一、简介
Ansible is a radically simple configuration-management, application deployment, task-execution, and multinode orchestration engine.
Design Principles
Have a dead simple setup process and a minimal learning curve
Be super fast & parallel by default
Require no server or client daemons; use existing SSHd
Use a language that is both machine and human friendly
Focus on security and easy auditability/review/rewriting of content
Manage remote machines instantly, without bootstrapping
Allow module development in any dynamic language, not just Python
Be usable as non-root
Be the easiest IT automation system to use, ever.
二、安装
2.1 编译安装
解决依赖关系
# yum -y install python-jinja2 PyYAML python-paramiko python-babel python-crypto
# tar xf ansible-1.5.4.tar.gz
# cd ansible-1.5.4
# python setup.py build
# python setup.py install
# mkdir /etc/ansible
# cp -r examples/* /etc/ansible
2.2 rpm包安装
三、部署
3.1 四台主机
192.168.1.220 svn.abc.com svn
192.168.1.221 rs1.abc.com rs1
192.168.1.222 rs2.abc.com rs2
192.168.1.3 master.abc.com master
3.2 系统版本
CentOS release 6.5
2.6.32-431.el6.x86_64
3.3 以220作为控制台，指挥着rs1,rs2,master
[root@svn ~]# yum list all ansib*
已加载插件：fastestmirror, security
Loading mirror speeds from cached hostfile
epel/metalink | 3.2 kB 00:00
* base: centos.ustc.edu.cn
* epel: mirrors.neusoft.edu.cn
* extras: mirrors.pubyun.com
* updates: centos.ustc.edu.cn
base | 3.7 kB 00:00
epel | 4.4 kB 00:00
getepel/primary_db 33% [===== ] 16 kB/s | 2.2 MB 04:35 Eepel/primary_db | 6.6 MB 03:24
extras | 3.4 kB 00:00
updates | 3.4 kB 00:00
updates/primary_db | 3.8 MB 00:03
可安装的软件包
ansible.noarch 1.9.1-1.el6 epel
ansible-inventory-grapher.noarch 1.0.1-2.el6 epel
ansible-lint.noarch 2.0.1-1.el6 epel
[root@svn ~]# yum install ansible
3.4 改一下本地主机库
[root@svn ~]# cd /etc/ansible/
[root@svn ansible]# ls
ansible.cfg hosts roles
[root@svn ansible]# vim hosts
:.,$s/^\([^[:space:]#]\)/#\1/g注释掉例子再配
[webservers]
rs1.abc.com
rs2.abc.com
[dbservers]
master.abc.com
3.5 任何svn联系被控制主机，基于ssh连接
[root@svn ansible]# ssh-keygen -t rsa -P ''
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
71:dd:e4:81:47:bc:39:f3:b2:2b:9e:72:87:bc:60:b8 root@svn.abc.com
The key's randomart image is:
+--[ RSA 2048]----+
| ++ |
| ..+o. |
| . . ..oo |
| o = |
| S + |
| . . .|
| . o. . o |
| o..=.o |
| E +++.. |
+-----------------+
[root@svn ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@rs1.abc.com
[root@svn ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@rs2.abc.com
[root@svn ansible]# ssh-copy-id -i /root/.ssh/id_rsa.pub root@master.abc.com
3.6 ansible基本语法
ansible <host-pattern> [-f forks] [-m module_name] [-a args]
默认模块 -m command
执行一个事例测试一下
[root@svn ansible]# ansible all -m ping
rs2.abc.com | success >> {
"changed": false,
"ping": "pong"
}
rs1.abc.com | success >> {
"changed": false,
"ping": "pong"
}
master.abc.com | success >> {
"changed": false,
"ping": "pong"
}
时间是否一致
[root@svn ~]# ansible all -a 'date'
rs2.abc.com | success | rc=0 >>
Thu Jun 18 20:53:03 CST 2015
rs1.abc.com | success | rc=0 >>
Tue Jun 23 21:48:44 CST 2015
master.abc.com | success | rc=0 >>
Mon Jun 1 19:11:27 CST 2015
更改一下时间
[root@svn ~]# ansible all -m command -a 'ntpdate time.nist.gov'
master.abc.com | success | rc=0 >>
24 Jun 11:43:43 ntpdate[33091]: adjust time server 128.138.141.172 offset 0.003317 sec
rs1.abc.com | success | rc=0 >>
24 Jun 11:43:57 ntpdate[4133]: step time server 64.113.32.5 offset 46706.282835 sec
rs2.abc.com | success | rc=0 >>
24 Jun 11:43:58 ntpdate[12483]: step time server 64.113.32.5 offset 482046.302774 sec
[root@svn ~]# ansible all -a 'date'
rs2.abc.com | success | rc=0 >>
Wed Jun 24 11:44:05 CST 2015
rs1.abc.com | success | rc=0 >>
