配置文件查找优先级
ANSIBLE_CONFIG #全局
ansible.cfg #项目目录
.ansible.cfg
/etc/ansible/ansible.cfg
Ansible Inventory 主机清单
Ansible Ad-Hoc 模块 ansible-doc module_name
1.yum | yum_repository
2.copy
3.file
4.service|systemd
5.cron
6.mount
7.user
8.group
9.shell | command
10.firewalld | selinux
command shell
- 建议使用shell模块，因为command不支持管道技术
yum模块
| 内容 | 含义 | ||
|---|---|---|---|
| name | 软件包名称 | URL地址 | 本地的某个路径下的rpm包 |
| state | 具体动作 present absent latest | ||
| exclude | 排除 | ||
| enablerepo | 通过哪个仓库安装 | ||
| disablerepo | 安装时不使用哪个仓库 |
- 2yum 安装软件
#示例一、安装当前最新的Apache软件，如果存在则不安装
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=httpd state=latest"
#示例二、安装当前最新的Apache软件，通过epel仓库安装
[root@manager ~]# ansible oldboy -m yum -a "name=httpd enablerepo=epel state=present"
#示例三、通过公网URL安装rpm软件
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=http://192.168.16.236/zabbix/4.0/rhel/7/x86_64/zabbix-agent-4.0.0-2.el7.x86_64.rpm state=present"
#示例五、更新所有的软件包，但排除和kernel相关的
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name='*' state=latest exclude="kernel*""
#示例六、删除Apache软件
[root@manager ~/ansible-project1]# ansible oldboy -m yum -a "name=httpd state=absent"
copy模块
| 内容 | 含义 |
|---|---|
| src | 当前管理机的配置文件路径 |
| content | 要写入的内容 |
| dest | 目标文件的配置文件路径 |
| owner | 属主 |
| group | 属组 |
| mode | 权限 |
| backup | 备份 （每个变更进行备份） |
[root@manager ~/ansible-project1]# ansible oldboy -m copy -a 'src=./hosts dest=/tmp/ owner=root group=root mode=600 backup=yes'
管理httpd配置文件
[root@manager ~/ansible-project1]# ansible oldboy -m copy -a "src=./files/httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=0644 backup=yes"
systemd
name： 服务名称
state： started stopped restarted reloaded
enabled： 开机自启动 yes|no
1.启动httpd服务
[root@manager ~/ansible-project1]# ansible oldboy -m systemd -a "name=httpd state=started"
2.开机自启动
[root@manager ~/ansible-project1]# ansible oldboy -m systemd -a "name=httpd state=started enabled=yes"
file模块
path: /work #在被控端哪个路径下创建目录 | 文件
state: directory touch # directory 目录 touch 文件``
owner: root
group: root
mode: '0755'
recurse: yes 递归授权
[root@manager ~/ansible-project1]# ansible oldboy -m file -a "path=/ansible_data state=directory owner=root group=root mode=0755"
group
name: 组名称
state: present absent
gid： 组id
[root@manager ~/ansible-project1]# ansible oldboy -m group -a "name=test gid=8888 state=present"
[root@manager ~/ansible-project1]# ansible oldboy -m group -a "name=test state=absent"
user
name: 指定用户名称
uid: 指定用户的uid
group: 指定用户的组名称 或 组 GID
groups: 指定用户的附加组（附加组需存在） append：yes 给一个用户追加附加组
create_home 创建用户家目录/home/Username 默认yes | no
shell: 指定登录用户的bash /bin/bash /sbin/nologin
system: 指定系统用户
password
1.创建一个dev用户，uid为9999 属于test主的组，附加组为admin，root组
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=dev uid=9999 group=test groups=adm,root shell=/bin/bash create_home=yes"
2.追加两个组给dev用户
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=dev groups=bin,daemon append=yes"
3.创建一个系统用户ops，没有家目录 不允许登录系统
[root@manager ~/ansible-project1]# ansible oldboy -m user -a "name=ops system=yes shell=/sbin/nologin create_home=no"
4.创建一个普通用户，可登录 devops 123456
ansible all -i localhost, -m debug -a "msg={{ '123456' | password_hash('sha512', 'mysecretsalt') }}"
"msg": "$6$mysecretsalt$ZB9R8AirQYAXhtfhOo2qdJz52FyNI6v3L6Uc3KNRP.arBKIYpcuEyQewT5qBAHoyQFwHkW6Z551Ql.cZ53GeY0"
[root@manager ~/ansible-project1]# ansible oldboy -m user -a 'name=devops password="$6$mysecretsalt$ZB9R8AirQYAXhtfhOo2qdJz52FyNI6v3L6Uc3KNRP.arBKIYpcuEyQewT5qBAHoyQFwHkW6Z551Ql.cZ53GeY0"'
mount挂载
src： 源设备 （磁盘 | 光盘| 远程的共享的地址） src=172.16.1.31:/data
path: 挂载点
fstype: 设备类型 nfs xfs ext4 iso9660 ....
