Ansible基础入门

# 至少需要两台主机，以servera和serverb演示
# 以使用CentOS7.6系统及华为开源镜像站源作为演示
0.前置操作
配置好固定IP
添加hosts域名解析
vim /etc/hosts		# 将两台主机IP和主机名添加

1.配置yum源
wget -O /etc/yum.repos.d/CentOS-Base.repo https://repo.huaweicloud.com/repository/conf/CentOS-7-reg.repo

yum clean all

yum makecache

2.配置epel源
sed -i "s/#baseurl/baseurl/g" /etc/yum.repos.d/epel.repo

sed -i "s/metalink/#metalink/g" /etc/yum.repos.d/epel.repo

sed -i "s@https\?://download.fedoraproject.org/pub@https://repo.huaweicloud.com@g" /etc/yum.repos.d/epel.repo

yum update

3.安装ansible
yum install ansible

4.确认安装
ansible -v

5.Ansible与其他不同，获取的配置文件会从多个地方查找作为学习测试使用可以将其复制之后修改（之后执行需到复制的目录下）
mkdir /example

cp -r /etc/ansible /example

6.免密
ssh-keygen -t rsa		# 全部回车

cd /root/.ssh

ssh-copy-id -i ~/.ssh/id_rsa.pub root@serverb

ssh	root@serverb

ssh-keygen -t rsa		# 全部回车

cd /root/.ssh

ssh-copy-id -i ~/.ssh/id_rsa.pub root@servera

exit

cd /example

ls /example
ansible.cfg  hosts  roles

ansible.cfg		#Ansible配置文件
hosts		    #主机清单（可以自己修改，需要在配置文件中配置为对应地址即可）
roles			#存放角色的文件夹

[defaults]										   # 通用配置

[inventory]										   # 主机清单相关

[privilege_escalation]							    # 提权相关

[paramiko_connection]							    # 早期连接方式（RHEL6）

[ssh_connection]								    # ssh链接配置

[persistent_connection]								# 持久链接配置

[accelerate]									   # 加速链接配置

[selinux]										   # selinux配置项

[colors]										   # 定义执行后输出结果的颜色

[diff]											   # 差异比较

[defaults] 

inventory   = ./hosts  # 主机清单的位置（基于当前目录）

ask_pass    = false   # false表示秘钥验证 true 密码验证

remote_user =  root  # 表示使用root来ssh管理被控也可以自行创建其他远程用户

log_path    = /var/log/ansible.log   # 指定ansible的日志文件位置

host_key_checking = False # 如果是第一次ssh链接被控，自动信任主机公钥

[privilege_escalation]

become=True  # 开启提权

become_method=sudo # 提权的方式sudo

become_user=root   # 提权到root

become_ask_pass=False  # 提权不需要密码

[ssh_connection]

ssh_args = -C -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no   # ssh的加速链接项

ansible   servera    -m    user   -a    ‘name=devops’    -u   root     -k

ansible-doc	-l					# 查看所有模块

ansible-doc	-s	module		     # 查看某个模块参数

ansible-doc	module				# 模块详细用法

ansible	all	-m	yum_repository	-a	"name=BASEOS description='BaseOS' file=rhel_dvd baseurl=file:///media/cdrom/BaseOS gpgcheck=yes gpgkey=file:///media/cdrom/RPM-GPG-KEY-redhatrelease enable=yes"

ansible	all	-m	yum_repository	-a	"name=APPSTREAM description='AppStream' file=rhel_dvd baseurl=file:///media/cdrom/AppStream gpgcheck=yes gpgkey=file:///media/cdrom/RPM-GPG-KEY-redhatrelease enable=yes"

ansible-playbook	xxx.yml

ansible-playbook	--syntax-check	xxx.yml

ansible-playbook	-C	xxx.yml

- name: Example Playbook		# playbook的名称，一般描述剧本内容
  hosts: servera				# 指定执行的主机或者主机组
  remote_user: root				# 连接的用户
  
  tasks:						# 执行的任务
    - name: Create user				# 此任务模块的描述信息
      user:						# 使用了user这个模块
        name: zhangsan				# 模块内参数：创建名字叫张三的用户
        state: present				# 模块内参数：动作为创建用户
        shell: /bin/bash			# 模块内参数：指定shell为bash shell

    - name: Install package			# 此任务模块描述信息
      yum:							# 使用yum这个模块
        name: httpd					# 模块内参数：对httpd进行操作
        state: present				# 模块内参数：动作为安装

