ansible是新出现的自动化运维工具，基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。
ansible是基于模块工作的，本身没有批量部署的能力。真正具有批量部署的是ansible所运行的模块，ansible只是提供一种框架。主要包括：
(1)、连接插件connection plugins：负责和被监控端实现通信；
(2)、host inventory：指定操作的主机，是一个配置文件里面定义监控的主机；
(3)、各种模块核心模块、command模块、自定义模块；
(4)、借助于插件完成记录日志邮件等功能；
(5)、playbook：剧本执行多个任务时，非必需可以让节点一次性运行多个任务。
实验环境
centos6.9_x64
server 192.168.1.12
slave 192.168.1.13
实验软件
ansible-2.6.8-1.el6.noarch
sshpass-1.06-1.el6.x86_64
python-crypto2.6-2.6.1-2.el6.x86_64
python-jinja2-26-2.6-3.el6.noarch
软件安装
rpm -ivh epel-release-6-8.noarch.rpm
sed -i 's/^mirrorlist=https/mirrorlist=http/' /etc/yum.repos.d/epel.repo
yum install -y ansible expect openssl openssl-devel master/slave端操作
cp -pv /etc/ssh/sshd_config /etc/ssh/sshd_config.bak 开启ssh持久化
echo ClientAliveInterval 600 >> /etc/ssh/sshd_config
echo ClientAliveCountMax 10 >> /etc/ssh/sshd_config
tail -n 2 /etc/ssh/sshd_config
ClientAliveInterval 600
ClientAliveCountMax 10
service sshd restart
scp /etc/ssh/sshd_config root@192.168.1.13:/etc/ssh/
cp -pv /etc/ansible/hosts /etc/ansible/hosts.bak
touch /var/log/ansible.log
cp -pv /etc/ansible/ansible.cfg /etc/ansible/ansible.cfg.bak
sed -i 's/#log_path/log_path/g' /etc/ansible/ansible.cfg
sed -i 's/#inventory/inventory/g' /etc/ansible/ansible.cfg
sed -i 's/#remote_user/remote_user/g' /etc/ansible/ansible.cfg
sed -i 's/#host_key_checking /host_key_checking/g' /etc/ansible/ansible.cfg
mkpasswd -l 10 -C 5 生成密码
Bx6{iVGDK4
openssl passwd 123456 生成密文密码
3bhMTzgNCvRks
cat /etc/ansible/hosts
[server] 模块可自定义
192.168.0.180 ansible_ssh_user=root ansible_ssh_port=22 ansible_ssh_pass=3bhMTzgNCvRks 指定用户名 IP 端口号 密码
192.168.0.181 ansible_ssh_user=root ansible_ssh_port=22 ansible_ssh_pass=3bhMTzgNCvRks
192.168.0.182 ansible_ssh_user=root ansible_ssh_port=22 ansible_ssh_pass=3bhMTzgNCvRks
ansible --version
ansible 2.6.20
ansible all -m ping
192.168.1.12 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.1.13 | SUCCESS => {
"changed": false,
"ping": "pong"
}
ansible all -a 'uptime' ls cp等均可实现
192.168.1.12 | SUCCESS | rc=0 >>
09:43:36 up 29 min, 3 users, load average: 0.00, 0.02, 0.00
192.168.1.13 | SUCCESS | rc=0 >>
09:43:36 up 29 min, 3 users, load average: 0.00, 0.02, 0.00
cat /etc/ansible/hosts 密码加密
[servers]
192.168.1.12 ansible_ssh_user=root ansible_ssh_port=22 ansible_ssh_pass=1
192.168.1.13 ansible_ssh_user=root ansible_ssh_port=22 ansible_ssh_pass=1 可以看见密码尚未加密
ansible-vault encrypt /etc/ansible/hosts 加密密码123456 需要两次输入确定
cat /etc/ansible/hosts
$ANSIBLE_VAULT;1.1;AES256
64386266306265646465366334626236343734636330663735656261386534343761333039633134
6635313862343930383161353864666636363435626539370a653238663037643538306331366361 无法看见明文密码加密成功
ansible -i /etc/ansible/hosts server -m ping --ask-vault-pass server为分组
Vault password:
192.168.1.12 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.1.13 | SUCCESS => {
"changed": false,
"ping": "pong"
}
ansible-doc -l 查看功能模块
ansible-doc -l | grep copy 查看具体功能模块
-m 添加模块执行
-a '命令'
ansible all 所有主机
ansible server 自定义分组批量执行命令
ansible server -m copy -a "src=/home/test.sh dest=/tmp/ owner=root group=root mode=0755" 批量复制脚本
ansible server -m shell -a "/bin/sh /tmp/test.sh" 执行脚本
ansible java -m shell -a "/bin/sh /tmp/test.sh" --sudo sudo提权执行脚本
ansible server -m file -a "dest=/home/test.txt state=touch" 创建文件
ansible server -m copy -a "src=/root/tests/ dest=/root/tests force=no" 复制文件
ansible server -m file -a "dest=/home/test.txt state=absent" 删除文件
ansible server -m file -a "dest=/home/tests mode=755 owner=root group=root state=directory" 建立目录
ansible server -m unarchive -a "src=/root/test1.tar.gz dest=/root/tests mode=0755 force=yes copy=yes" 远程解压覆盖文件
ansible server -m file -a "dest=/home/tests state=absent" 删除目录
ansible server -m yum -a "name=httpd" 安装服务
ansible server -m yum -a "name=vsftpd"
ansible server -m service -a "name=httpd state=started/restarted/stopped enabled=yes" 远程启动服务
ansible server -m service -a "name=vsftpd state=started enabled=yes"
openssl passwd -1 -salt 123.com 123.com 为用户密码，opnenssl生成密文密码
ansible server -m user -a 'name=test comment="add a test user" password="$1$123.com$6Oaka602q3MP5w4ZaugbB0"' 建立用户设置密码
ansible server -m group -a "name=g1 gid=666 state=present system=yes" 新建组 g1位组名
ansible server -m group -a "name=g1 state=absent" 删除组
ansible server -m command -a "id test01" 查看用户
ansible server -m user -a "name=test01 state=absent remove=yes" 删除用户
ansible server -a "uptime" 执行命令
ansible server -m raw -a "ifconfig eth0" 查看主机IP地址
ansible server -m raw -a "tail /etc/group | grep g1" 查看组
ansible java -m setup -a "filter=ansible_eth[0-1]" 查看ip地址
ansible all -m ping 查看主机存活情况
ansible server -m setup 系统信息收集
ansible server --list 查看分组主机
ansible test -u root -m setup 查看系统信息
ansible server -a "rpm -qa vsftpd" 查看安装rpm包
ansible server -a "lsof -i:21" 查看服务状态
ansible server -a "netstat -tuplna | grep vsftpd"
ansible all -a "/sbin/reboot" -f 10 --sudo -K 重启 --sudo 为普通用户sudo权限
ps -aux | grep ansible
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ
root 2372 0.0 0.0 103332 884 pts/0 S+ 09:37 0:00 grep ansible
来源：oschina
链接：https://my.oschina.net/u/4393165/blog/4342881