环境释放
　　mac　　10.12.5

1

more /System/Library/CoreServices/SystemVersion.plist

安装命令

1
2
3

ruby -e "$(curl --insecure -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

brew update

brew install Ansible

安装后hosts默认访问位置

/usr/local/etc/ansible/hosts

公私钥配置
创建公私钥

1
ssh-keygen -t rsa -C ‘yat_ho@163.com‘
-t 指定密钥类型，默认即 rsa ，可以省略
-C 设置注释文字，比如你的邮箱

默认存放位置

1
/Users/jenkins/.ssh/id_rsa
将公钥复制到ssh服务器

1
ssh-copy-id jenkins@192.168.1.236
hosts配置
定义主机与组
定义一个IP为192.168.1.21, SSH端口为2135的主机

1
192.168.1.21:2135
定义一个别名为jumper, SSH端口为22, IP为192.168.1.50的主机

1
jumper ansible_ssh_port=22 ansible_ssh_host=192.168.1.50
组成员主机名称范例:

1
2
[test]
jenkis236 ansible_ssh_port=22 ansible_ssh_host=192.168.1.236
假如你有很多主机遵循某一种模式，你还可以这样来表示他们：

1
2
3
4
5
6
[webservers]
web[1:50].lightcloud.com

[database]
db-[a:f].lightcloud.com
定义主机变量

主机可以指定变量, 后面可以供Playbooks调用

1
2
[test]
jenkis236 ansible_ssh_port=22 ansible_ssh_host=192.168.1.236 http_port=8080　
定义组变量

1
2
3
4
5
6
[atlanta]
host1
host2
[atlanta:vars]
ntp_server=ntp.atlanta.example.com
proxy=proxy.atlanta.example.com
Ansible内置连接主机的变量

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
ansible_ssh_host
ansible通过ssh连接的IP或者FQDN
ansible_ssh_port
SSH连接端口
ansible_ssh_user
默认SSH连接用户
ansible_ssh_pass
SSH连接的密码（这是不安全的，ansible极力推荐使用--ask-pass选项或使用SSH keys）
ansible_sudo_pass
sudo用户的密码
ansible_connection
SSH连接的类型：local,ssh,paramiko，在ansible 1.2之前默认是paramiko，后来智能选择，优先使用基于ControlPersist的ssh（支持的前提）
ansible_ssh_private_key_file
SSH连接的公钥文件
ansible_shell_type
指定主机所使用的shell解释器，默认是sh，你可以设置成csh, fish等shell解释器
ansible_python_interpreter
用来指定python解释器的路径
ansible_*_interpreter
用来指定主机上其他语法解释器的路径，例如ruby，perl等
　Ansible常用模块及API
command: 执行远程主机SHELL命令

1
ansible all -i /Users/jenkins/jenkins/lirbary/ansible_hosts/hosts_test -m command -a "ifconfig"
script: 远程执行MASTER本地SHELL脚本.(类似scp+shell)

1
ansible test -i /Users/jenkins/jenkins/lirbary/ansible_hosts/hosts_test -m script -a "../Env_update_shell/test.sh"
copy：实现主控端向目标主机拷贝文件, 类似scp功能.

1
ansible test -i /Users/jenkins/jenkins/lirbary/ansible_hosts/hosts -m copy -a "src=~/test.sh dest=/tmp/ owner=root group=root mode=0755"
stat：获取远程文件状态信息, 包括atime, ctime, mtime, md5, uid, gid等信息.

1
ansible test -i /Users/jenkins/jenkins/lirbary/ansible_hosts/hosts_test -m stat -a "path=/Users/jenkins/jenkins/"
get_url:实现在远程主机下载指定URL到本地.

1
ansible test -i /Users/jenkins/jenkins/lirbary/ansible_hosts/hosts_test -m get_url -a "url=http://www.cnblogs.com/yatho dest=/tmp/index.html mode=0400 force=yes"
yum:Linux包管理平台操作, 常见都会有yum和apt, 此处会调用yum管理模式

1
ansible servers -m yum -a "name=curl state=latest"
cron:远程主机crontab配置

1
ansible webservers -m cron -a "name=‘check dir‘ hour=‘5,2‘ job=‘ls -alh > /dev/null‘"
service:远程主机系统服务管理

1
2
3

ansible webservers -m service -a "name=crond state=stopped"

ansible webservers -m service -a "name=crond state=restarted"

ansible webservers -m service -a "name=crond state=reloaded"

user:user

1
2
3
4
添加用户:

ansible webservers -m user -a "name=johnd comment=‘John Doe‘"

删除用户:

ansible webservers -m user -a "name=johnd state=absent remove=yes"

　playbook

playbook介绍

playbook是一个不同于使用Ansible命令行执行方式的模式, 其功能是将大量命令行配置集成到一起形成一个可定制的多主机配置管理部署工具.

