Ansiable自动化运维工具使用
1)Ansiable简介
Ansible是一个轻量级的自动化运维工具,基于Python开发,集合了众多运维工具(puppet、cfengine、chef、func、fabric)的优点于一身,可以实现批量的系统配置、程序部署、批量运行命令等功能。现在自动化运维工具在实现远程管理时主要有以下两种分类:
agent类:被管理端需要安装agentd程序,如puppet、func、saltstack;
agent less类:在被管理端无需agentd程序,可以通过ssh服务来直接管理,如ansible
1.1)ansiable架构
- 被管理的主机需要提前定义在主机列表文件中,和saltstack的认证类似。
- ansible的大部分管理工作都是通过核心模块来完成,如定义哪个主机需要安装哪个服务等。
- 可以自定义模块来完成ansible本身不具备的功能。
- 把需要完成的任务定义在一个YAML格式编写的文件中,可以多次调用。
2)安装Ansiable
1 [root@s-30 ansible]#yum install ansible -y 2 ...省略若干... 3 [root@s-30 ansible]# ansible --version 4 ansible 2.4.2.0 5 config file = /etc/ansible/ansible.cfg #Ansiable服务主配置文件 6 configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules'] 7 ansible python module location = /usr/lib/python2.7/site-packages/ansible 8 executable location = /usr/bin/ansible 9 python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)] 10 [root@s-30 ansible]#
2.1)ansiable的基础配置
1、ansible服务主配置文件:/etc/ansible/ansible.cfg,该文件基本可以不用动。
2、主机列表配置文件:/etc/ansible/hosts,被管理的每个主机都需要在此文件中有定义。如果没有定义在主机列表文件中,执行命令会提示“No hosts matched”
1 [root@s-30 ansible]# vim hosts 2 3 # This is the default ansible 'hosts' file. 4 # 5 # It should live in /etc/ansible/hosts 6 # 7 # - Comments begin with the '#' character 8 # - Blank lines are ignored 9 # - Groups of hosts are delimited by [header] elements 10 # - You can enter hostnames or ip addresses 11 # - A hostname/ip can be a member of multiple groups 12 13 # Ex 1: Ungrouped hosts, specify before any group headers. 14 15 ## green.example.com #这里填写被管理主机的ip或者域名 16 ## blue.example.com 17 ## 192.168.100.1 18 # This is the default ansible 'hosts' file. 19 # 20 # It should live in /etc/ansible/hosts 21 # 22 # - Comments begin with the '#' character 23 # - Blank lines are ignored 24 # - Groups of hosts are delimited by [header] elements 25 # - You can enter hostnames or ip addresses 26 # - A hostname/ip can be a member of multiple groups 27 28 # Ex 1: Ungrouped hosts, specify before any group headers. 29 30 ## green.example.com 31 ## blue.example.com 32 ## 192.168.100.1 33 ## 192.168.100.10 34 35 # Ex 2: A collection of hosts belonging to the 'webservers' group 36 37 ## [webservers] #定义了webservers组,被管理的主机添加到这个组,引用这个组就代表引用这里面的所有主机 38 ## alpha.example.org 39 ## beta.example.org 40 ## 192.168.1.100 41 ## 192.168.1.110 42 43 # If you have multiple hosts following a pattern you can specify 44 # them like this: 45 46 ## www[001:006].example.com 47 48 # Ex 3: A collection of database servers in the 'dbservers' group 49 50 ## [dbservers] 51 ## 52 ## db01.intranet.mydomain.net 53 ## db02.intranet.mydomain.net 54 ## 10.25.1.56 55 ## 10.25.1.57 56 57 # Here's another example of host ranges, this time there are no 58 # leading 0s: 59 60 ## db-[99:101]-node.example.com
ansible默认使用SSH服务管理,每次需要输入被管理服务器的账号密码,为避免繁琐可以使用SSH免秘钥登录的方式,将服务器端生成的秘钥发送给其他被管理的机器;或者将登录信息记录在inventory主机列表文件中,ssh免秘钥分配。
1、使用ssh-keygen命令创建密钥对
[root@s-30 ansible]# ssh-keygen -t rsa #除了rsa格式,还有dsa格式,只不过rsa可以实现加密认证也可以进行签名认证,dsa只能用于签名认证 Generating public/private rsa key pair. Enter file in which to save the key (/root/.ssh/id_rsa): ansiable #输入要保存的秘钥文件 Enter passphrase (empty for no passphrase): #输入密码短语(不能为空) Enter same passphrase again: #再输入上面的密码短语 Your identification has been saved in ansiable. Your public key has been saved in ansiable.pub. The key fingerprint is: SHA256:asYsq1zmMusIAMlhTG+Ay4c/18lZO2SC8uqg8GZJ/Pg root@s-30 The key's randomart image is: +---[RSA 2048]----+ |+= | |+o+ | |+o.o . | |oo.o . . + | |..o o o S . | |. oo = * o | |oo +B * . | |++O=.= | |o+BBE | +----[SHA256]-----+ [root@s-30 ansible]#
2、找到创建的秘钥对,公钥就是需要放在每台被管理机器上的文件。
1 [root@s-30 /]# cd /root/.ssh 2 [root@s-30 .ssh]# ls 3 id_rsa id_rsa.pub known_hosts 4 [root@s-30 .ssh]# ll 5 total 12 6 -rw------- 1 root root 1679 Oct 17 04:57 id_rsa 7 -rw-r--r-- 1 root root 391 Oct 17 04:57 id_rsa.pub 8 -rw-r--r-- 1 root root 176 Oct 22 23:39 known_hosts
1 [root@s-30 bin]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@192.168.31.129 #用ssh-copy-id像另一台主机发公钥 2 /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub" 3 The authenticity of host '192.168.31.129 (192.168.31.129)' can't be established. 4 ECDSA key fingerprint is SHA256:JJIUQQvA7RQEwj/6oMBI4mcKUbodDDQFQO4VVqE/D/E. 5 ECDSA key fingerprint is MD5:87:19:f6:04:79:a7:af:24:36:01:9c:10:9d:2a:ac:90. 6 Are you sure you want to continue connecting (yes/no)? y 7 Please type 'yes' or 'no': yes 8 /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed 9 /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys 10 root@192.168.31.129's password: 11 Permission denied, please try again. 12 root@192.168.31.129's password: 13 14 Number of key(s) added: 1 15 16 Now try logging into the machine, with: "ssh 'root@192.168.31.129'" 17 and check to make sure that only the key(s) you wanted were added. 18 19 [root@s-30 bin]# ssh 192.168.31.129 ifconfig #检测是否分发成功 20 ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 21 inet 192.168.31.129 netmask 255.255.255.0 broadcast 192.168.31.255 22 inet6 fe80::a1be:8b76:26c5:2f5e prefixlen 64 scopeid 0x20<link> 23 ether 00:0c:29:2e:b4:f9 txqueuelen 1000 (Ethernet) 24 RX packets 111 bytes 18471 (18.0 KiB) 25 RX errors 0 dropped 0 overruns 0 frame 0 26 TX packets 117 bytes 17770 (17.3 KiB) 27 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 28 29 lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 30 inet 127.0.0.1 netmask 255.0.0.0 31 inet6 ::1 prefixlen 128 scopeid 0x10<host> 32 loop txqueuelen 1000 (Local Loopback) 33 RX packets 0 bytes 0 (0.0 B) 34 RX errors 0 dropped 0 overruns 0 frame 0 35 TX packets 0 bytes 0 (0.0 B) 36 TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 37 38 [root@s-30 bin]#
与人善言,暖于布锦,伤人之言,深于矛戟