2020-01-17
此為ansible批量管理服務的第1個博客，發布博客為ansible批量管理服務入門
綜合架構（二）——ansible批量管理服務
一ansible批量管理服務功能
01.可以實現批量系統操作配置
02.可以實現批量軟件服務部署
03.可以實現批量文件數據分發
04.可以實現批量系統信息收集，資產管理
二ansible批量管理服務特點
01.管理端不需要啟動服務程序（no server）
02.管理端不需要編寫配置文件（/etc/ansible/ansible.cfg）
03.受控端不需要安裝軟件程序（libselinux-python）
04.受控端不需要啟動服務程序（no agent）
05.服務程序管理操作模塊眾多（module）
06.利用劇本編寫來實現自動化（playbook）
三批量管理軟件安裝部暑過程
[root@manager ~]# yum install -y ansible Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com base | 3.6 kB 00:00 epel | 5.4 kB 00:00 extras | 2.9 kB 00:00 updates | 2.9 kB 00:00 (1/2): epel/x86_64/updateinfo | 1.0 MB 00:01 (2/2): epel/x86_64/primary_db | 6.9 MB 00:02 Package ansible-2.9.2-1.el7.noarch already installed and latest version Nothing to do
涉及到的組件非常多
[root@manager ~]# rpm -ql ansible | wc
17280 17280 1446145 [root@manager ~]# rpm -ql ansible | head /etc/ansible /etc/ansible/ansible.cfg /etc/ansible/hosts /etc/ansible/roles /usr/bin/ansible /usr/bin/ansible-2 /usr/bin/ansible-2.7 /usr/bin/ansible-config /usr/bin/ansible-connection /usr/bin/ansible-console [root@manager ~]# rpm -ql ansible | tail /usr/share/doc/ansible-2.9.2/README.rst /usr/share/man/man1/ansible-config.1.gz /usr/share/man/man1/ansible-console.1.gz /usr/share/man/man1/ansible-doc.1.gz /usr/share/man/man1/ansible-galaxy.1.gz /usr/share/man/man1/ansible-inventory.1.gz /usr/share/man/man1/ansible-playbook.1.gz /usr/share/man/man1/ansible-pull.1.gz /usr/share/man/man1/ansible-vault.1.gz /usr/share/man/man1/ansible.1.gz [root@manager ~]#
查看ansible的版本
版本很重要，因為有些服務的版本可能隔一段時間就會發生變化，相關的功能也會變化
[root@manager ~]# ansible --version
ansible 2.9.2 config file = /etc/ansible/ansible.cfg configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python2.7/site-packages/ansible executable location = /usr/bin/ansible python version = 2.7.5 (default, Oct 30 2018, 23:45:53) [GCC 4.8.5 20150623 (Red Hat 4.8.5-36)]
注意只能使用長格式查看
[root@manager ~]# ansible -V
usage: ansible [-h] [--version] [-v] [-b] [--become-method BECOME_METHOD] [--become-user BECOME_USER] [-K] [-i INVENTORY] [--list-hosts] [-l SUBSET] [-P POLL_INTERVAL] [-B SECONDS] [-o] [-t TREE] [-k] [--private-key PRIVATE_KEY_FILE] [-u REMOTE_USER] [-c CONNECTION] [-T TIMEOUT] [--ssh-common-args SSH_COMMON_ARGS] [--sftp-extra-args SFTP_EXTRA_ARGS] [--scp-extra-args SCP_EXTRA_ARGS] [--ssh-extra-args SSH_EXTRA_ARGS] [-C] [--syntax-check] [-D] [-e EXTRA_VARS] [--vault-id VAULT_IDS] [--ask-vault-pass | --vault-password-file VAULT_PASSWORD_FILES] [-f FORKS] [-M MODULE_PATH] [--playbook-dir BASEDIR] [-a MODULE_ARGS] [-m MODULE_NAME] pattern ansible: error: too few arguments [root@manager ~]# ansible -v usage: ansible [-h] [--version] [-v] [-b] [--become-method BECOME_METHOD] [--become-user BECOME_USER] [-K] [-i INVENTORY] [--list-hosts] [-l SUBSET] [-P POLL_INTERVAL] [-B SECONDS] [-o] [-t TREE] [-k] [--private-key PRIVATE_KEY_FILE] [-u REMOTE_USER] [-c CONNECTION] [-T TIMEOUT] [--ssh-common-args SSH_COMMON_ARGS] [--sftp-extra-args SFTP_EXTRA_ARGS] [--scp-extra-args SCP_EXTRA_ARGS] [--ssh-extra-args SSH_EXTRA_ARGS] [-C] [--syntax-check] [-D] [-e EXTRA_VARS] [--vault-id VAULT_IDS] [--ask-vault-pass | --vault-password-file VAULT_PASSWORD_FILES] [-f FORKS] [-M MODULE_PATH] [--playbook-dir BASEDIR] [-a MODULE_ARGS] [-m MODULE_NAME] pattern ansible: error: too few arguments
