Ansible-----Roles----------------明岁秋风知再会，暂时分手莫相思。
Ansible Roles
一、基本概述
1.1、Ansible Roles介绍
roles不管是Ansible还是saltstack，我们在写一键部署的时候，都不可能把所有的步骤全部写入到一个'剧本'文件中，肯定需要把不同的工作模块，拆分开来，'解耦' 我们需要用到reles官方推荐，因为roles的目录结构层次更加清晰
例如：基础优化项目文档，如果把所有的东西放进去也是很鸡肋的，不如我们把这些功能全部拆分开，哪里需要就调用。
建议：
每个roles最好只使用一个tasks这样方便我们去调用，能够很好的做到'解耦(SOA)'
拓展内容：
- hosts: all
roles:
- role: stop_linux
- role: nginx
when: ansible_fqdn is match "web*"
一个roles下面调用多个role，h
production # inventory file for production servers
staging # inventory file for staging environment
group_vars/
group1.yml # here we assign variables to particular groups
group2.yml
host_vars/
hostname1.yml # here we assign variables to particular systems
hostname2.yml
library/ # if any custom modules, put them here (optional)
module_utils/ # if any custom module_utils to support modules, put them here (optional)
filter_plugins/ # if any custom filter plugins, put them here (optional)
site.yml # master playbook
webservers.yml # playbook for webserver tier
dbservers.yml # playbook for dbserver tier
roles/
common/ # this hierarchy represents a "role"
tasks/ #
main.yml # <-- tasks file can include smaller files if warranted
handlers/ #
main.yml # <-- handlers file
templates/ # <-- files for use with the template resource
ntp.conf.j2 # <------- templates end in .j2
files/ #
bar.txt # <-- files for use with the copy resource
foo.sh # <-- script files for use with the script resource
vars/ #
main.yml # <-- variables associated with this role
defaults/ #
main.yml # <-- default lower priority variables for this role
meta/ #
main.yml # <-- role dependencies
library/ # roles can also include custom modules
module_utils/ # roles can also include custom module_utils
lookup_plugins/ # or other types of plugins, like lookup in this case
webtier/ # same kind of structure as "common" was above, done for the webtier role
monitoring/ # ""
fooapp/ # ""
1.2、创建roles目录
1）使用命令创建
[root@m01 roles]# ansible-galaxy init nginx
- Role nginx was created successfully
[root@m01 roles]# tree nginx
nginx #项目目录名称
├── defaults #默认的变量（优先级很低）
│ └── main.yml
├── files #存放文件，使用copy模块时自动获取
├── handlers #存放触发器的配置
│ └── main.yml
├── meta #依赖的服务，执行该项目时先执行其他的项目
│ └── main.yml
├── README.md
├── tasks #默认执行的playbook
│ └── main.yml
├── templates #存放jinja2模板，使用template模块时自动获取
├── tests
│ ├── inventory
│ └── test.yml
└── vars #存放变量
└── main.yml
2)手动创建
[root@m01 roles]# mkdir nginx/{tasks,files,templates,vars,handlers,meta} -p
[root@m01 roles]# tree nginx/
nginx/
├── files
├── handlers
├── meta
├── tasks
├── templates
└── vars
1.3、Ansible Roles依赖关系
roles 允许你在使用roles时自动引入其他的roles，role依赖关系存储在roles目录中meta/main.yml文件中。
例如：推送wordpress并解压，前提条件，必须安装nginx和php，把服务跑起来才能运行wordpress页面，此时我们就可以在wordpress的roles中定义依赖nginx和php的roles。
vim /etc/ansible/roles/wordpress/meta/main.yml
dependencies:
- { role: nginx }
- { reole: php }
如果编写了meta目录下的main.yml文件，那么Ansible会自动先执行meta目录中的maiin.yml文件中的dependencies文件，如上所示，就会先执行nginx和php的安装
二、重构playbook
重构playbook思路
1.配置主机清单
vim /etc/ansible/hosts #将所有主机名或IP写入文件
2.配置hosts
vim /etc/hosts #将所有主机名+ip填入
3.优化部分
# 统一设置关闭防火墙，创建统一用户
4.配置nginx
1)准备配置文件
2)下载nginx--检测是否安装
3)推送配置文件---触发器：重启nginx
4)启动nginx
5.配置php
1)准备配置文件
2)下载php--检测是否安装
3)推送配置文件---触发器：重启php
4)启动php
6.配置数据库
1)下载mariadb
2)MySQL-PYTHON
3)启动mariadb
4)新建项目数据库表
5)授权
6)上传数据库文件
7.项目部分
1)准备文件(网站配置文件、代码包...)
