太厉害了,终于有人能把Ansible讲的明明白白了,建议收藏
14 篇文章 18 订阅
订阅专栏

文章目录
一: ansible 的概述
1. ansible简介
Ansible是一款为类Unix系统开发的自由开源的配置和自动化工具。
它用Python写成,类似于saltstack和Puppet,但是有一个不同和优点是我们不需要在节点中安装任何客户端。
它使用SSH来和节点进行通信。Ansible基于 Python paramiko 开发,分布式,无需客户端,轻量级,配置语法使用 YMAL 及 Jinja2模板语言,更强的远程命令执行操作。
2. 官方网站
https://www.ansible.com/

我们可以看到上面的红帽标志,红帽公司于2015年10月收购了ansible,而ansible成立于2013年。
3. ansible 的特点
1、部署简单,没有客户端,只需在主控端部署Ansible环境,被控端无需做任何操作;
2. 模块化:调用特定的模块,完成特定任务
3. 默认使用SSH协议对设备进行管理;
4. 主从集中化管理;
5、配置简单、功能强大、扩展性强;
6、支持API及自定义模块,可通过Python轻松扩展;
7、通过Playbooks来定制强大的配置、状态管理
8. 对云计算平台、大数据都有很好的支持;
9. 具有幂等性:一个操作在一个主机上执行一遍和执行N遍的结果是一样的
ansible是基于模块工作的,本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块,ansible只是提供一种框架。主要包括:
(1)、连接插件connection plugins:负责和被监控端实现通信;
(2)、host inventory:指定操作的主机,是一个配置文件里面定义监控的主机;
(3)、各种模块核心模块、command模块、自定义模块;
(4)、借助于插件完成记录日志邮件等功能;
(5)、playbook:剧本执行多个任务时,非必需可以让节点一次性运行多个任务
4. ansible的工作机制
Ansible 在管理节点将 Ansible 模块通过 SSH 协议推送到被管理端执行,执行完之后自动删除,可以使用 SVN 等来管理自定义模块及编排

由图可以看出Ansible的组成由一下模块组成:
Ansible: ansible的核心模块
Host Inventory:主机清单,也就是被管理的主机列表
Playbooks:ansible的剧本,可想象为将多个任务放置在一起,一块执行
Core Modules:ansible的核心模块
Custom Modules:自定义模块
Connection Plugins:连接插件,用于与被管控主机之间基于SSH建立连接关系
Plugins:其他插件,包括记录日志等
1
2
3
4
5
6
7
二. Asible的安装
1. 设置EPEL仓库
Ansible仓库默认不在yum仓库中,因此我们需要使用下面的命令启用epel仓库
[root@itlaoxin162 ~]# yum install epel-release -y
1
2. 使用yum安装Ansible
[root@itlaoxin162 ~]# yum install ansible
1
3. 查看ansible的版本
[root@itlaoxin162 ~]# ansible --version
ansible 2.9.18
1
2
3
ansible的命令参数
anisble命令语法: ansible [-i 主机文件] [-f 批次] [组名] [-m 模块名称] [-a 模块参数]
参数 | 功能 |
-v | 详细模式,如果执行成功,输出详细结果 |
-i | 指定host文件路径,默认在/etc/ansible/hosts |
-f,-forks=NUM | NUM默认是整数5,指定fork开启同步进程的个数 |
-m | 指定使用的module名称,默认command模块 |
-a | 指定模块的参数 |
-k | 提示输入SSH密码,而不是使用基于ssh密钥认证 |
-sudo | 指定使用sudo获取root权限 |
-K | 提示输入sudo密码 |
-u | 指定移动端的执行用户 |
-C | 测试命令执行会改变什么内容,不会真正的去执行 |
ansible-doc 详细参数
[root@itlaoxin162 ~]# ansible-doc -l
列出所有模块列表
指定查看某个模块的参数
ansible-doc -s 模块名字
[root@itlaoxin162 ~]# ansible-doc -s onyx_ospf
- name: Manage OSPF protocol on Mellanox ONYX network devices
onyx_ospf:
interfaces: # List of interfaces and areas. Required if `state=present'.
ospf: # (required) OSPF instance number 1-65535
router_id: # OSPF router ID. Required if `state=present'.
state: # OSPF state.