Wed Jun 24 11:44:05 CST 2015
master.abc.com | success | rc=0 >>
Wed Jun 24 11:44:05 CST 2015
3.7 列出ansible支持模块
[root@svn ~]# ansible-doc -l
把一个文件复制到3台主机上
[root@svn ~]# ansible webservers -m copy -a "src=/root/epel-release-6-8.noarch.rpm dest=/tmp/"
rs2.abc.com | success >> {
"changed": false,
"checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a",
"dest": "/tmp/epel-release-6-8.noarch.rpm",
"gid": 0,
"group": "root",
"mode": "0644",
"owner": "root",
"path": "/tmp/epel-release-6-8.noarch.rpm",
"size": 14540,
"state": "file",
"uid": 0
}
rs1.abc.com | FAILED >> {
"checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a",
"failed": true,
"msg": "Aborting, target uses selinux but python bindings (libselinux-python) aren't installed!"
} //提示出错，去rs1那台主机安装yum install libselinux-python吧
再来试一次
[root@svn ~]# ansible webservers -m copy -a "src=/root/epel-release-6-8.noarch.rpm dest=/tmp/"
rs2.abc.com | success >> {
"changed": false,
"checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a",
"dest": "/tmp/epel-release-6-8.noarch.rpm",
"gid": 0,
"group": "root",
"mode": "0644",
"owner": "root",
"path": "/tmp/epel-release-6-8.noarch.rpm",
"size": 14540,
"state": "file",
"uid": 0
}
rs1.abc.com | success >> {
"changed": true,
"checksum": "2b2767a5ae0de30b9c7b840f2e34f5dd9deaf19a",
"dest": "/tmp/epel-release-6-8.noarch.rpm",
"gid": 0,
"group": "root",
"md5sum": "2cd0ae668a585a14e07c2ea4f264d79b",
"mode": "0644",
"owner": "root",
"secontext": "unconfined_u:object_r:user_tmp_t:s0",
"size": 14540,
"src": "/root/.ansible/tmp/ansible-tmp-1435139261.54-223429784911851/source",
"state": "file",
"uid": 0
}
验证
[root@svn ~]# ansible webservers -a 'ls /tmp'
rs2.abc.com | success | rc=0 >>
epel-release-6-8.noarch.rpm
mysql
rs1.abc.com | success | rc=0 >>
epel-release-6-8.noarch.rpm
lost+found
3.8 在每一个主机定义crontab任务
[root@svn ~]# ansible-doc -s cron
less 436
Copyright (C) 1984-2009 Mark Nudelman
less comes with NO WARRANTY, to the extent permitted by law.
For information about the terms of redistribution,
see the file named README in the less distribution.
Homepage: http://www.greenwoodsoftware.com/less
- name: M a n a g e c r o n . d a n d c r o n t a b e n t r i e s .
action: cron
backup # If set, create a backup of the crontab before it
cron_file # If specified, uses this file in cron.d instead of
day # Day of the month the job should run ( 1-31, *, */
hour # Hour when the job should run ( 0-23, *, */2, etc
job # The command to execute. Required if state=present
minute # Minute when the job should run ( 0-59, *, */2, et
month # Month of the year the job should run ( 1-12, *, *
name= # Description of a crontab entry.
reboot # If the job should be run at reboot. This option i
special_time # Special time specification nickname.
state # Whether to ensure the job is present or absent.
user # The specific user whose crontab should be modifie
weekday
[root@svn ~]# ansible all -m cron -a 'name="custom job" minute=*/1 hour=* day=* month=* weekday=* job="/usr/sbin/ntpdate time.nist.gov"'
rs2.abc.com | success >> {
"changed": true,
"jobs": [
"custom job"
]
}
rs1.abc.com | success >> {
"changed": true,
"jobs": [
"custom job"
]
}
master.abc.com | success >> {
"changed": true,
"jobs": [
"custom job"
]
}
[root@svn ~]# ansible all -a "crontab -l"
rs2.abc.com | success | rc=0 >>
#Ansible: custom job
*/1 * * * * /usr/sbin/ntpdate time.nist.gov
rs1.abc.com | success | rc=0 >>
#Ansible: custom job
*/1 * * * * /usr/sbin/ntpdate time.nist.gov
3.9 定义一个组
[root@svn ~]# ansible-doc -s group
less 436
Copyright (C) 1984-2009 Mark Nudelman
less comes with NO WARRANTY, to the extent permitted by law.
