1. 选型工具说明缺点xshell不适应机器过多场景需要连接后才能用forssh/scp密钥认证密钥认证免密码登录scp传输文本/脚本ssh远程执行命令或脚本串行saltstack需要安装客户端ansible无客户端密钥认证批量部署环境需要新python版本被红帽收购了Terraform关注基础设施云环境一键创建100台云服务器一键创建负载均衡数据库产品2. ansible架构通过主机清单连接管理被控端命令行执行模块使用playbook剧本核心3. 环境准备环境准备主机名ipansible管理端m02(增加核心数 4c或8c)10.0.0.62/172.16.1.62被管理端web01,web02,db01,nfs01,backup......3.1. 安装ansible1.安装pip工具 yum install -y python3-pip 2.升级pip python3 -m pip install -i https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple --upgrade pip 3.pip源(加速pip下载软件) pip3 config set global.index-url https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple 4.安装ansible pip3 install ansible 5.创建ansible配置文件默认没有 mkdir -p /etc/ansible/ cat /etc/ansible/ansible.cfgEOF [defaults] host_key_checking False deprecation_warnings False interpreter_python/usr/bin/python3 [inventory] [privilege_escalation] [paramiko_connection] [ssh_connection] [persistent_connection] [accelerate] [selinux] [colors] [diff] EOF3.2. 检查[rootm02 ~]# ansible --version /usr/local/lib/python3.7/site-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 3.7 is no longer supported by the Python core team and support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.7. from cryptography.exceptions import InvalidSignature ansible [core 2.11.12] config file /etc/ansible/ansible.cfg configured module search path [/root/.ansible/plugins/modules, /usr/share/ansible/plugins/modules] ansible python module location /usr/local/lib/python3.7/site-packages/ansible ansible collection location /root/.ansible/collections:/usr/share/ansible/collections executable location /usr/local/bin/ansible python version 3.7.9 (default, Jun 10 2022, 11:25:35) [GCC 7.3.0] jinja version 3.1.6 libyaml True3.3. 解决CryptographyDeprecationWarning提示[rootm02 ~]# pip install cryptography36.0.1 Looking in indexes: https://mirrors.tuna.tsinghua.edu.cn/pypi/web/simple Collecting cryptography36.0.1 Downloading https://mirrors.tuna.tsinghua.edu.cn/pypi/web/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (3.6 MB) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 3.6/3.6 MB 728.3 kB/s eta 0:00:00 Requirement already satisfied: cffi1.12 in /usr/lib64/python3.7/site-packages (from cryptography36.0.1) (1.14.1) Requirement already satisfied: pycparser in /usr/lib/python3.7/site-packages (from cffi1.12-cryptography36.0.1) (2.20) Installing collected packages: cryptography Attempting uninstall: cryptography Found existing installation: cryptography 45.0.5 Uninstalling cryptography-45.0.5: Successfully uninstalled cryptography-45.0.5 Successfully installed cryptography-36.0.1 WARNING: Running pip as the root user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv [rootm02 ~]# ansible --version ansible [core 2.11.12] config file /etc/ansible/ansible.cfg configured module search path [/root/.ansible/plugins/modules, /usr/share/ansible/plugins/modules] ansible python module location /usr/local/lib/python3.7/site-packages/ansible ansible collection location /root/.ansible/collections:/usr/share/ansible/collections executable location /usr/local/bin/ansible python version 3.7.9 (default, Jun 10 2022, 11:25:35) [GCC 7.3.0] jinja version 3.1.6 libyaml True3.4. 配置主机清单[lb] 172.16.1.[5:6] [web] 172.16.1.[7:10] [db] 172.16.1.[51:52] [nfs] 172.16.1.31 [bak] 172.16.1.41 #创建data分组,子组有db组,nfs组,bak组 [data:children] db nfs bak需求100台机器100个密码如何管理解决主机清单文件中指定密码 [web] 10.0.0.7 ansible_userroot ansible_port22 ansible_passwordLidao996 10.0.0.8 ansible_userroot ansible_port22 ansible_passwordLidao9964. 使用ansible4.1. ping模块检查主机是否可以被管理ansible -i /etc/ansible/hosts all -m ping -i 指定主机清单如果不指定默认是/etc/ansible/hosts4.2. command模块在被管理主机上执行简单的命令ansible lb -m command -a hostname -I4.3. shell模块类似command模块支持负载一点的命令ansible lb -m shell -a rpm -qa | grep tree4.4. script模块ansible lb -m script -a /server/scripts/script.sh5. ansible模块模块分类模块说明/选项执行命令/脚本command一般用于执行简单命令不支持特殊符号默认的模块shell与command类似支持特殊符号script1.分发脚本管理端指定的文件2.执行脚本运行文件目录filetouch,mkdir,rm,chown,chmod,ln -s文件目录软链接path路径目录目录下的文件src源文件创建软链接mode0644,0755,owner,groupstatetouch/directory/link/absent用户usernameuser用户名uiduid用户uidshell/sbin/nologin用户shellcreate_homefalse/true是否创建家目录statepresent/absent添加/删除安装软件包yum/aptnametree软件包名statepresent/absent安装或卸载拷贝copy类似scp拷贝文件或压缩包不要拷贝目录src/etc/hosts管理机源文件dest/etc/hosts被管理机位置服务管理systemd服务管理开机自启动开启关闭重启namenginx服务名enabledyes/no是否开机自启动statestarted/stopped/restarted/reloaded5.1. file创建目录 ansible all -m file -a path/dir/ statedirectory 创建文件 ansible all -m file -a path/dir/test.txt statetouch 创建软链接 ansible all -m file -a src/etc/hosts path/dir/ statelink 删除极其危险 ansible web -m file -a path/dir/ stateabsent 创建文件或目录的时候同时需改权限所有者用户组等内容 ansible all -m file -a path/dir/ mode0700 userzbl groupzbl statedirectoryCollection Index — Ansible Community Documentationuser和group模块group用户组模块user用户模块5.2. user group添加www-ans用户uid,gid 2999 虚拟用户 添加用户组指定gid ansible all -m group -a namewww-ans gid2999 statepresent ansible all -m user -a namewww-ans uid2999 groupwww-ans shell/sbin/nologin create_homefalse statepresent ansible all -a grep www-ans /etc/passwd /etc/group5.3. yum安装软件#安装软件 ansible all -m yum -a nametree5.4. copy分发配置ansible all -m copy -a src/etc/hosts dest/etc/hosts backupyes src源文件 dest目标 backup是否备份5.5. systemd启动服务#开启nginx并设置开启自启动 ansible web -m systemd -a namenginx enabledtrue statestarted #关闭firewalld并禁止开机自启动 ansible web -m systemd -a namefirewalld enabledfalse statestopped6. 总结主机清单ansible模块