2)创建站点目录
3)推送解压代码包
4)推送配置文件
5)站点目录授权
6)推送网站配置文件--触发器：重启nginx
8.负载均衡
1)准备文件(upstream配置文件)
2)下载nginx
3)推送配置文件--触发器：重启nginx
4)开启nginx
9.keepalived
1)准备keepalived配置文件
2)下载keepalived
3)推送配置文件--触发器：重启keepalived
4)开启keepalived
10.nfs
1)下载rpcbind和nfs-server
2)脚本运行检测挂载点
2)添加挂载点--触发器：重启nfs-server
11.整合剧本
2.1、配置主机清单
!/bin/bash
cat >> /etc/ansible/hosts << EOF
nfs ansible_ssh_pass='1'
[web_group]
web01 ansible_ssh_pass='1'
web02 ansible_ssh_pass='1'
web03 ansible_ssh_pass='1'
[lb_group]
lb01 ansible_ssh_pass='1'
lb02 ansible_ssh_pass='1'
[db01]
db01 ansible_ssh_pass='1'
EOF
1)准备文件
/mnt/roles/ansible_hostlist.sh
### 2)编写剧本
- hosts: all
tasks:
- name: Add Host List
script: /mnt/roles/host_list.sh
2.2、配置本机hosts
!/bin/bash
cat >> /etc/hosts <<EOF
192.168.207.7 web01
192.168.207.8 wb02
192.168.207.9 web03
192.168.207.31 nfs
192.168.207.51 db01
192.168.207.5 lb01
192.168.207.6 lb02
192.168.207.61 master
EOF
1)准备文件
/mnt/roles/add_localhost.sh
### 2)编写脚本
- name: Add Localhost
script: /mnt/roles/add_localhost.sh
2...Send Code File
1）准备文件
1. /mnt/roles/code/files/wordpress.tar.gz
2)编写剧本
vim /mnt/roles/code/tasks/main.yml
- name: Send Code Box
unarchive:
src: /mnt/roles/code/files/wordpress.tar.gz
dest: /mnt/
when: ansible_fqdn == "nfs"
2.3、优化部分（first）
1）准备文件
1./mnt/roles/first/files/init.sh
2)编写剧本
vim /mnt/roles/first/tasks/main.yml
- name: Stop Firewalld
service:
name: firewalld
state: stopped
enabled: no
- name: Stop Selinux Now
shell: setenforce 0
ignore_errors: yes
- name: Stop Selinux
selinux:
state: disabled
- name: Create Group
group:
name: www
gid: 666
state: present
- name: Create User
user:
name: www
uid: 666
group: www
create_home: false
shell: /sbin/nologin
- name: Running Init.sh
script: /mnt/roles/first/files/init.sh
2.4、nginx部分
1）准备文件
1./mnt/roles/nginx/files/nginx.conf
2./mnt/roles/nginx/files/proxy_params
2)安装nginx
vim /mnt/roles/nginx/tasks/main.yml
- name: Check Nginx
shell: rpm -ql nginx
ignore_errors: yes
register: check_nginx
- name: Install Nginx
yum:
name: nginx
state: present
when: check_nginx.rc != 0
- name: Send Conf File
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "nginx.conf", dest: "/etc/nginx" }
- { src: "proxy_params", dest: "/etc/nginx/" }
notify: restart_nginx
- name: Senf Include File
copy:
src: proxy_params
dest: /etc/nginx/
- name: Start Nginx
service:
name: nginx
state: started
enabled: yes
3)配置触发器
vim /mnt/roles/nginx/handlers/main.yml
- name: restart_nginx
service:
name: nginx
state: restarted
4)变量文件
vim /mnt/roles/nginx/vars/main.yml
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.5、php部分
1）准备文件
1./mnt/roles/php/files/www.conf
2./mnt/roles/php/files/php.ini
2)编写剧本
vim /mnt/roles/php/tasks/main.yml
- name: Remove Old Php
shell: yum -y remove php-mysql-5.4 php php-fpm php-common
- name: Check php
shell: rpm -qa | grep php
ignore_errors: yes
register: check_php
- name: Download Php7.2-1
shell: rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
when: check_php.rc != 0
- name: Download Php7.2-2
shell: rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
- name: Install Php7.2
