Ansible 自动化运维笔记(总结)

[实验环境]

[状态]    [主机列表]        [python版本]

控制机 192.168.1.10        Python2.6/2.7

被控机 192.168.1.20        Python2.4
被控机 192.168.1.30        Python2.4

[root@localhost ~]# ssh-keygen -t rsa
[root@localhost ~]# ls -lh .ssh/*
-rw-------. 1 root root  408 May 18 20:10 .ssh/authorized_keys
-rw-------. 1 root root 1.7K May 18 20:19 .ssh/id_rsa
-rw-r--r--. 1 root root  408 May 18 20:19 .ssh/id_rsa.pub

[root@localhost ~]# ssh-copy-id root@192.168.1.20
[root@localhost ~]# ssh-copy-id root@192.168.1.30

[root@localhost ~]# cd /usr/src/ansible-2.5.0/examples
[root@localhost exampless]# mkdir /etc/ansible
[root@localhost exampless]# cp -a ansible.cfg hosts /etc/ansible

[root@localhost ~]# vim /etc/ansible/hosts
 
192.168.1.20      #写入单个IP地址
192.168.1.30

[webserver]       #指定一个组
192.168.1.20
192.168.1.30

[admin]           #指定一个范围
192.168.1.[1:100]

[root@localhost ~]# vim /etc/ansible/ansible.cfg

61 # uncomment this to disable SSH key host checking
62 host_key_checking = False        #禁用每次执行命令检查ssh,取消注释

100 # logging is off by default unless this path is defined
101 # if so defined, consider logrotate
102 log_path = /var/log/ansible.log  #开启日志记录功能,取消注释

[root@localhost ~]# ansible all -m ping

192.168.1.20 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}
192.168.1.30 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}

[root@localhost ~]# ansible webserver -m ping

192.168.1.20 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}
192.168.1.30 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}

#!/usr/bin/expect

set timeout 10
set hostname [lindex $argv 0]
set username [lindex $argv 1]
set password [lindex $argv 2]

spawn ssh-copy-id $username@$hostname

expect {
            "Are you sure you want to continue connecting (yes/no)?" {
            send "yes\r"
            expect "*password:"
            send "$password\r"
            }

            "*password:" {
            send "$password\r"
            }
            "Now try logging into the machine" {
            }
        }
expect eof

#!/bin/bash

USER=root
PASSWD=1233

# yum install -y expect

for HOST in 192.168.1.{1..10}
do
        echo "------------------>" $HOST "-----------------------------"
/usr/bin/expect -c "
spawn ssh-copy-id $USER@$HOST;
expect {
            \"Are you sure you want to continue connecting (yes/no)?\" {
            send \"yes\r\"
            expect \"*password:\"
            send \"$PASSWD\r\"
            }

            \"*password:\" {
            send \"$PASSWD\r\"
            }
            \"Now try logging into the machine\" {
            }
        }
expect eof
"
done

[root@localhost ~]# cat -n /etc/ansible/hosts

1 192.168.1.10 ansible_ssh_pass='123123'
2 192.168.1.20 ansible_ssh_pass='123123'
3 
4 [docker]
5 172.168.1.10[1:9]

6 [docker:vars]
7 ansible_ssh_pass='123123'


8 [web_server]
9  192.168.10.10
10 192.168.10.20
11 192.168.10.30

[root@Client ~]# vim /etc/ssh/sshd_config
Port 10086
Port 22

[root@Client ~]# systemctl restart sshd

[root@Ansible ~]# vim /etc/ansible/hosts

[web_server]
192.168.10.10:10086
192.168.10.20:10086

[web_server:vars]
ansible_ssh_pass='123123'

[root@localhost ~]# vim /etc/ansible/hosts

[web_server]
192.168.10.10 ansible_ssh_port=10086 ansible_ssh_user=root ansible_ssh_pass='123123'

[docker_server]
192.168.10.10
192.168.10.20

[docker_server:vars]
ansible_ssh_port=10086
ansible_ssh_user=root
ansible_ssh_pass='123123'

[root@localhost ~]# ansible all -m shell -a "chdir=/boot ls"

[root@localhost ~]# ansible all -m shell -a "executable=/bin/bash uname -r"
[root@localhost ~]# ansible all -m shell -a "executable=/bin/bash uname -r" -o

[root@localhost ~]# cat data.sh 
#!/bin/bash

date

[root@localhost ~]# ansible all -m script -a "/root/data.sh"