# 通用的标准格式模板
- name: Playbook name   # Playbook描述信息
  hosts: target_hosts   # 指定目标主机或主机组
  become: yes           # 是否切换到特权（sudo）模式
  remote_user: username # 指定远程连接的用户名

  vars:                 # 变量定义
    var_name: var_value
    another_var: another_value

  tasks:                # 任务列表
    - name: Task name
      module_name:
        module_parameter: value
      register: variable_name

    - name: Another task
      module_name:
        module_parameter: value
      when: condition

  handlers:             # 处理程序
    - name: Handler name
      notify:
        - Task name

  roles:                # 引用角色
    - role1
    - role2

- name: 执行 Shell 命令
  shell: ls -l /path/to/directory

- name: 执行脚本
  script: /path/to/script.sh

- name: 创建目录
  file:
    path: /path/to/directory
    state: directory
    mode: '0755'

- name: 创建文件
  file:
    path: /path/to/file.txt
    state: touch
    mode: '0644'

- name: 修改文件权限
  file:
    path: /path/to/file.txt
    mode: '0755'

- name: 修改文件所有权
  file:
    path: /path/to/file.txt
    owner: new_owner
    group: new_group

- name: 复制文件
  file:
    src: /path/to/source/file.txt				# 源端 
    dest: /path/to/destination/file.txt			 # 目的端
    remote_src: yes							    # 删除源端

- name: 删除文件或目录
  file:
    path: /path/to/file_or_directory
    state: absent

- name: 复制文件到远程主机
  copy:
    src: /path/to/local/file
    dest: /path/to/remote/file

- name: 复制目录到远程主机
  copy:
    src: /path/to/local/directory/
    dest: /path/to/remote/directory/

- name: 添加 EPEL 软件源
  yum_repository:
    name: epel
    description: Extra Packages for Enterprise Linux 7 - $basearch
    baseurl: http://download.fedoraproject.org/pub/epel/7/$basearch
    gpgcheck: yes
    gpgkey: /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
    state: present

- name: 删除 EPEL 软件源
  yum_repository:
    name: epel
    state: absent

- name: yum example
  hosts: all
  tasks:
     - name: 安装 mariadb php
       yum:
           name: "{{ item }}"
           state: present
       loop:
         - php
         - mariadb
     - name: 安装 Development Tools
       yum:
           name: "@Development Tools"
           state: present
     - name: 升级所有包
       yum:
           name: '*'
           state: latest

- name: 启动服务
  service:
    name: apache2
    state: started

- name: 停止服务
  service:
    name: apache2
    state: stopped

- name: 重启服务
  service:
    name: apache2
    state: restarted

- name: 重新加载服务配置
  service:
    name: apache2
    state: reloaded

- name: Create a cron job
  cron:
    name: "My Cron Job"
    minute: "30"
    hour: "2"
    job: "/path/to/my_command"

- name: Update a cron job
  cron:
    name: "My Cron Job"
    minute: "0"
    hour: "8"
    job: "/path/to/updated_command"

- name: Remove a cron job
  cron:
    name: "My Cron Job"
    state: absent

- name: Create a user
  user:
    name: myuser
    password: mypassword
    state: present

- name: Create a group
  group:
    name: mygroup
    state: present

- name: vars example
  hosts: all
  vars:
    port: 80
    host_name: servera
    file: /etc/passwd

- name: vars example
  hosts: all
  vars:
    port: 80
    host_name: servera
    file: /etc/passwd
  tasks:
    - name: print vars
      shell: echo "{{ port }} {{ host_name }} {{ file }}" > /test.txt

ansible	all	-m	setup

ansible	all	-m	setup	-a	'filter=ansible_*_mb'

ansible	all	-m	setup	-a	'filter=ansible_ens160'

ansible_distribution		# 显示系统发行版本
ansible_distribution_version	# 显示系统具体发行版本号
ansible_hostname			# 主机名
ansible_interfaces           # 网络接口列表
ansible_kernel				# 内核版本
ansible_devices				# 显示磁盘设备信息

# 需要注意['servera']中servera只能是主机名不能用IP地址
# 调用主机IP
{{ hostvars['servera'].ansible_eth0.ipv4.address }}

# 显示其他主机的变量值
{{ hostvars['servera'].some_variable }}

# 识别当前正在运行的task的主机的主机名
{{ hostvars[inventory_hostname].ansible_eth0.ipv4.address }}

# 这是一个判断系统为Redhat或Debian或者都不是的情况下安装对应的版本vim，或者报出is not supported
- name: when example
  hosts: all
  tasks:
    - name: install vim
      yum:
        name: vim-enhanced
        state: installed
      when: ansible_os_family == "Redhat"
        - name: Install VIM apt
          apt:
            name: vim 
            state: installed
          when: ansible_os_family == "Debian"
        - name: Unexpected OS family
          debug: msg="OS Family {{ ansible_os_family }} is not supported"
          when: not ansible_os_family == "RedHat" or ansible_os_family == "Debian"

