ansible的安装部署

架构接上一篇

一.安装部署

[root@base2 ~]# ls
ansible-2.7.8-1.el7.noarch.rpm
ansible-tower-setup-bundle-3.4.2-1.el7.tar.gz
libtomcrypt-1.17-25.el7.x86_64.rpm
libtommath-0.42.0-5.el7.x86_64.rpm
python2-crypto-2.6.1-13.el7.x86_64.rpm
python2-jmespath-0.9.0-1.el7.noarch.rpm
python-httplib2-0.9.2-0.1.el7.noarch.rpm
python-keyczar-0.71c-2.el7.noarch.rpm
python-paramiko-2.1.1-0.9.el7.noarch.rpm
[root@base2 ~]# yum install -y *.rpm
[root@base2 ~]# cd /etc/ansible/
[root@base2 ansible]# ll
total 24
-rw-r--r-- 1 root root 20277 Feb 22 07:04 ansible.cfg   # 主配置文件
-rw-r--r-- 1 root root  1016 Feb 22 07:04 hosts         # 定义主机变量
drwxr-xr-x 2 root root     6 Feb 22 07:04 roles         # 存放角色的文件

#添加主机，我是分组存放主机的

[root@base2 ansible]# vim hosts   
[web]
base2

[db]
base3

#我们现在用密码来连接

[root@base2 ansible]# ansible base2 -m ping    # -m 调用模块,连接base2

[root@base2 ansible]# ansible base2 -m ping -k   # -k表示使用密码
SSH password: 

[root@base2 ansible]# ansible base3 -m ping -k
SSH password:

#为了方便，我设置成为免密

[root@base2 ansible]# ssh-copy-id base2   # 建立免密

[root@base2 ansible]# ssh-copy-id base3  # 建立免密

[root@base2 ansible]# ansible base* -m ping   # 测试，不需要密码就可以成功

二.用ansible来部署远程服务

1.创建远程用户，并免密

[root@base2 ansible]# ansible all -m user -a "name=lala password=redhat"  # 给所有节点创建用户

[root@base3 ~]# id lala    # 在远程端查看，用户建立成功
uid=1000(lala) gid=1000(lala) groups=1000(lala)
[root@base3 ~]# cat /etc/shadow | tail -n 1

[root@base2 ansible]# ssh-copy-id lala@base2 # 当我们给普通用户免密时，发现自己设置的密码不能使用

[root@base2 ansible]# passwd lala   # 所以我们还需要手动修改密码

[root@base3 ~]# passwd lala     # 修改远程主机用户密码

[root@base2 ansible]# ssh-copy-id lala@base2  # 免密成功 
同样的cp给base3

[root@base2 ansible]# ansible all -m ping

[root@base2 ansible]# vim /etc/sudoers   # 修改普通用户权限
92 lala    ALL=(ALL)       NOPASSWD: ALL
[root@base3 ~]# vim /etc/sudoers
92 lala    ALL=(ALL)       NOPASSWD: ALL

注：修改文件时，文件为只读，wq! 退出去即可

[root@base2 ansible]# ansible all -m ping -u lala -b     # -b表示切换为超户

[root@base2 ansible]# ansible all -u lala -b -a "hostname"

2. yum模块的使用（为远程主机安装httpd）

[root@base2 ansible]# ansible base3 -u lala -b -m yum -a "name=httpd state=present"
name=httpd    # 以普通用户的身份登录远程，并用-b切换为超户

在远程主机base3上查看是否安装成功

[root@base3 ~]# rpm -qa httpd    # 远程查看，安装成功
httpd-2.4.6-45.el7.x86_64

在ansible服务端远程开启httpd服务

[root@base2 ansible]# ansible base3 -u lala -b -m service -a "name=httpd state=started"  # 远程开启httpd服务

查看远程主机是否开启成功

[root@base3 ~]# netstat -antlp | grep httpd   # 查看远程主机，开启成功

修改默认发布目录，方便测试

[root@base2 ansible]# vim index.html
www.westos.org
[root@base2 ansible]# ansible base3 -u lala -b -m copy -a "src=index.html dest=/var/www/html/index.html"    # 远程修改默认发布目录

测试：

[root@foundation78 ~]# curl 172.25.78.13  # 测试
www.westos.org

3.安装数据库

[root@base2 ansible]# ansible base3  -m yum -a "name=mariadb-server state=present"  # 远程安装数据库
[root@base2 ansible]# ansible base3  -m service -a "name=mariadb state=started"   # 开启mysql
[root@base2 ansible]# ansible base3  -m mysql_user -a "name=haha password=westos priv=test.*:ALL state=present"   # 授权，执行失败，缺少模块

[root@base2 ansible]# ansible base3  -m yum  -a "name=MySQL-python state=present"  # 安装模块

[root@base2 ansible]# ansible base3  -m mysql_user -a "name=haha password=westos priv=test.*:ALL state=present"   # 重新授权

在远程主机上登录数据库查看

[root@base3 ~]# mysql
MariaDB [(none)]> use mysql
MariaDB [mysql]> select Host,User,Password  from user where User="haha";

4.整合模块（以httpd服务为例）

**我们之前的所有模块都是自己一个一个自己加的，这样太麻烦了，所以我们现在用playbooks来整合模块**

[root@base2 ansible]# pwd
/etc/ansible
[root@base2 ansible]# mkdir playbooks
[root@base2 ansible]# cd playbooks/
[root@base2 playbooks]# mkdir httpd
[root@base2 playbooks]# cd httpd/
[root@base2 httpd]# vim httpd.yml   # 一定要注意缩进