shell: yum -y install php71w php71w-cli php71w-common php71w-devel php71w-embedded php71w-gd php71w-mcrypt php71w-mbstring php71w-pdo php71w-xml php71w-fpm php71w-mysqlnd php71w-opcache php71w-pecl-memcached php71w-pecl-redis php71w-pecl-mongodb
- name: Send php File
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "www.conf", dest: "/etc/pfp-fpm.d/" }
- { src: "php.ini", dest: "/etc/" }
- name: Start Php
service:
name: php-fpm
state: started
enabled: yes
3)编辑触发器
vim /mnt/roles/php/handlers/main.yml
- name: restart_php
service:
name: php-fpm
state: restarted
2.6、数据库部分
1)准备文件
/mnt/roles/file.sql
2）编写剧本
vim /mnt/roles/mariadb/tasks/main.yml
- name: Check Mariadb
shell: rpm -qa | grep mariadb-server
ignore_errors: yes
register: check_mariadb
- name: Check Mysql-python
shell: rpm -ql MySQL-python
ignore_errors: yes
register: check_mysql
- name: Install Mariadb
yum:
name: mariadb-server
state: present
when: check_mariadb.rc != 0
- name: Install Mysql-python
yum:
name: MySQL-python
state: present
when: check_mysql.rc != 0
- name: Start Mariadb
service:
name: mariadb
state: started
enabled: yes
- name: Create Edusoho Database User
mysql_user:
name: "root"
host: "{{ net_ip }}.%"
password: "123"
priv: ".:ALL"
state: present
- name: Send File.sql
copy:
src: edusoho.sql
dest: /root/
- name: Create New Database
mysql_db:
name: edusoho
state: present
login_user: root
login_password: 123
- name: Import File.sql
mysql_db:
name: edusoho
state: import
target: /root/edusoho.sql
login_user: root
login_password: 123
3)触发器
- name: restart_mariadb
service:
name: mariadb-server
state: restarted
4）变量文件
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.7、项目代码部分
1）准备文件
1./mnt/roles/wordpress/templates/www.papacnb.com.conf
2)编写剧本
vim /mnt/roles/wordpress/tasks/main.yml
- name: Create Dir
file:
path: "{{ server_path }}"
state: directory
- name: Mount Dir
shell: mount -t nfs {{ nfs_ip }}:{{ server_path }} {{ server_path }}
- name: Chown Dir
shell: chown -R www.www {{ server_path }}
- name: Send Conf File
template:
src: "{{ server_path }}"
dest: /etc/nginx/conf.d/
notify: restart_nginx
3)配置触发器
- name: restart_nginx
service:
name: naginx
state: restarted
4)变量文件
vim /mnt/roles/wordpress/vars/main.yml
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.8、负载均衡部分
1)准备文件
/mnt/roles/upstream/templates/upstream.conf
/mnt/roles/upstream/files/proxy_params
2)编写剧本
vim /mnt/roles/upstream/tashs/main.yml
- name: Check Nginx
shell: rpm -ql nginx
ignore_errors: yes
register: check_nginx
- name: Install Nginx
yum:
name: nginx
state: present
when: check_nginx.rc != 0
- name: Send Conf File
template:
src: upstream.conf
dest: /etc/nginx/conf.d/
notify: restart_nginx
- name: Send Proxy_params
copy:
src: proxy_params
dest: /etc/nginx/
- name: Start Nginx
service:
name: nginx
state: started
3)编写触发器
- name: restart_nginx
service:
name: nginx
state: restarted
4)变量文件
vim /mnt/roles/upstream/vars/main.yml
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.9、配置keepalived
1)准备文件
1./mnt/roles/keepalived/template/keepalived.conf
2./mnt/roles/keepalived/files/check.sh
2)编写剧本