==：是否相等，相等则为真
!=：是否不等，不等则为真
>：是否左边大于右边，则为真
<：是否左边小于右边，则为真
>=：是否左边大于等于右边，则为真
<=：是否右边大于等于左边，则为真

and：逻辑与，左右同时为真，则为真
or：逻辑或，左右任意一个为真，则为真
not：逻辑否，对表达式取反
（）：组合表达式，组合内都是逻辑与关系

- name: block
  hosts: all
  tasks:
    - block:
      - yum:
        name: httpd
        state: present
      - yum:
        name: mariadb
        state: present
      - yum:
        name: php
        state: present
  when: ansible_os_family == "Redhat"

tasks:
        - block:
                - shell: ls /opt/demoa
          rescue:
                - file:
                        path: /opt/demo
                        state: directory
                - debug:
                        msg: "hello ansible"

tasks:
        - block:
                - shell: ls /opt/demoa
          rescue:
                - file:
                        path: /opt/demo
                        state: directory
                - debug:
                        msg: "hello ansible"
          always:
                  - debug:
                          msg: "hello always"

tasks:
          - debug:
                  msg: "msg1"
          - debug:
                  msg: "msg2"
          - fail:
				  msg: “exit playbook”
            when: ansible_os_family == "RedHat"

tasks:
          - debug:
                  msg: "msg1"
          - debug:
                  msg: "msg2"
            failed_when: ansible_os_family == "RedHat"
          - debug:
                  msg: "msg3"

- name: Loop over a list
  debug:
    msg: "Item: {{ item }}"
  loop:
    - item1
    - item2
    - item3

- name: Loop over a dictionary
  debug:
    msg: "Key: {{ item.key }}, Value: {{ item.value }}"
  loop: "{{ my_dict | dict2items }}"

- name: 生成 Nginx 配置文件
  hosts: web_servers
  vars:
    nginx_listen_port: 80
    upstream_servers:
      - 192.168.1.10
      - 192.168.1.11
      - 192.168.1.12
  tasks:
    - name: 生成 Nginx 配置文件
      template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf

http {
    upstream backend {
        {% for server in upstream_servers %}
        server {{ server }};
        {% endfor %}
    }

    server {
        listen {{ nginx_listen_port }};
        location / {
            proxy_pass http://backend;
        }
    }
}

- name: 生成 SSH 配置文件
  hosts: bastion_host
  vars:
    ssh_hosts:
      - host1.example.com
      - host2.example.com
      - host3.example.com
  tasks:
    - name: 生成 SSH 配置文件
      template:
        src: ssh_config.j2
        dest: /etc/ssh/ssh_config

{% for host in ssh_hosts %}
Host {{ host }}
    Port 22
    User your_username
    IdentityFile ~/.ssh/id_rsa
{% endfor %}

# 创建一个名为apache的角色，角色名就是目录名，使用init会帮助我们在当前目录下创建一个角色目录结构
ansible-galaxy init  apache

role_name/
├── tasks/
│   └── main.yml
├── handlers/
│   └── main.yml
├── files/
│   └── <additional files>
├── templates/
│   └── <template files>
├── vars/
│   └── main.yml
├── defaults/
│   └── main.yml
├── meta/
│   └── main.yml
└── README.md

- name: Example playbook
  hosts: myhosts
  roles:
    - apache

ansible-galaxy  search  		# 搜索角色
ansible-galaxy  install  		# 角色名 –p  roles/  安装路径，将角色安装到当前目录下的roles目录中
ansible-galaxy  list  			# 查看已经安装的roles
ansible-galaxy info myrole  	 # 查看已经安装的roles的详情
ansible-galaxy remove  rolesname # 卸载一个角色（也可以直接删除roles目录中对应的角色目录）

- name: Install Docker, Kubernetes
  hosts: all
  become: true

  tasks:
    # Install required packages
    - name: Install packages
      yum:
        name: "{{ item }}"
        state: present
      loop:
        - yum-utils
        - device-mapper-persistent-data
        - lvm2

    # Add Docker repository
    - name: Add Docker repository
      yum_repository:
        name: docker-ce
        description: Docker CE Stable
        baseurl: https://download.docker.com/linux/centos/7/x86_64/stable
        enabled: true
        gpgcheck: true
        gpgkey: https://download.docker.com/linux/centos/gpg
      tags: docker