For information about the terms of redistribution,
see the file named README in the less distribution.
Homepage: http://www.greenwoodsoftware.com/less
- name: A d d o r r e m o v e g r o u p s
action: group
gid # Optional `GID' to set for the group.
name= # Name of the group to manage.
state # Whether the group should be present or not on the remote host.
system # If `yes', indicates that the group created is a system group.
[root@svn ~]# ansible all -m group -a "gid=306 system=yes name=mysql"
rs2.abc.com | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
master.abc.com | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
rs1.abc.com | success >> {
"changed": true,
"gid": 306,
"name": "mysql",
"state": "present",
"system": true
}
验证
[root@svn ~]# ansible all -a "tail -l /etc/group"
rs2.abc.com | success | rc=0 >>
tcpdump:x:72:
oprofile:x:16:
slocate:x:21:
mysql:x:306:
zabbix:x:498:
ldap:x:55:
apache:x:48:
zabbixsrv:x:497:
li:x:501:
ganglia:x:495:
rs1.abc.com | success | rc=0 >>
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
sshd:x:74:
tcpdump:x:72:
oprofile:x:16:
slocate:x:21:
nscd:x:28:
ldap:x:55:
mysql:x:306:
master.abc.com | success | rc=0 >>
postfix:x:89:
cgred:x:499:
stapusr:x:156:
stapsys:x:157:
stapdev:x:158:
sshd:x:74:
tcpdump:x:72:
oprofile:x:16:
slocate:x:21:
mysql:x:306:
3.10 安装corosync
[root@svn ~]# ansible-doc -s yum
less 436
Copyright (C) 1984-2009 Mark Nudelman
less comes with NO WARRANTY, to the extent permitted by law.
For information about the terms of redistribution,
see the file named README in the less distribution.
Homepage: http://www.greenwoodsoftware.com/less
- name: M a n a g e s p a c k a g e s w i t h t h e I ( y u m ) p a c k a g e m a n a g e r
action: yum
conf_file # The remote yum configuration file to use for the transaction.
disable_gpg_check # Whether to disable the GPG checking of signatures of packages being installed. Has an effect only if state is `present' or `latest'.
disablerepo # `Repoid' of repositories to disable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them wi
enablerepo # `Repoid' of repositories to enable for the install/update operation. These repos will not persist beyond the transaction. When specifying multiple repos, separate them wit
list # Various (non-idempotent) commands for usage with `/usr/bin/ansible' and `not' playbooks. See examples.
name= # Package name, or package specifier with version, like `name-1.0'. When using state=latest, this can be '*' which means run: yum -y update. You can also pass a url or a loc
state # Whether to install (`present', `latest'), or remove (`absent') a package.
update_cache # Force updating the cache. Has an effect only if state is `present' or `latest'.