opts: 挂载选项 defaults
state:
absent mounted 永久
present unmounted 临时
1.挂载172.16.1.31/data/blog 挂载至本地的/opt
[root@manager ~/ansible-project1]# ansible oldboy -m mount -a "src=172.16.1.31:/data/blog path=/opt fstype=nfs opts=defaults state=mounted"
[root@manager ~/ansible-project1]# ansible oldboy -m mount -a "src=172.16.1.31:/data/blog path=/opt fstype=nfs opts=defaults state=unmounted"
selinux
[root@manager ~/ansible-project1]# ansible oldboy -m selinux -a "state=disabled"
firewalld
zone: 指定区域 默认public
service: 指定服务名称
port: 指定端口
state: 启用或禁止
masquerade: 开机地址伪装 yes
immediate: 临时生效 yes
permanent: 永久生效
source: 来源IP
rich_rule: rule service name="ftp" audit limit value="1/m" accept
1.放行http服务
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public service=http state=enabled immediate=yes permanent=yes"
2.放行tcp80端口
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public port=80/tcp state=enabled immediate=yes permanent=yes"
3.将5555端口转发到 172.16.1.7 22 端口 开启masquerade地址伪装
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public rich_rule='rule family=ipv4 forward-port port=5555 protocol=tcp to-port=22 to-addr=172.16.1.7' state=enabled immediate=yes"
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public masquerade=yes state=enabled immediate=yes"
4.配置基于来源IP 10.0.0.1主机 放行 22 端口
[root@manager ~/ansible-project1]# ansible 172.16.1.31 -m firewalld -a "zone=public rich_rule='rule family=ipv4 source address=10.0.0.100/32 service name=ssh accept' state=enabled immediate=yes"
cron
1.添加一个定时任务 （能不能执行跟cron模块没有关系）
[root@manager ~/ansible-project1]# ansible oldboy -m cron -a "name='Backup scripts' minute=00 hour=05 user=root job='/bin/bash /scripts/check_data.sh &>/dev/null'"
2.删除定时任务
[root@manager ~/ansible-project1]# ansible oldboy -m cron -a "name='Backup scripts' minute=00 hour=05 user=root job='/bin/bash /scripts/check_data.sh &>/dev/null' state=absent"
yum_repository
name: 仓库名称，并且是文件的名称
description: 描述--
baseurl: 仓库的地址|很重要 http:// https:// ftp:// file://
enabled: 是否启用该仓库yes
gpgcheck: 不对下载的软件包进行检查
[root@manager ~/ansible-project1]# ansible oldboy -m yum_repository -a 'name=rpmforge description="RPMforge YUM Repo" baseurl="https://mirrors.tuna.tsinghua.edu.cn/centos/$releasever/os/$basearch/" enabled=yes gpgcheck=no'
ansible-doc （user group mount）
1.使用ansible 的 ad-hoc 搭建 NFS 服务？ 31
1.安装nfs
# ansible nfs -m yum -a "name=nfs-utils state=present"
2.配置nfs
[root@manager ~/ansible-project1]# cat exports.j2
/data/blog 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666)
/data/zh 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666)
/data/ansible 172.16.1.0/24(rw,sync,all_squash,anonuid=666,anongid=666)
[root@manager ~/ansible-project1]# ansible nfs -m copy -a "src=./exports.j2 dest=/etc/exports owner=root group=root mode=0644 backup=yes"
3.根据配置文件进行初始化操作 创建用户 创建目录 授权
[root@manager ~/ansible-project1]# ansible nfs -m group -a "name=www gid=666 state=present"
[root@manager ~/ansible-project1]# ansible nfs -m user -a "name=www uid=666 group=www state=present"
[root@manager ~/ansible-project1]# ansible nfs -m file -a "path=/data/ansible state=directory owner=www group=www mode=755 recurse=yes"
3.启动nfs
[root@manager ~/ansible-project1]# ansible nfs -m systemd -a "name=nfs state=restarted enabled=yes"
2.使用ansible 的 ad-hoc 实现 NFS 挂载？ 7
1.安装nfs-utils工具
[root@manager ~/ansible-project1]# ansible web -m yum -a "name=nfs-utils state=present"
2.使用mount挂载即可
[root@manager ~/ansible-project1]# ansible web -m mount -a "src=172.16.1.31:/data/ansible path=/mnt fstype=nfs opts=defaults state=mounted"
[root@manager ~/ansible-project1]# cat nfs-server.yml
- hosts: nfs
tasks:
- name: Installed NFS Server
yum:
name: nfs-utils
state: present
- name: Configure NFS Server
copy:
src: ./exports.j2
dest: /etc/exports
owner: root
group: root
mode: 0644
- name: Create NFS Group
group:
name: www
gid: 666
- name: Create NFS User
user:
name: www
uid: 666
group: 666
- name: Create NFS Share directory
file:
path: /data/ansible
state: directory
owner: www
group: www
mode: 755
- name: Restart NFS Server
systemd:
name: nfs
state: restarted
[root@manager ~/ansible-project1]# cat nfs-client.yml
- hosts: web
tasks:
- name: Mount NFS Server
mount:
src: 172.16.1.31:/data/ansible
path: /mnt
fstype: nfs
opts: defaults
state: mounted