ansible軟件學習說明:
1) 掌握ansible主機清單配置: 指定ansible程序可以批量管理哪些主機
https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html
2) 掌握ansible常用功能模塊: 實現批量管理功能模塊
https://docs.ansible.com/ansible/latest/modules/modules_by_category.html
3) 掌握ansible劇本編寫方法: 實現自動化批量管理功能
https://docs.ansible.com/ansible/latest/user_guide/playbooks.html
四網站主機清單配置
（一）方式一：直接在配置文件/etc/ansible/hosts寫入主機地址
[root@manager ~]# tail /etc/ansible/hosts # Here's another example of host ranges, this time there are no # leading 0s: ## db-[99:101]-node.example.com 172.16.1.7 172.16.1.8 172.16.1.31 172.16.1.41
m表示module
[root@manager ~]# ansible --help | grep "\-m " [-a MODULE_ARGS] [-m MODULE_NAME] -m MODULE_NAME, --module-name MODULE_NAME
在命令行檢測
ping 模塊：測試主機之間的連通性
參考：https://docs.ansible.com/ansible/latest/modules/ping_module.html#ping-module
[root@manager ~]# ansible all -m ping
172.16.1.41 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" }
[root@manager ~]# ansible 172.16.1.8 -m ping 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.7 -m ping 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.31 -m ping 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.41 -m ping 172.16.1.41 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]#
注意命令的順序不能寫錯的
[root@manager ~]# ansible -m 172.16.1.7 ping [WARNING]: Could not match supplied host pattern, ignoring: ping [WARNING]: No hosts matched, nothing to do [root@manager ~]# ansible -m 172.16.1.8 ping [WARNING]: Could not match supplied host pattern, ignoring: ping [WARNING]: No hosts matched, nothing to do [root@manager ~]#
（二）方式二：基於密碼方式進行配置
參考官網，比較麻煩
把公鑰刪除，這是在受控端沒有管理端的公鑰的情況下配置的
以備份服務器為受控端
[root@nfs01 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:b9:d6:60 brd ff:ff:ff:ff:ff:ff inet 10.0.0.31/24 brd 10.0.0.255 scope global noprefixroute eth0 valid_lft forever preferred_lft forever inet6 fe80::d2e4:6879:ac85:c625/64 scope link tentative noprefixroute dadfailed valid_lft forever preferred_lft forever inet6 fe80::8c8d:c31b:a121:ca62/64 scope link tentative noprefixroute dadfailed valid_lft forever preferred_lft forever inet6 fe80::9d5f:63cb:4c46:8ce7/64 scope link noprefixroute valid_lft forever preferred_lft forever 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:b9:d6:6a brd ff:ff:ff:ff:ff:ff inet 172.16.1.31/24 brd 172.16.1.255 scope global noprefixroute eth1 valid_lft forever preferred_lft forever inet6 fe80::e654:55e2:8c88:ecfb/64 scope link tentative noprefixroute dadfailed valid_lft forever preferred_lft forever inet6 fe80::5e65:529b:4fae:7fc3/64 scope link tentative noprefixroute dadfailed valid_lft forever preferred_lft forever inet6 fe80::787b:a3a1:ead:b12e/64 scope link noprefixroute valid_lft forever preferred_lft forever