、
[root@itlaoxin162 ~]# ansible-doc -s service
- name: Manage services
service:
arguments: # Additional arguments provided on the command line.
enabled: # Whether the service should start on boot. *At least one of
state and enabled are
required.*
name: # (required) Name of the service.
pattern: # If the service does not respond to the status command,
name a substring to look
for as would be found in
the output of the `ps'
command as a stand-in for a
status result. If the
string is found, the
service will be assumed to
be started.
runlevel: # For OpenRC init scripts (e.g. Gentoo) only. The runlevel
that this service belongs
to.
sleep: # If the service is being `restarted' then sleep this many
seconds between the stop
三. ansible的使用
1. 基于端口,用户,密码定义主机清单
格式:
ansible基于ssh连接-i (inventory)参数后指定的远程主机时,也可以写端口,用户,密码。
如:
ansible_ssh_port: 指定ssh端口 ansible_ssh_user:指定 ssh 用户 ansible_ssh_pass: 指定 ssh 用户登录是认证密码(明文密码不安全) ansible_sudo_pass: 指明 sudo 时候的密码
添加的内容如下:
[root@itlaoxin162 ~]# grep -v ^# /etc/ansible/hosts |grep -v ^$
[web-servers]
192.168.1.163 ansible_ssh_port=22 ansible_ssh_user=root ansible_ssh_pass=12345678
[root@itlaoxin16
1
2
3
4
直接添加到文件文末就可以;
测试主机的连通性
[root@itlaoxin162 ~]# ansible -i /etc/ansible/hosts web-servers -m ping
[WARNING]: Invalid characters were found in group names but not replaced, us
see details
192.168.1.163 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
1
2
3
4
5
6
7
8
9
10
查看组下所有的IP:
[root@itlaoxin162 ~]# ansible all --list
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
hosts (1):
192.168.1.163
[root@itlaoxin162 ~]#
1
2
3
4
5
6
2. 基于ssh密钥来访问定义主机清单
设置密钥
[root@itlaoxin162 ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:CWdEZJbtzH4+ypeXe80jPnBr9UX/0yChZtX5DCjKckg root@itlaoxin162
The key's randomart image is:
+---[RSA 2048]----+
| o*o |
| +. . |
| . o+ o . |
| E+ .= + + .|
| . oSo + . =.|
| o + =.o...=|
| o o oooo+*|
| . ==ooB|
| ooo++oo|
+----[SHA256]-----+
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
拷贝密钥并测试
[root@itlaoxin162 ~]# ssh-copy-id root@192.168.1.163
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.1.163's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.1.163'"
and check to make sure that only the key(s) you wanted were added.