[root@localhost ~]# ansible all -m script -a "creates=/etc/passwd /root/data.sh"
[root@localhost ~]# ansible all -m script -a "removes=/etc/passwd /root/data.sh"

ansible all -m file -a "path=/tmp/lyshark.log state=touch"

ansible all -m file -a "path=/tmp/lyshark state=directory"

ansible all -m file -a "src=/bin/bash path=/tmp/lyshark.link state=link"

ansible all -m file -a "src=/bin/bash path=/tmp/lyshark.hard state=hard"

ansible all -m file -a "src=/bin/bash path=/tmp/lyshark.hard state=hard force=yes"

ansible all -m file -a "path=/tmp/lyshark.hard state=absent"

ansible all -m shell -a "rm -fr /tmp/*" -o      #清空演示目录
ansible all -m shell -a "useradd admin"         #创建一个用户与组
ansible all -m file -a "path=/tmp/lyshark state=directory owner=root group=admin"
ansible all -m file -a "path=/tmp/lyshark mode=777"

ansible all -m file -a "path=/tmp/lyshark state=directory owner=admin group=admin mode=777 recurse=yes"

ansible all -m copy -a "src=/etc/passwd dest=/tmp"
#注:如果执行失败,请在被控机上安装 yum install libselinux-python -y

ansible all -m copy -a 'content="www.mkdirs.com\nby:LyShark\n" dest=/tmp/passwd'

ansible all -m copy -a 'src=/etc/shadow dest=/tmp/shadow owner=admin group=admin mode=777'

ansible all -m fetch -a "src=/bin/bash dest=/root"

ansible all -m find -a 'paths=/etc contains="*passwd*"'

ansible all -m find -a 'paths=/etc contains="*passwd*" recurse=yes'

ansible all -m find -a 'paths=/etc patterns="*.sh" file_type=any hidden=yes'

ansible all -m find -a 'paths=/etc patterns="*.sh" file_type=any hidden=yes'

ansible all -m find -a 'paths=/etc age=-1d recurse=yes'

ansible all -m find -a 'paths=/etc size=1m recurse=yes'

ansible all -m find -a 'paths=/etc patterns=*.sh get_checksum=yes hidden=yes recurse=yes'

[root@localhost ~]# ansible all -m unarchive -a "src=/root/lyshark.tar.gz dest=/tmp/ mode=777"

ansible all -m replace -a 'path=/tmp/lyshark.log regexp="www" replace="wangrui" backup=yes'

ansible all -m lineinfile -a 'path=/etc/selinux/config regexp="^SELINUX=" line="SELINUX=disabled"'

ansible all -m lineinfile -a 'path=/etc/selinux/config regexp="EOF" line="mkdirs.com"'

ansible all -m lineinfile -a 'path=/etc/selinux/config regexp="BOF" line="mkdirs.com"'

ansible all -m lineinfile -a 'path=/etc/selinux/config regexp="^mkdirs.com" state=absent'

ansible all -m lineinfile -a 'path=/etc/selinux/config insertafter="^SELINUX=" line="mkdirs.com"'

ansible all -m lineinfile -a 'path=/etc/selinux/config insertbefore="^SELINUX=" line="mkdirs.com"'

[root@localhost ~]# ansible all -m setup

[root@localhost ~]# ansible all -m setup -a "filter=ansible_all_ipv4_addresses"
[root@localhost ~]# ansible all -m setup -a "filter=ansible_all_ipv6_addresses"

[root@localhost ~]# ansible all -m setup -a "filter=ansible_memory_mb"

[root@localhost ~]# ansible all -m setup -a "filter=*mb"

[root@localhost ~]# ansible all -m setup -a "filter=ansible_ens32"

[root@localhost ~]# ansible all -m yum -a "name=httpd state=installed" -o
[root@localhost ~]# ansible all -m shell -a "rpm -qa httpd" -o

[root@localhost ~]# ansible all -m yum -a "name=httpd state=removed" -o
[root@localhost ~]# ansible all -m shell -a "rpm -qa httpd" -o

ansible all -m cron -a "name='mkdirs test' minute=5 hour=1 job='echo hello lyshark'"

ansible all -m cron -a "name='mkdirs test1' minute=1 hour=1 day=*/3 job='echo wangrui'"

ansible all -m cron -a "name='mkdirs test1' state=absent backup=yes"

ansible all -m shell -a "crontab -l" -o

ansible all -m cron -a "name='test cron' job='/bin/bash /tmp/lyshark.sh' weekday=6"
ansible all -m cron -a "name='test admin' job='/bin/bash /tmp/lyshark.sh' weekday=6 minute=30 hour='*/8'"
ansible all -m cron -a "name='test cron' job='/bin/bash /tmp/lyshark.sh' minute=30 hour='*/8' day='1,10,20' weekday=6"