[root@nfs01 ~]# ls /root/.ssh/ authorized_keys [root@nfs01 ~]# ll /root/.ssh/ -bash: ll: command not found [root@nfs01 ~]# ls -l /root/.ssh/ total 4 -rw------- 1 root root 394 Jan 16 22:47 authorized_keys [root@nfs01 ~]# cat /root/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDhE06kiM6UKlnZqGPBahZuAgq+LHdSssZrInWpkecC5buh2RRzl2NOiXCWNhEIwNgIJjLGsnITrTOyRsOel94oUYHR4iSPPhAe8yVuTZA8fS9ti1goIKt6/UYhi6bbNmFiqWPlSq1EIgpNvlWaDjHIchdIHR/lbgP3Wjg2PPI2QtzR5/SZJOI0g/GTJw1FDGXpYUlz608YTo79tl15zUAGT5rLiu5ugXY28HGQbPru5xA+BQZyzKu4jInllM8WzLimpFb7WX8HagwSU2S/Hx2+HSzEbMHXqz0tm8WbQogEO78gv0cJ6USq8vyc1ueq/Jn27gDu3ygPXtcSCn0XKpZJ root@manager
[root@manager ~]# tail -1 /etc/ansible/hosts 172.16.1.31 [root@manager ~]# ansible 172.16.1.31 -m ping 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" }
刪除受控端的管理端對應的公鑰
[root@nfs01 ~]# rm -f /root/.ssh/authorized_keys [root@nfs01 ~]# ls /root/.ssh/authorized_keys ls: cannot access /root/.ssh/authorized_keys: No such file or directory
此時管理端要輸入密碼才可以登錄到受控端
[root@manager ~]# ssh 172.16.1.31 root@172.16.1.31's password: Last login: Sun Jan 26 17:30:17 2020 from 172.16.1.61 [root@nfs01 ~]# exit logout Connection to 172.16.1.31 closed.
修改配置文件並且進行
[root@manager ~]# tail -1 /etc/ansible/hosts 172.16.1.31 ansible_user=root ansible_password=123456 ansible_port=22 [root@manager ~]# ansible 172.16.1.31 -m ping 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" }
（三）方式三: 采用主機組方式配置
分組進行操作，和班級進行分組管理一樣，管理起來更加方便
[root@manager ~]# tail /etc/ansible/hosts ## db-[99:101]-node.example.com [web] 172.16.1.7 172.16.1.8 [nfs] 172.16.1.31 [backup] 172.16.1.41
執行命令
[root@manager ~]# ansible web -m ping
172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible nfs -m ping 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible backup -m ping 172.16.1.41 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" }
主機子組配置，對組進行管理
[root@manager ~]# tail -15 /etc/ansible/hosts # leading 0s: ## db-[99:101]-node.example.com [client:children] web nfs backup [web] 172.16.1.7 172.16.1.8 [nfs] 172.16.1.31 [backup] 172.16.1.41
執行命令
[root@manager ~]# ansible client -m ping
172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } 172.16.1.41 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" }
（四）方式四：采用匹配方式配置主機信息
[7:20]表示IP地址最后一位為7到20的主機
[root@manager ~]# tail -1 /etc/ansible/hosts 172.16.1.[7:20]
執行命令
31，41沒有匹配
[root@manager ~]# ansible 172.16.1.7 -m ping 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.8 -m ping 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.31 -m ping [WARNING]: Could not match supplied host pattern, ignoring: 172.16.1.31 [WARNING]: No hosts matched, nothing to do [root@manager ~]# ansible 172.16.1.41 -m ping [WARNING]: Could not match supplied host pattern, ignoring: 172.16.1.41 [WARNING]: No hosts matched, nothing to do
