Ansible-安装-秘钥-部署-使用
本文转自：https://www.cnblogs.com/ylqh/p/5902259.html
ansiblemaster：192.168.74.146
ansibleslave1 ：192.168.74.144
ansibleslave2 : 192.168.74.140
安装ansible：
[root@ansiblemaster /]# yum -y install ansible
生成ssh秘钥文件，并且分发给所有客户端
[root@ansible_master ~]# ssh-keygen -t rsa #生成密钥
#将公钥分别发送到slave机器上面 [root@ansible_master ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub 192.168.74.144 -bash: ssh-copy-id: command not found 报错了 解决方法： yum -y install openssh-clients
[root@ansible_master ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub 192.168.74.144
The authenticity of host '192.168.74.144 (192.168.74.144)' can't be established.
RSA key fingerprint is b8:5b:58:13:6f:71:12:0b:10:70:97:f8:c7:71:2c:c5.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.74.144' (RSA) to the list of known hosts.
root@192.168.74.144's password:
Now try logging into the machine, with "ssh '192.168.74.144'", and check in:
.ssh/authorized_keys
to make sure we haven't added extra keys that you weren't expecting.
在slave端见检查是否出现一个authorized_keys的文件。
root@ansibleslave1 .ssh]# ls /root/.ssh/
authorized_keys
检查一下是否安装成功：
[root@ansible_master ~]# ansible --version
ansible 2.1.1.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides
安装ssh过程中如果出现sign_and_send_pubkey: signing failed: agent refused operation，解决方式为执行
eval "$(ssh-agent -s)"
ssh-add
ansible安装完成
ansible的配置：
首先配置三台主机的hosts的文件：
[root@ansiblemaster ansible]# cat /etc/hosts 192.168.74.146 ansiblesmaster 192.168.74.144 ansibleslave1 192.168.74.140 ansibleslave2
配置ansible的host分组
[root@ansiblemaster ansible]# cat /etc/ansible/hosts [www] ansibleslave1 ansibleslave2
测试ansible与slave的是否可用了
[root@ansiblemaster ansible]# ansible *www* -m shell -a "df -h" -k SSH password: ansibleslave1 | SUCCESS | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 488M 0 488M 0% /dev tmpfs 495M 0 495M 0% /dev/shm tmpfs 495M 624K 495M 1% /run tmpfs 495M 0 495M 0% /sys/fs/cgroup /dev/sda3 18G 1.4G 17G 8% / tmpfs 495M 44K 495M 1% /tmp /dev/sda1 283M 74M 191M 28% /boot tmpfs 99M 0 99M 0% /run/user/0 tmpfs 99M 0 99M 0% /run/user/1000 ansibleslave2 | SUCCESS | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 488M 0 488M 0% /dev tmpfs 495M 0 495M 0% /dev/shm tmpfs 495M 648K 495M 1% /run tmpfs 495M 0 495M 0% /sys/fs/cgroup /dev/sda3 18G 2.1G 16G 12% / tmpfs 495M 48K 495M 1% /tmp /dev/sda1 283M 74M 191M 28% /boot tmpfs 99M 0 99M 0% /run/user/0 tmpfs 99M 0 99M 0% /run/user/1000
到此ansible已经支持简单的批量命令了
ansible错误排除：
第一：
[root@ansiblemaster ansible]# ansible -m ping all -k
SSH password:
ansibleslave1 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh.",
"unreachable": true
}
解决方法：
第一：首先查看客户端的/root/.ssh/下面是否存在 authorized_keys文件。
第二：测试master端是否可以无密钥登录slave端
（注意：检查防火墙与selinux）
第三：ping主机名是否可以ping通。
第二：
[root@ansiblemaster ansible]# ansible all -m ping -k
SSH password:
ansibleslave1 | FAILED! => {
"failed": true,
"msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host."