[root@localhost ~]# ansible all -m service -a "name=httpd runlevel=3 state=started enabled=yes"

[root@localhost ~]# ansible all -m service -a "name=httpd runlevel=3 state=stopped enabled=no"

[root@localhost ~]# ansible all -m get_url -a "url=http://mirrors.aliyun.com/repo/Centos-7.repo dest=/root"

[root@localhost playbook]# vim hosts

[lamp]
192.168.1.31
192.168.1.32

[lamp:vars]
ansible_ssh_port=22
ansible_ssh_user=root
ansible_ssh_pass='1233'

[root@localhost playbook]# vim main.yml

## 初始化,关闭防火墙,和SELinux
 - hosts: lamp
   tasks:
     - name: off selinux and iptables
       shell: setenforce 0 && iptables -F
     - name: permanent off selinux
       lineinfile:
            dest: /etc/selinux/config
            regexp: '^SELINUX='
            line: 'SELINUX=disabled'
#----------------------------------------------------------
 - hosts: lamp
   tasks:
     - name: shell install lamp
       shell: yum install -y apr apr-util httpd mariadb mariadb-server php php-mysql
     - name: copy index.html index.php
       copy: src={{item.src}} dest={{item.dest}} owner=root group=root mode=644
       with_items:
           - {src: ./index.html,dest: /var/www/html/index.html}
           - {src: ./index.php,dest: /var/www/html/index.php}
     - name: start httpd,mariadb
       shell: systemctl restart httpd mariadb
     - name: set mysql password
       shell: mysql -e "set password=password('123123');"

       notify:                # 上一条命令执行成功发送notify消息
          - run httpd
          - run mariadb

   handlers:                  # 接到指定的消息并执行相应的过程
      - name: run httpd
        service: name=httpd state=restarted
      - name: run mariadb
        service: name=mariadb state=restarted

[root@localhost playbook]# ansible-playbook -i hosts main.yml --syntax-check
[root@localhost playbook]# ansible-playbook -i hosts main.yml --list-task
[root@localhost playbook]# ansible-playbook -i hosts main.yml --list-hosts

[root@localhost playbook]# ansible-playbook -i hosts main.yml

[root@localhost playbook]# cat hosts
[zabbix_client]
192.168.1.31
192.168.1.32

[zabbix_client:vars]
ansible_ssh_port=22
ansible_ssh_user=root
ansible_ssh_pass='1233'

---
 - hosts: zabbix_client
   #remote_user: root              #指定远程SSH认证用户
   #sudo: yes                      #启用Sudo操作
   #sudo_user: lyshark             #指定Sudo的用户
   vars:
     - ServerIP: 192.168.1.30
   tasks:
     - name: wget zabbix-agent-4.0.0-2.el7.x86_64.rpm
       get_url: url="http://repo.zabbix.com/zabbix/4.0/rhel/7/x86_64/zabbix-agent-4.0.0-2.el7.x86_64.rpm" dest="/tmp"
     - name: install zabbix-agent-4.0.0-2.el7.x86_64.rpm
       shell: rpm -i /tmp/zabbix-agent-4.0.0-2.el7.x86_64.rpm

     - name: edit zabbix_agentd.conf
       lineinfile:
            dest: /etc/zabbix/zabbix_agentd.conf
            regexp: 'Server=127.0.0.1'
            line: 'Server={{ServerIP}}'
     - name: edit zabbix_agentd.conf
       lineinfile:
            dest: /etc/zabbix/zabbix_agentd.conf
            regexp: 'ServerActive=127.0.0.1'
            line: 'ServerActive={{ServerIP}}'
     - name: edit zabbix_agentd.conf
       lineinfile:
            dest: /etc/zabbix/zabbix_agentd.conf
            regexp: 'Hostname=Zabbix server'
            line: 'Hostname={{ServerIP}}'

     - name: start zabbix
       shell: /usr/sbin/zabbix_agentd
     - name: enable zabbix
       shell: echo "/usr/sbin/zabbix_agentd" >> /etc/bashrc

[root@localhost playbook]# ansible-playbook -i hosts main.yml --syntax-check
[root@localhost playbook]# ansible-playbook -i hosts main.yml --list-task
[root@localhost playbook]# ansible-playbook -i hosts main.yml --list-hosts

[root@localhost playbook]# ansible-playbook -i hosts main.yml