    # Install Docker
    - name: Install Docker
      yum:
        name: "docker-ce-{{ item }}"
        state: present
      loop:
        - cli
        - containerd.io
      tags: docker

    # Start and enable Docker service
    - name: Start Docker service
      systemd:
        name: docker
        state: started
        enabled: true
      tags: docker

    # Add Kubernetes repository
    - name: Add Kubernetes repository
      yum_repository:
        name: kubernetes
        description: Kubernetes
        baseurl: https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
        enabled: true
        gpgcheck: true
        gpgkey: https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg

    # Install Kubernetes packages
    - name: Install Kubernetes packages
      yum:
        name: "{{ item }}"
        state: present
      loop:
        - kubelet
        - kubeadm
        - kubectl

    # Start and enable Kubernetes services
    - name: Start Kubernetes services
      systemd:
        name: "{{ item }}"
        state: started
        enabled: true
      loop:
        - kubelet

    # Disable SELinux
    - name: Disable SELinux
      selinux:
        state: disabled

    # Set vm.swappiness to 0
    - name: Set vm.swappiness to 0
      sysctl:
        name: vm.swappiness
        value: 0
        state: present
        sysctl_file: /etc/sysctl.d/99-kubernetes.conf
        reload: yes

    # Set net.bridge.bridge-nf-call-iptables to 1
    - name: Set net.bridge.bridge-nf-call-iptables to 1
      sysctl:
        name: net.bridge.bridge-nf-call-iptables
        value: 1
        state: present
        sysctl_file: /etc/sysctl.d/99-kubernetes-iptables.conf
        reload: yes

- name: epel
  hosts: all
  tasks:
    - name: install epel-release
      yum:
        name: epel-release
        state: present
    - name: Configure the EPEL source of Huawei open source mirror
      yum_repository:
        name: epel
        description: EPEL - Extra Packages for Linux
        baseurl: https://mirrors.huaweicloud.com/epel/$releasever/$basearch/
        gpgcheck: no
        state: present
    - name: makecache
      yum:
        name: '*'
        state: latest

- name: Gather hardware inventory
  hosts: all
  gather_facts: yes

  tasks:
    - name: Get host information
      debug:
        msg: "Hostname: {{ ansible_hostname }}"

    - name: Get memory information
      command: free -m
      register: memory_output

    - name: Parse memory information
      set_fact:
        total_memory: "{{ memory_output.stdout_lines[1] | regex_replace('\\s+', ' ') | split(' ')[1] }}"
        used_memory: "{{ memory_output.stdout_lines[1] | regex_replace('\\s+', ' ') | split(' ')[2] }}"

    - name: Get BIOS version
      command: dmidecode -s bios-version
      register: bios_output

    - name: Get disk device information
      command: lsblk --output NAME,FSTYPE,SIZE,MOUNTPOINT
      register: disk_output

    - name: Parse disk device information
      set_fact:
        disks: "{{ disk_output.stdout_lines[1:] | map('regex_replace', '\\s+', ' ') | map('split', ' ') | list }}"

    - name: Display hardware inventory
      debug:
        msg: |
          Hostname: {{ ansible_hostname }}
          Total memory: {{ total_memory }}MB
          Used memory: {{ used_memory }}MB
          BIOS version: {{ bios_output.stdout }}
          Disk devices:
          {% for disk in disks %}
          - Name: {{ disk[0] }}
            Filesystem: {{ disk[1] }}
            Size: {{ disk[2] }}
            Mountpoint: {{ disk[3] }}
          {% endfor %}

- hosts: all
  tasks:
    - name: install httpd
      yum:
        name: httpd
        state: present
    - name: enable httpd
      systemd:
        name: httpd
        enabled: yes
        state: started
    - name: enable 80/tcp
      firewalld:
        service: http
        immediate: yes
        permanent: yes
        state: enabled
    - name: Create webdev directory
      file:
        path: /webdev
        state: directory
        owner: root
        group: devops
        mode: '2775'
        setype: httpd_sys_content_t
    - name: Creat file
      copy:
        content: "Devlopment\n"
        dest: /webdev/index.html
        setype: httpd_sys_content_t
    - name: create soft link
      file:
        src: /webdev
        dest: /var/www/html/webdev
        state: link

# ansible官网
https://www.ansible.com/
# ansible官方产品文档
https://docs.ansible.com
# 角色使用文档
https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_reuse_roles.html
# 华为云开源镜像站
https://mirrors.huaweicloud.com/home
# ansible模块
https://docs.ansible.com/ansible/latest/collections/index_module.html