}
ssh第一次连接的时候一般会提示输入yes 进行确认为将key字符串加入到 ~/.ssh/known_hosts 文件中。而本机的~/.ssh/known_hosts文件中并有fingerprint key串
解决方法：在ansible.cfg文件中更改下面的参数：
# host_key_checking = False
将#号去掉即可
###################ansible内置模块的使用####################
先介绍一下ansible的命令参数：
1 [root@ansiblemaster ansible]# ansible --help 2 Usage: ansible <host-pattern> [options] 3 4 Options: 5 -a MODULE_ARGS, --args=MODULE_ARGS #（指定模块参数） 6 module arguments 7 --ask-vault-pass ask for vault password 8 -B SECONDS, --background=SECONDS #（在后台运行命令，在制定NUM秒后kill该任务） 9 run asynchronously, failing after X seconds 10 (default=N/A) 11 -C, --check don't make any changes; instead, try to predict some 12 of the changes that may occur #（只是测试一下会改变什么内容，不会真正去执行） 13 -D, --diff when changing (small) files and templates, show the 14 differences in those files; works great with --check 15 -e EXTRA_VARS, --extra-vars=EXTRA_VARS 16 set additional variables as key=value or YAML/JSON 17 -f FORKS, --forks=FORKS 18 specify number of parallel processes to use 19 (default=5) 20 -h, --help show this help message and exit #（帮助信息） 21 -i INVENTORY, --inventory-file=INVENTORY #（指定hosts文件路径，默认default=/etc/ansible/hosts） 22 specify inventory host path 23 (default=/etc/ansible/hosts) or comma separated host 24 list. 25 -l SUBSET, --limit=SUBSET 26 further limit selected hosts to an additional pattern 27 --list-hosts outputs a list of matching hosts; does not execute 28 anything else 29 -m MODULE_NAME, --module-name=MODULE_NAME #（指定模块） 30 module name to execute (default=command) 31 -M MODULE_PATH, --module-path=MODULE_PATH #（要执行的模块路径，默认为/usr/share/ansible） 32 specify path(s) to module library (default=None) 33 --new-vault-password-file=NEW_VAULT_PASSWORD_FILE 34 new vault password file for rekey 35 -o, --one-line condense output #（一个主机的执行结果在一行显示） 36 --output=OUTPUT_FILE output file name for encrypt or decrypt; use - for 37 stdout 38 -P POLL_INTERVAL, --poll=POLL_INTERVAL 39 set the poll interval if using -B (default=15) 40 --syntax-check perform a syntax check on the playbook, but do not 41 execute it 42 -t TREE, --tree=TREE log output to this directory #（日志输出到该目录，日志文件名以主机名命名） 43 --vault-password-file=VAULT_PASSWORD_FILE 44 vault password file 45 -v, --verbose verbose mode (-vvv for more, -vvvv to enable 46 connection debugging) 47 --version show program's version number and exit 48 49 Connection Options: 50 control as whom and how to connect to hosts 51 52 -k, --ask-pass ask for connection password #（输入ssh密码,而不是使用秘钥） 53 --private-key=PRIVATE_KEY_FILE, --key-file=PRIVATE_KEY_FILE 54 use this file to authenticate the connection 55 -u REMOTE_USER, --user=REMOTE_USER #（指定远程机器的用户） 56 connect as this user (default=None) 57 -c CONNECTION, --connection=CONNECTION #（指定建立连接的类型，一般有ssh，localhost FILES） 58 connection type to use (default=smart) 59 -T TIMEOUT, --timeout=TIMEOUT #（超时时间） 60 override the connection timeout in seconds 61 (default=10) 62 --ssh-common-args=SSH_COMMON_ARGS 63 specify common arguments to pass to sftp/scp/ssh (e.g. 64 ProxyCommand) 65 --sftp-extra-args=SFTP_EXTRA_ARGS 66 specify extra arguments to pass to sftp only (e.g. -f, 67 -l) 68 --scp-extra-args=SCP_EXTRA_ARGS 69 specify extra arguments to pass to scp only (e.g. -l) 70 --ssh-extra-args=SSH_EXTRA_ARGS 71 specify extra arguments to pass to ssh only (e.g. -R) 72 73 Privilege Escalation Options: 74 control how and which user you become as on target hosts 75 76 -s, --sudo run operations with sudo (nopasswd) (deprecated, use 77 become) 78 -U SUDO_USER, --sudo-user=SUDO_USER 79 desired sudo user (default=root) (deprecated, use 80 become) 81 -S, --su run operations with su (deprecated, use become) 82 -R SU_USER, --su-user=SU_USER 83 run operations with su as this user (default=root) 84 (deprecated, use become) 85 -b, --become run operations with become (does not imply password 86 prompting) 87 --become-method=BECOME_METHOD 88 privilege escalation method to use (default=sudo), 89 valid choices: [ sudo | su | pbrun | pfexec | runas | 90 doas | dzdo ] 91 --become-user=BECOME_USER 92 run operations as this user (default=root) 93 --ask-sudo-pass ask for sudo password (deprecated, use become) 94 --ask-su-pass ask for su password (deprecated, use become) 95 -K, --ask-become-pass #（提示输入sudo密码，与sudo一起使用） 96 ask for privilege escalation password
（解释的不是太全，有些我还没有用到，欢迎大牛指定！）
ansible的模块的使用：
第一个：copy模块
用途：把master端文件拷贝到其他slave端上
[root@ansiblemaster ansible]# ansible *www* -m copy -a 'src=/etc/ansible/test1.txt dest=/opt/'
ansibleslave2 | FAILED! => {
"changed": false,
"checksum": "44b9edcf7d3cb15a005a3eb16b8011d352399eed",
"failed": true,
"msg": "Aborting, target uses selinux but python bindings (libselinux-python) aren't installed!"