vim /mnt/roles/keepalived/tasks/main.yml
- name: Check Keepalived
shell: rpm -ql keepalived
ignore_errors: yes
register: check_keepalived
- name: Install Keepalived
yum:
name: keepalived
state: installed
when: check_keepalived.rc != 0
- name: Send Check.sh
copy:
src: check.sh
dest: /etc/keepalived/
- name: Send Conf File
template:
src: keepalived.conf
dest: /etc/keepalived/
notify: restart_keepalived
- name: Start Keepalived
service:
name: keepalived
state: started
3)配置触发器
- name: restart_keepalived
service:
name: keepalived
state: restarted
2.10、配置NFS
1）准备文件
1./mnt/roles/nfs/templates/check_mount.sh
2)编写剧本
vim /mnt/roles/nfs/tasks/main.yml
- name: Check Nfs
shell: rpm -ql nfs-utils
ignore_errors: yes
register: check_nfs
- name: Install Nfs-server
yum:
name: nfs-utils
state: present
when: check_nfs.rc != 0
- name: Install Rpcbind
yum:
name: rpcbind
state: present
- name: Start Nfs
service:
name: nfs-server
state: started
enabled: yes
- name: Start Rpcbind
service:
name: rpcbind
state: tarted
enabled: yes
- name: Mount Dir
template:
src: check_mount.sh
dest: /root/
- name: Chown Mount Jt Dir
shell: chown -R www.www {{ server_path_jt }}
- name: Chown Mount Dir
shell: chown -R www.www {{ server_path }}
- name: Check Mount
shell: chmod +x check_mount.sh
- name: Run Mount
shell: ./check_mount.sh
- name: restart_nfs
service:
name: nfs-server
state: restarted
3）变量文件
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.11、全站https配置
1）准备文件
/mnt/roles/https/files/server.cert
/mnt/roles/https/files/server.key
2)剧本编写
vim /mnt/roles/https/tasks/main.yml
- name: Make Dir
file:
path: /etc/nginx/ssl_key
state: directory
- name: Send Key
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "server.cert", dest: "/etc/nginx/ssl_key/" }
- { src: "server.cert.key", dest: "/etc/nginx/ssl_key/" }
2.12、web_nfs部分
1）编写剧本
vim /mnt/roles/web_nfs/tasks/main.yml
- name: Install Nfs
yum:
name: nfs-utils
state: installed
- name: Install Rpcbind
yum:
name: rpcbind
state: present
- name: Start Nfs
service:
name: nfs-server
state: started
enabled: yes
- name: Start Rpcbind
service:
name: rpcbind
state: started
enabled: yes
2.13、lb_nfs部分
1）编写剧本
vim /mnt/roles/lb_nfs/tasks/main.yml
- name: Install Nfs
yum:
name: nfs-utils
- name: Install Rpcbind
yum:
name: rpcbind
- name: Start Nfs
service:
name: "{{ item }}"
state: started
enabled: yes
with_items:
- nfs-server
- rpcbind
- name: Make Jt Dir
file:
path: "{{ server_path_jt }}"
state: directory
- name: Mount Jt Dir
mount:
src: "{{ nfs_ip }}":"{{server_path_jt}}"
path: "{{ server_path_jt }}"
fstype: nfs
opts: default
state: mounted
2)变量文件
vim /mnt/roles/lb_nfs/vars/main.yml
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.14、Prometheus部分
1）准备文件
1./mnt/roles/prometheus/files/prometheus.tar.gz
2./mnt/roles/prometheus/files/prometheus.service
3./mnt/roles/prometheus/template/prometheus.yml
4./mnt/roles/prometheus/files/profile
5./mnt/roles/mysql_prometheus/template/my.cnf
6./mnt/roles/mysql_prometheus/files/grafana.rpm
7./mnt/roles/mysql_prometheus/files/mysqld_exporter.tar.gz
8./mnt/roles/mysql_prometheus/files/mysqld-exporter.