[root@manager ~]# tail -1 /etc/ansible/hosts 172.16.1.[1:20] [root@manager ~]# ansible 172.16.1.7 -m ping 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.8 -m ping 172.16.1.8 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "ping": "pong" } [root@manager ~]# ansible 172.16.1.31 -m ping [WARNING]: Could not match supplied host pattern, ignoring: 172.16.1.31 [WARNING]: No hosts matched, nothing to do [root@manager ~]# ansible 172.16.1.41 -m ping [WARNING]: Could not match supplied host pattern, ignoring: 172.16.1.41 [WARNING]: No hosts matched, nothing to do
五批量管理服務應用方法
批量管理命令語法結構:
ansible 管理主機信息/主機組信息 -m 模塊名稱 -a "模塊參數"
[root@manager ~]# tail /etc/ansible/hosts # Here's another example of host ranges, this time there are no # leading 0s: ## db-[99:101]-node.example.com [client] 172.16.1.7 172.16.1.8 172.16.1.31 172.16.1.41
（一）command模塊 (默認)
[root@manager ~]# ansible client -a "free -h" 172.16.1.7 | CHANGED | rc=0 >> total used free shared buff/cache available Mem: 972M 138M 591M 7.7M 242M 651M Swap: 1.5G 0B 1.5G 172.16.1.31 | CHANGED | rc=0 >> total used free shared buff/cache available Mem: 972M 140M 642M 7.7M 189M 647M Swap: 1.5G 0B 1.5G 172.16.1.41 | CHANGED | rc=0 >> total used free shared buff/cache available Mem: 972M 136M 673M 7.7M 162M 665M Swap: 1.5G 0B 1.5G 172.16.1.8 | CHANGED | rc=0 >> total used free shared buff/cache available Mem: 972M 140M 662M 7.7M 169M 657M Swap: 1.5G 0B 1.5G
[root@manager ~]# ansible client -m shell -a "rm -rf /tmp/*" [WARNING]: Consider using the file module with state=absent rather than running 'rm'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message. 172.16.1.7 | CHANGED | rc=0 >> 172.16.1.8 | CHANGED | rc=0 >> 172.16.1.31 | CHANGED | rc=0 >> 172.16.1.41 | CHANGED | rc=0 >> [root@manager ~]# ansible client -m shell -a "ls /tmp/*" 172.16.1.8 | CHANGED | rc=0 >> ansible_command_payload.zip 172.16.1.7 | CHANGED | rc=0 >> ansible_command_payload.zip 172.16.1.41 | CHANGED | rc=0 >> ansible_command_payload.zip 172.16.1.31 | CHANGED | rc=0 >> ansible_command_payload.zip
[root@manager ~]# ansible client -m command -a "pwd" 172.16.1.41 | CHANGED | rc=0 >> /root 172.16.1.7 | CHANGED | rc=0 >> /root 172.16.1.8 | CHANGED | rc=0 >> /root 172.16.1.31 | CHANGED | rc=0 >> /root
模塊參數:chdir: 在執行批量管理命令時, 先進行目錄切換
[root@manager ~]# ansible client -m command -a "chdir=/tmp pwd" 172.16.1.41 | CHANGED | rc=0 >> /tmp 172.16.1.7 | CHANGED | rc=0 >> /tmp 172.16.1.31 | CHANGED | rc=0 >> /tmp 172.16.1.8 | CHANGED | rc=0 >> /tmp
creates: 判斷指定文件是否存在, 如果不存在,就執行后面命令；存在就不執行后面命令
和判斷語句類似
[root@manager ~]# ansible client -m command -a "creates=/tmp/happy.txt touch /tmp/happy.txt" [WARNING]: Consider using the file module with state=touch rather than running 'touch'. If you need to use command because file is insufficient you can add 'warn: false' to this command task or set 'command_warnings=False' in ansible.cfg to get rid of this message. 172.16.1.31 | CHANGED | rc=0 >> 172.16.1.7 | CHANGED | rc=0 >> 172.16.1.41 | CHANGED | rc=0 >> 172.16.1.8 | CHANGED | rc=0 >>
[root@manager ~]# ansible client -m command -a "chdir=/tmp ls" 172.16.1.41 | CHANGED | rc=0 >> ansible_command_payload_dKZhze happy.txt 172.16.1.8 | CHANGED | rc=0 >> ansible_command_payload_0Y2P6b happy.txt 172.16.1.7 | CHANGED | rc=0 >> ansible_command_payload_sagI1X happy.txt 172.16.1.31 | CHANGED | rc=0 >> ansible_command_payload_1XAqCp happy.txt