}
问题：被控机器上开启selinux的，需要要安装上libselinux-python
解决办法：被控机器上安装：
yum -y install libselinux-python
[root@ansiblemaster ansible]# ansible *www* -m copy -a 'src=/etc/ansible/test1.txt dest=/opt/' -k
SSH password:
ansibleslave2 | SUCCESS => {
"changed": true,
"checksum": "44b9edcf7d3cb15a005a3eb16b8011d352399eed",
"dest": "/opt/test1.txt",
"gid": 0,
"group": "root",
"md5sum": "0a1d32cf98dac2652ecca0aa4571ac3b",
"mode": "0644",
"owner": "root",
"secontext": "system_u:object_r:usr_t:s0",
"size": 5,
"src": "/root/.ansible/tmp/ansible-tmp-1474886175.03-280566111251484/source",
"state": "file",
"uid": 0
}
第二个：file模块：
用途：更改被控节点的权限为777，属主数组为root
[root@ansiblemaster ansible]# ansible all -m file -a "dest=/opt/test1.txt mode=777 owner=root group=root"
ansibleslave1 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "0777",
"owner": "root",
"path": "/opt/test1.txt",
"secontext": "system_u:object_r:usr_t:s0",
"size": 5,
"state": "file",
"uid": 0
}
第三个：cron
用途：在所有节点上设置crontab
[root@ansiblemaster ansible]# ansible all -m cron -a 'name="custom job" minute=*/3 hour=* day=* month=* weekday=* job="/usr/sbin/ntpdate 192.168.74.146"'
ansibleslave1 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"custom job"
]
}
ansibleslave2 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"custom job"
]
}
第四个：group模块
用途：在所有被控端上创建gid是2048的名字为zzl的组
[root@ansiblemaster ansible]# ansible all -m group -a 'gid=2048 name=zzl'
ansibleslave1 | SUCCESS => {
"changed": true,
"gid": 2048,
"name": "zzl",
"state": "present",
"system": false
}
ansibleslave2 | SUCCESS => {
"changed": true,
"gid": 2048,
"name": "zzl",
"state": "present",
"system": false
}
第五个：user模块
用途：在所有被控端上创建用户名为zzl，组名为zzl的用户
[root@ansiblemaster ansible]# ansible all -m user -a 'name=zzl groups=zzl state=present'
ansibleslave1 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 100,
"groups": "zzl",
"home": "/home/zzl",
"name": "zzl",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 1003
}
ansibleslave2 | SUCCESS => {
"changed": true,
"comment": "",
"createhome": true,
"group": 100,
"groups": "zzl",
"home": "/home/zzl",
"name": "zzl",
"shell": "/bin/bash",
"state": "present",
"system": false,
"uid": 1002
}
第六：get_url模块：
用途： 将http://ip/的index.html下载到所有节点的/home目录下
[root@ansiblemaster ~]# ansible all -m get_url -a 'url=http://ip/ dest=/home'
ansibleslave1 | SUCCESS => {
"changed": true,
"checksum_dest": null,
"checksum_src": "3b8a8ccd603538b663776258db5265adf1e87ece",
"dest": "/home/index.html",
"gid": 0,
"group": "root",
"md5sum": "8235b10c5e8177ab388f9b0f7073bcb9",
"mode": "0644",
"msg": "OK (unknown bytes)",
"owner": "root",
"secontext": "unconfined_u:object_r:home_root_t:s0",
"size": 3209,
"src": "/tmp/tmp5dcxVi",
"state": "file",
"uid": 0,
"url": "http://211.151.81.74/"
}
ansibleslave2 | SUCCESS => {
"changed": true,
"checksum_dest": null,
"checksum_src": "67190352276452de41c7b08b0eb98d0b997ea21a",
"dest": "/home/index.html",
"gid": 0,
"group": "root",
"md5sum": "643988ed5105422eaf813b6acde9661a",
"mode": "0644",
"msg": "OK (unknown bytes)",
"owner": "root",
"secontext": "unconfined_u:object_r:home_root_t:s0",
"size": 3209,
"src": "/tmp/tmpmGTNeq",
"state": "file",
"uid": 0,
"url": "http://211.151.81.74/"
}
第七：script模块
用途：在所有节点上执行/home/1.sh脚本(该脚本是在ansible控制节点上的)
[root@ansiblemaster ~]# ansible all -m script -a '/home/1.sh'
ansibleslave1 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "",
"stdout": "",
"stdout_lines": []
}
ansibleslave2 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "",
"stdout": "",
"stdout_lines": []
}
第八：command:
用途：在指定节点上运行df -h的命令
[root@ansiblemaster ~]# ansible all -m command -a 'df -h' ansibleslave1 | SUCCESS | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 488M 0 488M 0% /dev tmpfs 495M 0 495M 0% /dev/shm tmpfs 495M 624K 495M 1% /run tmpfs 495M 0 495M 0% /sys/fs/cgroup /dev/sda3 18G 1.4G 17G 8% / tmpfs 495M 44K 495M 1% /tmp /dev/sda1 283M 74M 191M 28% /boot tmpfs 99M 0 99M 0% /run/user/0 tmpfs 99M 0 99M 0% /run/user/1000 ansibleslave2 | SUCCESS | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 488M 0 488M 0% /dev tmpfs 495M 0 495M 0% /dev/shm tmpfs 495M 648K 495M 1% /run tmpfs 495M 0 495M 0% /sys/fs/cgroup /dev/sda3 18G 2.2G 16G 12% / tmpfs 495M 48K 495M 1% /tmp /dev/sda1 283M 74M 191M 28% /boot tmpfs 99M 0 99M 0% /run/user/0 tmpfs 99M 0 99M 0% /run/user/1000