2)编写剧本
vim /mnt/roles/prometheus/tasks/main.yml
- name: Send Prometheus-exporter Bar
unarchive:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "/mnt/roles/prometheus/files/prometheus.tar.gz", dest: "/usr/local/"}
- { src: "/mnt/roles/prometheus/files/mysqld_exporter.tar.gz", dest: "/usr/local" }
- name: Create Pro_soft_links
shell: ln -s /usr/local/prometheus-2.25.0.linux-amd64 /usr/local/prometheus
- name: Create Mysqld_sof_link
shell: ln -s /usr/local/mysqld_exporter-0.13.0.linux-amd64 /usr/local/mysqld_exporter
- name: Add Path
copy:
src: profile
dest: /etc/
- name: Source Path
shell: source /etc/profile
- name: Send Systemd File
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "prometheus.service", dest: "/usr/lib/systemd/system/"}
- { src: "mysqld-exporter.service", dest: "/usr/lib/systemd/system/"}
- name: Reload Systemd
shell: systemctl daemon-reload
- name: Send Prometheus.yml
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
with_items:
- { src: "prometheus.yml", dest: "/usr/local/prometheus/" }
- { src: "my.cnf", dest: "/usr/local/prometheus/" }
- name: Start Pro/mysqld
systemd:
name: "{{ item }}"
state: started
enabled: yes
with_items:
- prometheus
- mysqld-exporter
- name: Send Grafana Bar
copy:
name: grafana.rpm
dest: /usr/local/
- name: Install Grafana
shell: yum install -y /usr/local/grafana.rpm
- name: Start Grafana
service:
name: grafana-server
state: started
enabled: yes
3）触发器
- name: restart_prometheus
service:
name: prometheus
state: restarted
4)变量文件
vim /mnt/roles/prometheus/vars/main.yml
server_name: www.papacnb.com
server_path: /mnt/wordpress/
server_port: 80
server_path_jt: /mnt/wordpress/wp-content/uploads/
net_ip: 192.168.207
https_port: 443
server_conf: www.papacnb.com.conf
nfs_ip: 192.168.207.31
2.15、mysqld_exporter部分
1)准备文件
2）编写剧本
vim /mnt/roles/mysql_prometheus/tasks/main.yml
- name: Add Mysql User
mysql_user:
name: "mysql-exporter"
host: "{{ net_ip }}.%"
password: "123"
priv: ".:ALL"
state: present
login_user: root
login_password: 123
2.16、node_exporter部署
1）文件准备
1./mnt/roles/prometheus/files/node_exporter.tar.gz
2./mnt/roles/prometheus/files/node-exporter.service
2)编写剧本
vim /mnt/roles/prometheus/files/profile
- name: Send Node_exporter Bar
unarchive:
src: node_exporter.tar.gz
dest: /usr/local/
- name: Create Soft Links
shell: ln -s /usr/local/node_exporter-1.1.2.linux-amd64 /usr/local/node_exporter
- name: Send Profile Path
shell: echo "{{ item }}" >> /etc/profile
with_items:
- export NODE_EXPORT_HOME=/usr/local/node_exporter
- export PATH=$PATH:$NODE_EXPORT_HOME
- name: Source Path
shell: source /etc/profile
- name: Send Systemd File
copy:
src: node-exporter.service
dest: /usr/lib/systemd/system/
- name: Start Node-exporter
service:
name: node-exporter
state: started
enabled: yes
2.14、剧本整合
- hosts: all
roles:
- role: first
- role: code
- role: nfs
when: ansible_fqdn == "nfs"
- role: nginx
when: ansible_fqdn is match "web"
- role: php
when: ansible_fqdn is match "web"
- role: web_nfs
when: ansible_fqdn is match "web"
- role: wordpress
when: ansible_fqdn is match "web"
- role: mariadb
when: ansible_fqdn == "db01"
- role: lb_nfs
when: ansible_fqdn is match "lb"
- role: https
when: ansible_fqdn is match "lb"
- role: upstream
when: ansible_fqdn is match "lb"
- role: keepalived
when: ansible_fqdn is match "lb"
- role: mysqld_prometheus
when: ansible_fqdn == "db01"
- role: node_exporter
when: ansible_fqdn in ['web01', 'web02', 'web03', 'nfs', 'lb01', 'lb02']
- role: prometheus
when: ansible_fqdn == "prometheus"
浙公网安备 33010602011771号