再次執行會跳過了
[root@manager ~]# ansible client -m command -a "creates=/tmp/happy.txt touch /tmp/happy.txt" 172.16.1.31 | SUCCESS | rc=0 >> skipped, since /tmp/happy.txt exists 172.16.1.8 | SUCCESS | rc=0 >> skipped, since /tmp/happy.txt exists 172.16.1.7 | SUCCESS | rc=0 >> skipped, since /tmp/happy.txt exists 172.16.1.41 | SUCCESS | rc=0 >> skipped, since /tmp/happy.txt exists
批量執行腳本
第一個步驟：編寫腳本
第二個步驟：將腳本推送到被管理主機上
第三個步驟：將腳本文件權限進行設置
第四個步驟：批量執行腳本
https://docs.ansible.com/ansible/latest/modules/shell_module.html#shell-module
（二）shell模塊（萬能模塊）
作用說明：批量執行命令，可以識別特殊符號
[root@manager ~]# ansible-doc --help | grep "\-s" [-j] [-F | -l | -s | --metadata-dump] prepend colon-separated path(s) to module library (def -s, --snippet Show playbook snippet for specified plugin(s)
[root@manager ~]# ansible-doc -s shell
- name: Execute shell commands on targets shell: chdir: # Change into this directory before running the command. cmd: # The command to run followed by optional arguments. creates: # A filename, when it already exists, this step will *not* be run. executable: # Change the shell used to execute the command. This expects an absolute path to the executable. free_form: # The shell module takes a free form command to run, as a string. There is no actual parameter named 'free form'. See the examples on how to use this module. removes: # A filename, when it does not exist, this step will *not* be run. stdin: # Set the stdin of the command directly to the specified value. stdin_add_newline: # Whether to append a newline to stdin data. warn: # Whether to enable task warnings. (END)
把管理端的腳本傳輸到受控端的目錄里面
先查看目錄是否存在
[root@manager ~]# ansible client -m shell -a "ls -d /shell_scripts" 172.16.1.8 | CHANGED | rc=0 >> /shell_scripts 172.16.1.7 | CHANGED | rc=0 >> /shell_scripts 172.16.1.31 | CHANGED | rc=0 >> /shell_scripts 172.16.1.41 | CHANGED | rc=0 >> /shell_scripts
正式進行文件傳輸
[root@manager ~]# time ansible client -m copy -a 'src=/shell_scripts/install.sh dest=/shell_scripts' 172.16.1.41 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "checksum": "d8930d18657635c362456d4e25091679006031e8", "dest": "/shell_scripts/install.sh", "gid": 0, "group": "root", "mode": "0755", "owner": "root", "path": "/shell_scripts/install.sh", "size": 36, "state": "file", "uid": 0 } 172.16.1.7 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "checksum": "d8930d18657635c362456d4e25091679006031e8", "dest": "/shell_scripts/install.sh", "gid": 0, "group": "root", "mode": "0644", "owner": "root", "path": "/shell_scripts/install.sh", "size": 36, "state": "file", "uid": 0 } 172.16.1.31 | SUCCESS => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python" }, "changed": false, "checksum": "d8930d18657635c362456d4e25091679006031e8", "dest": "/shell_scripts/install.sh", "gid": 0, "group": "root", "mode": "0755", "owner": "root", "path": "/shell_scripts/install.sh", "size": 36, "state": "file