Ansible 系统概述与部署

Ansible的编排引擎可以出色地完成配置管理、流程控制、资源部署等多方面工作,与其他IT自动化产品相比较,Ansible为你提供一种不需要安装客户端软件、管理简便、功能强大的基础架构配置、维护工具,Ansible 基于 Python 语言实现,由 Paramiko 和 PyYAML 两个关键模块构建。

Ansible 的安装方式非常灵活满足各种环境部署的需求,一般可以直接用源码进行安装,也可用操作系统软件包管理工具进行安装,下面我们只介绍比较复杂的源码安装,但是我们后期的小实验会使用Yum安装的来进行讲解.

1.首先安装gcc编译器,和Python的相关依赖包.

[root@localhost ~]# yum -y install gcc zlib zlib-devel openssl openssl-devel libffi-devel

Package gcc-4.8.5-36.el7.x86_64 already installed and latest version
Package zlib-1.2.7-18.el7.x86_64 already installed and latest version
Package zlib-devel-1.2.7-18.el7.x86_64 already installed and latest version
Package 1:openssl-1.0.2k-16.el7.x86_64 already installed and latest version
Package 1:openssl-devel-1.0.2k-16.el7.x86_64 already installed and latest version
Package libffi-devel-3.0.13-18.el7.x86_64 already installed and latest version
Nothing to do

2.由于Ansible是使用Python开发的,这里我们需要编译并安装Python解释器.

[root@localhost ~]# yum install -y readline
[root@localhost ~]# wget https://www.python.org/ftp/python/3.7.0/Python-3.7.0.tgz
[root@localhost ~]# tar xvzf Python-3.7.0.tgz -C /usr/src/python3.7
[root@localhost ~]# cd /usr/src/Python-3.7.0/
[root@localhost ~]# ./configure --prefix=/usr/local/python3.7
[root@localhost ~]# make && make altinstall

3.将python头文件拷贝到标准目录,以避免编译ansible时,找不到所需的头文件.

[root@localhost ~]# cd /usr/local/include/python3.7/
[root@localhost ~]# cp -a ./* /usr/local/include/

4.接着我们备份一下旧版本的Python,并创建符号链接链接到新版本的Python上面/

[root@localhost ~]# cd /usr/bin/
[root@localhost bin]# mv python python.old
[root@localhost bin]# ln -s /usr/local/bin/python3.7 /usr/local/bin/python
[root@localhost bin]# rm -rf /usr/bin/python
[root@localhost bin]# cp /usr/local/bin/python3.7 /usr/bin/python

5.由于yum是用python开发的,这里为了避免冲突要改掉他的配置.

[root@localhost ~]# vim /usr/bin/yum

#!/usr/bin/python2.7       ←此处将python改成python2.7

[root@localhost ~]# vim /usr/libexec/urlgrabber-ext-down

#!/usr/bin/python2.7       ←此处将python改成python2.7

6.最后测试python新版本是否生效了.

[root@localhost ~]# python

Python 3.7.0 (default, Apr 17 2018, 11:03:21) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> exit()

7.安装setuptools模块.

[root@localhost ~]# wget https://files.pythonhosted.org/packages/72/c2/c09362ab29338413ab687b47dab03bab4a792e2bbb727a1eb5e0a88e3b86/setuptools-39.0.1.zip
[root@localhost ~]# unzip setuptools-39.0.1.zip -d /usr/src/
[root@localhost ~]# cd /usr/src/setuptools-39.0.1/
[root@localhost setuptools-39.0.1]# python setup.py install

8.pycrypto模块安装.

[root@localhost ~]# wget https://pypi.python.org/packages/source/p/pycrypto/pycrypto-2.6.1.tar.gz
[root@localhost ~]# tar xvzf pycrypto-2.6.1.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/pycrypto-2.6.1/
[root@localhost pycrypto-2.6.1]# python setup.py install

9.PyYAML模块安装.

[root@localhost ~]# wget http://pyyaml.org/download/libyaml/yaml-0.1.7.tar.gz
[root@localhost ~]# tar xvzf yaml-0.1.7.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/yaml-0.1.7/
[root@localhost yaml-0.1.7]# ./configure --prefix=/usr/local
[root@localhost yaml-0.1.7]# make --jobs=`grep processor /proc/cpuinfo | wc -l`
[root@localhost yaml-0.1.7]# make install

[root@localhost ~]# wget http://pyyaml.org/download/pyyaml/PyYAML-3.12.tar.gz
[root@localhost ~]# tar xvzf PyYAML-3.12.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/PyYAML-3.12/
[root@localhost PyYAML-3.12]# python setup.py install

10.Jinja2模块安装

[root@localhost ~]# wget https://pypi.python.org/packages/source/M/MarkupSafe/MarkupSafe-0.9.3.tar.gz
[root@localhost ~]# tar xvzf MarkupSafe-0.9.3.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/MarkupSafe-0.9.3/
[root@localhost MarkupSafe-0.9.3]# python setup.py install

[root@localhost ~]# wget https://files.pythonhosted.org/packages/56/e6/332789f295cf22308386cf5bbd1f4e00ed11484299c5d7383378cf48ba47/Jinja2-2.10.tar.gz
[root@localhost ~]# tar xvzf Jinja2-2.10.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/Jinja2-2.10/
[root@localhost Jinja2-2.10]# python setup.py install

11.paramiko模块安装.