[root@svn ~]# ansible all -m yum -a "state=present name=corosync"
[root@svn ~]# ansible all -a "rpm -q corosync"
rs2.abc.com | success | rc=0 >>
corosync-1.4.7-1.el6.x86_64
rs1.abc.com | success | rc=0 >>
corosync-1.4.7-1.el6.x86_64
master.abc.com | success | rc=0 >>
corosync-1.4.7-1.el6.x86_64
3.11 启动服务
[root@svn ~]# ansible all -a "service httpd status"
rs2.abc.com | FAILED | rc=3 >>
httpd 已停
rs1.abc.com | FAILED | rc=3 >>
httpd 已停
master.abc.com | FAILED | rc=3 >>
httpd 已停
[root@svn ~]# ansible all -m service -a "state=started name=httpd enabled=yes"
master.abc.com | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
rs1.abc.com | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
rs2.abc.com | success >> {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
四、YAML
4.1 YAML介绍
YAML是一个可读性高的用来表达资料序列的格式。YAML参考了其他多种语言，包括：XML、C语言、Python、Perl以及电子邮件格式RFC2822等。Clark Evans在2001年在首次发表了这种语言，另外Ingy dt Net与Oren Ben-Kiki也是这语言的共同设计者。
YAML Ain't Markup Language，即YAML不是XML。不过，在开发的这种语言时，YAML的意思其实是："Yet Another Markup Language"（仍是一种标记语言）。其特性：
YAML的可读性好
YAML和脚本语言的交互性好
YAML使用实现语言的数据类型
YAML有一个一致的信息模型
YAML易于实现
YAML可以基于流来处理
YAML表达能力强，扩展性好
更多的内容及规范参见http://www.yaml.org。
4.2 YAML语法
YAML的语法和其他高阶语言类似，并且可以简单表达清单、散列表、标量等数据结构。其结构（Structure）通过空格来展示，序列（Sequence）里的项用"-"来代表，Map里的键值对用":"分隔。下面是一个示例。
name: John Smith
age: 41
gender: Male
spouse:
name: Jane Smith
age: 37
gender: Female
children:
- name: Jimmy Smith
age: 17
gender: Male
- name: Jenny Smith
age 13
gender: Female
YAML文件扩展名通常为.yaml，如example.yaml。
五、ansible playbooks
playbook是由一个或多个“play”组成的列表。play的主要功能在于将事先归并为一组的主机装扮成事先通过ansible中的task定义好的角色。从根本上来讲，所谓task无非是调用ansible的一个module。将多个play组织在一个playbook中，即可以让它们联同起来按事先编排的机制同唱一台大戏。下面是一个简单示例。
- hosts: webnodes
vars:
http_port: 80
max_clients: 256
remote_user: root
tasks:
- name: ensure apache is at the latest version
yum: name=httpd state=latest
- name: ensure apache is running
service: name=httpd state=started
handlers:
- name: restart apache
service: name=httpd state=restarted
5.1 playbook基础组件
5.1.1 Hosts和Users
playbook中的每一个play的目的都是为了让某个或某些主机以某个指定的用户身份执行任务。hosts用于指定要执行指定任务的主机，其可以是一个或多个由冒号分隔主机组；remote_user则用于指定远程主机上的执行任务的用户。如上面示例中的
-hosts: webnodes
remote_user: root
不过，remote_user也可用于各task中。也可以通过指定其通过sudo的方式在远程主机上执行任务，其可用于play全局或某任务；此外，甚至可以在sudo时使用sudo_user指定sudo时切换的用户。
- hosts: webnodes
remote_user: mageedu
tasks:
- name: test connection
ping:
remote_user: mageedu
sudo: yes
5.1.2 任务列表和action
play的主体部分是task list。task list中的各任务按次序逐个在hosts中指定的所有主机上执行，即在所有主机上完成第一个任务后再开始第二个。在运行自下而下某playbook时，如果中途发生错误，所有已执行任务都将回滚，因此，在更正playbook后重新执行一次即可。
task的目的是使用指定的参数执行模块，而在模块参数中可以使用变量。模块执行是幂等的，这意味着多次执行是安全的，因为其结果均一致。
每个task都应该有其name，用于playbook的执行结果输出，建议其内容尽可能清晰地描述任务执行步骤。如果未提供name，则action的结果将用于输出。
定义task的可以使用“action: module options”或“module: options”的格式，推荐使用后者以实现向后兼容。如果action一行的内容过多，也中使用在行首使用几个空白字符进行换行。
tasks:
- name: make sure apache is running
service: name=httpd state=running
在众多模块中，只有command和shell模块仅需要给定一个列表而无需使用“key=value”格式，例如：
tasks:
- name: disable selinux
command: /sbin/setenforce 0
如果命令或脚本的退出码不为零，可以使用如下方式替代：
tasks:
- name: run this command and ignore the result
shell: /usr/bin/somecommand || /bin/true
或者使用ignore_errors来忽略错误信息：
tasks:
- name: run this command and ignore the result
shell: /usr/bin/somecommand
ignore_errors: True
5.1.3 handlers
用于当关注的资源发生变化时采取一定的操作。
“notify”这个action可用于在每个play的最后被触发，这样可以避免多次有改变发生时每次都执行指定的操作，取而代之，仅在所有的变化发生完成后一次性地执行指定操作。在notify中列出的操作称为handler，也即notify中调用handler中定义的操作。
- name: template configuration file
template: src=template.j2 dest=/etc/foo.conf
notify:
- restart memcached
- restart apache
handler是task列表，这些task与前述的task并没有本质上的不同。
handlers:
- name: restart memcached
service: name=memcached state=restarted
- name: restart apache
service: name=apache state=restarted
案例：
heartbeat.yaml
- hosts: hbhosts
remote_user: root
tasks:
