasks:
	    - name: create test file
	      template:
		src: ./test.j2
		dest: /mnt/test

for循环

vim test.yml
	---
	- name: test j2
	  hosts: westos
	  tasks:
	    - name: create test file
	      template:
		src: ./test.j2
		dest: /mnt/test
vim ./user.yml
        ---
        user:
        - westos
        - linux
        - redhat

vim ./test.j2
        {% for NAME in user %}
        {{NAME}}
        {% endfor %}

if 判定

vim test.yml
	---
	- name: test j2
	  hosts: westos
	  tasks:
	    - name: create test file
	      template:
		src: ./test.j2
		dest: /mnt/test
vim ./user.yml
        ---
        user:
        - westos
        - linux
        - redhat

vim ./test.j2
	{% for NAME in user %}
		{% if NAME in "linux" %}
			{{loop.index0}}			##显示序号从0开始也可从1开始  不能为其他
			{% if NAME not in "linux" %}	
			{{loop.index0}} {{NAME}}	##显示序号和名字
		{%endif%}
	{% endfor %}

练习：
        清单列表中的主机生成所有ip和域名及主机名

    vim test.j2
        {%for WESTOS in groups['all']%}
        {{hostvars[WESTOS]['ansible_facts']['ens3']['ipv4']['address']}}  {{hostvars[WESTOS]['ansible_facts']['fqdn']}}   {{hostvars[WESTOS]['ansible_facts']['hostname']}}

    ansible-playbook test.yml    ##调用
    vim test.yml
        ---
        - name: test j2
          hosts: westos
          tasks:
            - name: create test file
              template:
            src: ./test.j2
            dest: /mnt/test

5.4.2 Ansible的加密控制

创建建立文件

ansible-vault create westos.yml
vim westosket                ##密码文件
    lee
vim westosnewkey             ##密码文件
    westos
ansible-vault create --vault-password-file=westoskey westos

加密现有文件

ansible-vault encrypt test

查看加密文件

ansible-vault view westos
ansible-vault view --vault-password-file=westoskey westos

编辑加密文件

ansible-vault edit westos1
ansible-vault edit --vault-password-file=westoskey westos

解密文件

ansible-vault decrypt westos                     ##文件永久解密
ansible-vault decrypt westos --output=linux      ##文件解密保存为linux

更改密码

ansible-vault rekey westos1
ansible-vault rekey westos1 --new-vault-password-file=westosnewkey

 playbook

ansible-playbook westos.yml  --ask-vault-pass    ##执行文件

ansible-playbook westos.yml --vault-password-file=westoskey