---

# httpd部署
- hosts: base3
  remote_user: root
  tasks:
    - name: install httpd
  yum:
    name: httpd
    state: present
- name: config httpd
  copy: src=httpd.conf dest=/etc/httpd/conf/httpd.conf
  notify: restart httpd
- name: start httpd
  service: name=httpd state=started

handlers:
- name: restart httpd
service:
name: httpd
state: restarted

[root@base2 httpd]# ansible-playbook httpd.yml --syntax-check  # 检测语法
[root@base2 httpd]# ansible-playbook httpd.yml --list-host   # 查看主机

[root@base2 httpd]# ansible-playbook httpd.yml --list-task   # 查看任务列表

[root@base2 httpd]# scp root@172.25.78.13:/etc/httpd/conf/httpd.conf /etc/ansible/playbooks/httpd/ # 运行文件

[root@base2 httpd]# ansible base3 -m setup # 查看base3上的所有远程信息
检测文件是否被篡改，查到的一样，说明没有被篡改

[root@base2 httpd]# md5sum httpd.conf       
f5e7449c0f17bc856e86011cb5d152ba  httpd.conf
[root@base3 conf]# md5sum httpd.conf
f5e7449c0f17bc856e86011cb5d152ba  httpd.conf





[root@base2 httpd]# ansible-playbook httpd.yml --start-at-task="start httpd"   # 指定任务执行，仅仅执行了安装的任务

[root@base2 httpd]# vim httpd.conf    # 修改端口号
 42 Listen 8080
[root@base2 httpd]# md5sum httpd.conf   # 检测到文件被篡改
04e9239e7bd5d5b9b85864226d60eee5  httpd.conf
[root@base2 httpd]# ansible-playbook httpd.yml   # 执行文件

在远程客户端查看，端口修改成功

[root@base3 conf]# netstat -antlp | grep httpd

四.jinja模块的使用

修改端口：
第一种方法：
[root@base2 httpd]# mv httpd.conf httpd.conf.j2 # j2=jinja2
[root@base2 httpd]# vim httpd.conf.j2
42 Listen {{ http_port }} # 调用端口变量
[root@base2 httpd]# vim httpd.yml
—
# httpd部署

- hosts: base3
  vars:
    http_port: 80      # 传入变量，这个变量会自动被识别
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd state=present
    - name: config httpd
      template: src=httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd
    - name: start httpd
      service: name=httpd state=started
  handlers:
    - name: restart httpd
      service: name=httpd state=restarted

[root@base2 httpd]# ansible-playbook httpd.yml --syntax-check
[root@base2 httpd]# ansible-playbook httpd.yml   # 执行成功

在远程客户端查看

[root@base3 conf]# netstat -antlp | grep 80   # 查看端口，修改成功

第二种方法：

[root@base2 httpd]# vim /etc/ansible/hosts 
[web]
base2 http_port=8080

[db]
base3
[root@base2 httpd]# vim httpd.yml 
	# httpd部署
- hosts: all
  vars:
    http_port: 80
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd state=present
    - name: config httpd
      template: src=httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd
    - name: start httpd
      service: name=httpd state=started
  handlers:
    - name: restart httpd
      service: name=httpd state=restarted

[root@base2 httpd]# netstat -antlp | grep 8080
[root@base2 httpd]# netstat -antlp | grep 80

如上效果显示，我们设置的8080端口没有生效，因为httpd.yml文件的优先级比hosts文件的优先级高，所以我们设定的端口并没有生效，我们可以换一种方法来实现

[root@base2 httpd]# pwd
/etc/ansible/playbooks/httpd
[root@base2 httpd]# vim /etc/ansible/hosts
[web]
base2 http_port=8080

[db]
base3 http_port=80

[root@base2 httpd]# vim httpd.yml 
---
# httpd部署
- hosts: all
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd state=present
    - name: config httpd
      template: src=httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd
    - name: start httpd
      service: name=httpd state=started
  handlers:
    - name: restart httpd
      service: name=httpd state=restarted

[root@base2 httpd]# ansible-playbook httpd.yml --syntax-check
[root@base2 httpd]# ansible-playbook httpd.yml
[root@base2 httpd]# netstat -antlp | grep 8080  # 端口修改成功

第三种方法(识别ip来修改端口)：

[root@base2 httpd]# vim httpd.conf.j2 
42 Listen {{ http_host }}:{{ http_port}}  #  调用ip和端口变量
[root@base2 httpd]# vim /etc/ansible/hosts 
[web]
base2 http_host=172.25.78.12

[db]
base3 http_host=172.25.78.13

[webserver:children]
web
db

[webserver:vars]
http_port=80

[root@base2 httpd]# vim httpd.yml 
---
# httpd部署
- hosts: all
  vars:
    http_port: 80
  remote_user: root
  tasks:
    - name: install httpd
      yum: name=httpd state=present
    - name: config httpd   
      template: src=httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
      notify: restart httpd
    - name: start httpd
      service: name=httpd state=started
  handlers:
    - name: restart httpd
      service: name=httpd state=restarted

[root@base2 httpd]# ansible-playbook httpd.yml --syntax-check
[root@base2 httpd]# ansible-playbook httpd.yml

查看两台主机端口是否都修改成功

[root@base2 httpd]# netstat -antlp | grep httpd

[root@base3 ~]# netstat -antlp | grep httpd