**登陆测试:**
[root@itlaoxin162 ~]# ssh 192.168.1.163
Last login: Wed Apr 21 08:13:14 2021 from 192.168.1.162
71服务器也发送密钥
[root@itlaoxin162 ~]# ssh-copy-id root@192.168.1.71
修改hosts
vim /etc/ansible/hosts

查看配置文件中刚刚修改的内容
[root@itlaoxin162 ~]# grep -v "^#" /etc/ansible/hosts |grep -v "^$"
[web-servers]
192.168.1.163
192.168.1.711
2
3
4
ansible远程执行命令测试
ping模块 主要用来检测网络的连通性
command模块,执行shell命令
使用ping检查‘web-servers’或者ansible节点的连通性。
[root@itlaoxin162 ~]# ansible -i /etc/ansible/hosts 'web-servers' -m ping
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.163 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.71 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
这条命令我们也可以不指定hosts,效果是一样的,我们只要指定组即可
[root@itlaoxin162 ~]# ansible 'web-servers' -m ping
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
192.168.1.163 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python"
},
"changed": false,
"ping": "pong"
}
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
有时候我们为了方便阅读也把主机组名写在最后面
web-servers 这个组名,放在最后面
[root@itlaoxin162 ~]# ansible -m command -a "uptime" 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
08:37:28 up 11 min, 3 users, load average: 0.02, 0.15, 0.17
192.168.1.163 | CHANGED | rc=0 >>
08:37:28 up 1:58, 5 users, load average: 0.00, 0.01, 0.05
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
案例1: 检查节点的内存情况
[root@itlaoxin162 ~]# ansible -m command -a "free -m " 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
total used free shared buff/cache available
Mem: 3770 826 2283 15 661 2709
Swap: 2047 0 2047
192.168.1.163 | CHANGED | rc=0 >>
total used free shared buff/cache available
Mem: 3770 892 1076 38 1802 2588
Swap: 2047 0 2047
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
10
11
12
13
案例2:给节点增加用户
[root@itlaoxin162 ~]# ansible -m command -a "useradd itoldxin" 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
192.168.1.163 | CHANGED | rc=0 >>
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
查看是否创建用户成功
[root@itlaoxin162 ~]# ansible -m command -a "id itoldxin" 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
uid=1001(itoldxin) gid=1001(itoldxin) 组=1001(itoldxin)
192.168.1.163 | CHANGED | rc=0 >>
uid=1001(itoldxin) gid=1001(itoldxin) 组=1001(itoldxin)
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
四. ansible的高级用法
1. ansible的常用模块
1) ansible的3个远程模块的区别
command : ansible的默认模块,不指定-m参数的时候,使用的就是command模块; 常见的命令都可以使用,但命令的执行不是通过shell来执行的,所以< > | and & z这些操作都不可以,不支持管道,没法批量执行命令
shell模块: 使用shell模块的时候默认是通过/bin/sh来执行的,所以在终端输入的各种命令都可以使用
scripts模块
使用scripts模块可以在本地写一个脚本,在远程服务器上执行
案例1:使用shell模块的案例
[root@itlaoxin162 ~]# ansible -i /etc/ansible/hosts web-servers -m shell -a "source ~/.bash_profile && df -h|head -n 1"
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
文件系统 容量 已用 可用 已用% 挂载点
192.168.1.163 | CHANGED | rc=0 >>
文件系统 容量 已用 可用 已用% 挂载点
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9
注意: shell也可以把一个脚本copy到远程端然后再执行,但这样的话就需要调用两次ansible,所以script的出现就解决了这个问题;
案例2:使用script 模块
先写一个脚本:
[root@itlaoxin162 ~]# cat !$
cat /etc/ansible/test.sh
#!/bin/bash
date
hostname
echo "大家好,我是互联网老辛,脚本执行成功"
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
执行查看结果:
可以看到已经执行成功
2) copy模块的使用
copy模块:实现主控端向目标主机拷贝文件,类似scp功能
案例1: 把ansible主机的/etc/hosts 拷贝到主机组机器中的/root/下
查看是否执行成功:
[root@itlaoxin162 ~]# ansible -m command -a "ls /root/hosts" 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
/root/hosts
192.168.1.163 | CHANGED | rc=0 >>
/root/hosts
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
注意: command 不能使用ll命令,但可以使用ls -l的命令
[root@itlaoxin162 ~]# ansible -m command -a "ls -l /root/hosts" 'web-servers'
[WARNING]: Invalid characters were found in group names but not replaced, use
-vvvv to see details
192.168.1.71 | CHANGED | rc=0 >>
-rwxrwxrwx. 1 root root 183 4月 21 09:03 /root/hosts
192.168.1.163 | CHANGED | rc=0 >>
-rwxrwxrwx. 1 root root 183 4月 21 09:03 /root/hosts
[root@itlaoxin162 ~]#
1
2
3
4
5
6
7
8
9