[root@localhost ~]# wget https://files.pythonhosted.org/packages/f9/e5/99ebb176e47f150ac115ffeda5fedb6a3dbb3c00c74a59fd84ddf12f5857/ecdsa-0.13.tar.gz
[root@localhost ~]# tar xvzf ecdsa-0.13.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/ecdsa-0.13/
[root@localhost ecdsa-0.13]# python setup.py install

[root@localhost ~]# https://files.pythonhosted.org/packages/29/65/83181630befb17cd1370a6abb9a87957947a43c2332216e5975353f61d64/paramiko-2.4.1.tar.gz
[root@localhost ~]# tar xvzf paramiko-2.4.1.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/paramiko-2.4.1/
[root@localhost paramiko-2.4.1]# python setup.py install

12.simplejson模块安装.

[root@localhost ~]# wget https://files.pythonhosted.org/packages/0d/3f/3a16847fe5c010110a8f54dd8fe7b091b4e22922def374fe1cce9c1cb7e9/simplejson-3.13.2.tar.gz
[root@localhost ~]# tar xvff simplejson-3.13.2.tar.gz -C /usr/src/
[root@localhost src]# cd /usr/src/simplejson-3.13.2/
[root@localhost simplejson-3.13.2]# python setup.py install

13.Ansible安装.

[root@localhost ~]# wget https://files.pythonhosted.org/packages/4a/3b/9d98e132074bb6a3f18fd811db2819fbde6fc8a26fad9a40b49e53cb2455/ansible-2.5.0.tar.gz
[root@localhost ~]# tar xf ansible-2.5.0.tar.gz -C /usr/src/
[root@localhost ~]# cd /usr/src/ansible-2.5.0/
[root@localhost ansible-2.5.0]# python setup.py install

下面的小实验,我们将采用以下的IP地址规划,请自行配置好.

[实验环境]

[状态]    [主机列表]        [python版本]

控制机 192.168.1.10        Python2.6/2.7

被控机 192.168.1.20        Python2.4
被控机 192.168.1.30        Python2.4

为了避免 Ansible 下发指令时输入目标主机密码,通过证书签名达到 SSH 无密码是一个好的方案,推荐使用 ssh-keygen 与 ssh-copy-id 来实现快速证书的生成及公钥下发.

1.在控制主机创建密钥,执行 ssh-keygen -t rsa ,有询问直接按回车键即可,将在 /root/.ssh 下生成一对密钥,其中 id_rsa 为私钥,id_rsa.pub 为公钥,代码如下：

[root@localhost ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:TbU6Vvtwf0SP/rFW3c6NTBHHwN/pADsJsIstP/4f96k root@localhost.localdomain
The key s randomart image is:
+---[RSA 2048]----+
|       ..   ...o |
|        .. o .o o|
|       .  o *  ++|
|      o .o * o.++|
|     o oS = + =.=|
|      o  . . =.++|
|       o   . +o==|
|      . .   o +oO|
|       ..... Eo+.|
+----[SHA256]-----+

[root@localhost ~]#

2.下发密钥就是控制主机把公钥id_rsa.pub下发到被管节点上用户下.ssh目录,并重命名成 authorized_keys 且权限值为 400,接下来推荐常用的密钥拷贝工具 ssh-copy-id把公钥文件id_rsa.pub公钥拷贝到被管节点,命令格式如下：

[root@localhost ~]# ssh-copy-id root@192.168.1.20
[root@localhost ~]# ssh-copy-id root@192.168.1.30

3.RHEL7.0安装Ansible后发现找不到ansible.cfg,配置文件的路径,我们需要手动将它的配置文件拷贝到/etc/目录下去.

[root@localhost ~]# cd /usr/src/ansible-2.5.0/examples
[root@localhost exampless]# mkdir /etc/ansible
[root@localhost exampless]# cp -a ansible.cfg hosts /etc/ansible

4.编辑Ansible,写入被控主机IP地址,如果要写入一组IP我们可以加中括号 webserver代表的含义就是,执行下面一组IP的操作,admin 组则代表指定一个范围.

[root@localhost ~]# vim /etc/ansible/hosts
 
192.168.1.20      #写入单个IP地址
192.168.1.30

[webserver]       #指定一个组
192.168.1.20
192.168.1.30

[admin]           #指定一个范围
192.168.1.[1:100]

5.修改Ansible主配置文件,修改两处位置即可,分别是禁用每次执行命令检查ssh,和开启日志记录功能,取消两处的注释即可.

[root@localhost ~]# vim /etc/ansible/ansible.cfg

61 # uncomment this to disable SSH key host checking
62 host_key_checking = False        #禁用每次执行命令检查ssh,取消注释

100 # logging is off by default unless this path is defined
101 # if so defined, consider logrotate
102 log_path = /var/log/ansible.log  #开启日志记录功能,取消注释

6.此时Ansible控制主机就配置完毕了,我们来执行以下命令,看一下它的连通性吧,一般我们Ping一下看到pong说明成功啦.

[root@localhost ~]# ansible all -m ping

192.168.1.20 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}
192.168.1.30 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}

[root@localhost ~]# ansible webserver -m ping

192.168.1.20 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}
192.168.1.30 | SUCCESS => {     #说明成功
    "changed": false, 
    "ping": "pong"
}

这里测试时在控制主机与被管节点之间配置了 SSH 证书信任,如果没有用证书认证,则需要在执行 Ansible 命令时添加 -k 参数,在提示 "SSH password:"时输入 root 账号密码,实际生产环境中,大多数更倾向于使用 Linux 普通用户账户进行连接并通过 sudo 命令实现： root 权限,格式为： ansible all -m ping -u ansible -sudo