- name: ensure heartbeat latest version
yum: name=heartbeat state=present
- name: authkeys configure file
copy: src=/root/hb_conf/authkeys dest=/etc/ha.d/authkeys
- name: authkeys mode 600
file: path=/etc/ha.d/authkeys mode=600
notify:
- restart heartbeat
- name: ha.cf configure file
copy: src=/root/hb_conf/ha.cf dest=/etc/ha.d/ha.cf
notify:
- restart heartbeat
handlers:
- name: restart heartbeat
service: name=heartbeat state=restarted
六、测试
6.1 建一个以.yaml结尾文件
[root@svn ~]# vim test.yaml
//注意语法 “- 空格 parameter"
- hosts: all
remote_user: root
tasks:
- name: add a group
group: gid=1000 name=testgroup system=no
- name: excute a commad
command: /bin/date
[root@svn ~]# ansible-playbook test.yaml
//把一个任务所有主机执行一遍，在执行第二个任务
PLAY [all] ********************************************************************
GATHERING FACTS ***************************************************************
ok: [master.abc.com]
ok: [rs2.abc.com]
ok: [rs1.abc.com]
TASK: [add a group] ***********************************************************
changed: [rs1.abc.com]
changed: [rs2.abc.com]
changed: [master.abc.com]
TASK: [excute a commad] *******************************************************
changed: [rs1.abc.com]
changed: [master.abc.com] //出现changed 表明添加成功，注意的是执行结果不会返馈回来
changed: [rs2.abc.com]
PLAY RECAP ********************************************************************
master.abc.com : ok=3 changed=2 unreachable=0 failed=0
rs1.abc.com : ok=3 changed=2 unreachable=0 failed=0
rs2.abc.com : ok=3 changed=2 unreachable=0 failed=0
6.2更改httpd.conf配置文件
[root@svn ~]# vim web.yaml
- hosts: all
remote_user: root
tasks:
- name: ensure apche latest version
yum: state=latest name=httpd
- name: apache configure file
copy: src=/root/httpd.conf dest=/etc/httpd/conf/httpd.conf force=yes
notify:
- restart httpd
handlers:
- name: restart httpd
service: name=httpd state=restarted
[root@svn ~]# ansible-playbook web.yaml
PLAY [all] ********************************************************************
GATHERING FACTS ***************************************************************
ok: [rs2.abc.com]
ok: [rs1.abc.com]
ok: [master.abc.com]
TASK: [ensure apche latest version] *******************************************
ok: [master.abc.com]
ok: [rs1.abc.com]
ok: [rs2.abc.com]
TASK: [apache configure file] *************************************************
ok: [rs2.abc.com]
ok: [rs1.abc.com]
changed: [master.abc.com]
NOTIFIED: [restart httpd] *****************************************************
changed: [master.abc.com]
PLAY RECAP ********************************************************************
master.abc.com : ok=4 changed=2 unreachable=0 failed=0
rs1.abc.com : ok=3 changed=0 unreachable=0 failed=0
rs2.abc.com : ok=3 changed=0 unreachable=0 failed=0
[root@svn ~]# ansible all -a "ss -tnl"
rs2.abc.com | success | rc=0 >>
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::111 :::*
LISTEN 0 128 *:111 *:*
LISTEN 0 128 :::8080 :::*
LISTEN 0 128 *:1011 *:*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:631 *:*
LISTEN 0 128 ::1:631 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 :::36551 :::*
LISTEN 0 128 *:49863 *:*
rs1.abc.com | success | rc=0 >>
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::111 :::*
LISTEN 0 128 *:111 *:*
LISTEN 0 128 :::8080 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:631 *:*
LISTEN 0 128 ::1:631 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 *:58527 *:*
LISTEN 0 128 :::54598 :::*
master.abc.com | success | rc=0 >>
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::111 :::*
LISTEN 0 128 *:111 *:*
LISTEN 0 128 :::8080 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 *:22 *:*
LISTEN 0 128 127.0.0.1:631 *:*
LISTEN 0 128 ::1:631 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 128 *:56483 *:*
LISTEN 0 128 :::52136 :::*
