企业运维----自动化运维工具-Ansible（一）安装部署

Ansible（一）：Ansible的安装部署

• • • 1.Ansible简介
    • 2.Ansible特点
    • 3.Ansible安装部署
    • • 环境
      • 安装
    • 4.构建用户级ansible操作环境
    • • 编辑清单
      • ssh免密认证
      • 为所有受控主机创建devops
      • sudo授权：

1.Ansible简介

1. ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。

2. ansible是基于 paramiko 开发的,并且基于模块化工作，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。ansible不需要在远程主机上安装client/agents，因为它们是基于ssh来和远

   程主机通讯的。

2.Ansible特点

1. 部署简单，只需在主控端部署Ansible环境，被控端无需做任何操作；
2. 默认使用SSH协议对设备进行管理；
3. 有大量常规运维操作模块，可实现日常绝大部分操作；
4. 配置简单、功能强大、扩展性强；
5. 支持API及自定义模块，可通过Pyhon轻松扩展；
6. 通过Playbooks来定制强大的配置、状态管理；
7. 轻量级，无需在客户端安装agent，更新时，只需在操作机上进行一次更新即可；
8. 提供一个功能强大、操作性强的Web管理界面和REST API接口——AWX平台。

3.Ansible安装部署

环境

准备rhel8.2的主机和虚拟机，也可以开4台虚拟机。配置私有网段

主机名:ip	role
真机:172.25.41.250	ansible
westosa:172.25.41.1	node
westosb:172.25.41.2	node
westosc:172.25.41.3	node

安装

配置好本地网络仓库

安装epel源后dnf安装ansible

dnf install epel-release -y
dnf install ansible –y
           

查看版本信息

[[email protected]_student41 ansible]$ ansible --version 
ansible 2.9.23
  config file = /home/devops/ansible/ansible.cfg
  configured module search path = ['/home/devops/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.8 (default, Dec  5 2019, 15:45:45) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]

           

4.构建用户级ansible操作环境

在生产环境中一般不使用root。创建用户devops并登陆

[[email protected]_student41 ~]# useradd  devops
[[email protected]_student41 ~]# su - devops
Last login: Thu Aug 26 09:44:38 CST 2021 on pts/0
           

在devops下建立一个ansible目录，复制ansible配置文件到目录并且修改配置。

为了实验方便删除一些实验用不到的内容。

[[email protected]_student41 ~]$ mkdir ansible
[[email protected]_student41 ~]$ cd ansible/
[[email protected]_student41 ansible]$ cp /etc/ansible/ansible.cfg .
[[email protected]_student41 ansible]$ ls
ansible.cfg
[[email protected]_student41 ansible]$ vim ansible.cfg 
[[email protected]_student41 ansible]$ cat ansible.cfg 
# config file for ansible -- https://ansible.com/
# ===============================================

# nearly all parameters can be overridden in ansible-playbook
# or with command line flags. ansible will read ANSIBLE_CONFIG,
# ansible.cfg in the current working directory, .ansible.cfg in
# the home directory or /etc/ansible/ansible.cfg, whichever it
# finds first

[defaults]

# some basic default values...

inventory      = ~/ansible/inventory
#roles_path    = /etc/ansible/roles
host_key_checking = False
remote_user = devops
module_name = shell

[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False
           

编辑清单

添加受控主机ip(或者主机名)

[[email protected]_student41 ansible]$ vim inventory 
[[email protected]_student41 ansible]$ cat inventory 
[westos]
172.25.41.1
[linux]
172.25.41.1
172.25.41.3
[prod]
172.25.41.2
           

分组测试

[[email protected]_student41 ansible]$ ansible all --list
  hosts (3):
    172.25.41.1
    172.25.41.3
    172.25.41.2
[[email protected]_student41 ansible]$ ansible linux  --list
  hosts (2):
    172.25.41.1
    172.25.41.3
           

ssh免密认证

[[email protected]_student41 ansible]$ ssh-keygen 
[[email protected]_student41 ansible]$ for i in 1 2 3 ; do ssh-copy-id -i ~/.ssh/id_rsa.pub [email protected].$i; done
           

为所有受控主机创建devops

[[email protected]_student41 ~]# openssl passwd -6
Password: 
Verifying - Password: 
$6$EWhfM1Ds4rxJhHvu$vgFeXV20C.20sBaXsHwCxSMEsVRl1pIMBBiAKIS2Zc92OsGleGVP6c5zfXKBY.elzv.l84.ga8rNY305DQQ2T0


[[email protected]_student41 ansible]$  ansible all -m user -a 'name=devops state=present password="$6$EWhfM1Ds4rxJhHvu$vgFeXV20C.20sBaXsHwCxSMEsVRl1pIMBBiAKIS2Zc92OsGleGVP6c5zfXKBY.elzv.l84.ga8rNY305DQQ2T0"' -u root
           

sudo授权：

[[email protected]_student41 ansible]$ ansible all -m lineinfile -a 'path=/etc/sudoers line="devops ALL=(ALL) NOPASSWD: ALL "' -u root
[[email protected]_student41 ansible]$ ansible all -m shell -a 'tail -n 3 /etc/sudoers'

172.25.41.1 | CHANGED | rc=0 >>
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
devops ALL=(ALL) NOPASSWD: ALL 
172.25.41.2 | CHANGED | rc=0 >>
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
devops ALL=(ALL) NOPASSWD: ALL 
172.25.41.3 | CHANGED | rc=0 >>
## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
devops ALL=(ALL) NOPASSWD: ALL