它通过YAML格式定义, 可以实现向多台主机的分发应用部署.

以下给大家详细介绍一个针对nginx嵌套复用结构的playbook部署实例:

1. 构建目录结构

1
2
3
4
5

cd /etc/ansible/

mkdir group_vars

mkdir roles

2.定义host

1
2
3
4
5
6
7
8
9

vi /etc/ansible/hosts

[webservers]
client01.example.com
client02.example.com
[nginx01]
client01.example.com
[nginx02]
client02.example.com
3.定义变量

1
2
3
4
5
6
7

vi /etc/ansible/group_vars/nginx01

worker_processes: 4
num_cpus: 4
max_open_file: 65506
root: /data
remote_user: root
1
2
3
4
5
6
7

vi /etc/ansible/group_vars/nginx02

worker_processes: 2
num_cpus: 2
max_open_file: 35506
root: /www
remote_user: root
Tips:这里在group_vars下定义的文件名必须对应hosts文件下的group标签, 通过这里定义的不同参数从而部署不同类型的主机配置.

4.创建roles入口文件

1
2
3
4
5
6
7
8
9
10
11

vi /etc/ansible/site.yml

• hosts: webservers
  roles:
  • base_env
• hosts: nginx01
  roles:
  • nginx01
• hosts: nginx02
  roles:
  • nginx02
    　　

Tips: 这里的roles:下的字符串需对应roles目录下的目录名.

5.定义全局role base_env

创建目录结构

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

mkdir -p /etc/ansible/roles/base_env/tasks

vi /etc/ansible/roles/base_env/tasks/main.yml

将EPEL的yum源配置文件传送到客户端

• name: Create the contains common plays that will run on all nodes
  copy: src=epel.repo dest=/etc/yum.repos.d/epel.repo
• name: Create the GPG key for EPEL
  copy: src=RPM-GPG-KEY-EPEL-6 dest=/etc/pki/rpm-gpg

关闭SELINUX

• name: test to see if selling is running
  command: getenforce
  register: sestatus
  changed_when: false

删除iptables默认规则并保存

• name: remove the default iptables rules
  command: iptables -F
• name: save iptables rules
  command: service iptables save
  将对应需要拷贝到远程的文件复制到base_env/files目录下

1
2
3
4
5

mkdir -p /etc/ansible/roles/base_env/files

cp /etc/yum.repos.d/epel.repo /etc/ansible/roles/base_env/files

cp /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6 /etc/ansible/roles/base_env/files

1. 定义nginx01和ngnix02 role

创建目录结构

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

mkdir -p /etc/ansible/roles/nginx{01,02}

mkdir -p /etc/ansible/roles/nginx01/tasks

mkdir -p /etc/ansible/roles/nginx02/tasks

vi /etc/ansible/roles/nginx01/tasks/main.yml

安装nginx最新版本

• name: ensure nginx is at the latest version
  yum: pkg=nginx state=latest

将nginx配置文件传送到远程目录

• name: write the nginx config file
  template: src=nginx.conf dest=/etc/nginx/nginx.conf
  notify: restart nginx # 重启nginx

创建nginx根目录

• name: Create Web Root
  file: dest={{ root }} mode=775 state=directory owner=nginx group=nginx
  notify: reload nginx
• name: ensure nginx is running
  service: name=nginx state=restarted

cp /home/ansible/roles/nginx01/tasks/main.yml /home/ansible/roles/nginx02/tasks/main.yml

7.定义files

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

mkdir -p /etc/ansible/roles/nginx01/templates

mkdir -p /etc/ansible/roles/nginx02/templates

vi /etc/ansible/roles/nginx01/templates/nginx.conf

For more information on configuration, see:

user nginx;
worker_processes {{ worker_processes }};
{% if num_cpus == 2 %}
worker_cpu_affinity 01 10;
{% elif num_cpus == 4 %}
worker_cpu_affinity 1000 0100 0010 0001;
{% elif num_cpus >= 8 %}
worker_cpu_affinity 00000001 00000010 00000100 00001000 00010000 00100000 01000000 10000000;
{% else %}
worker_cpu_affinity 1000 0100 0010 0001;
{% endif %}
worker_rlimit_nofile {{ max_open_file }};

error_log /var/log/nginx/error.log;

error_log /var/log/nginx/error.log notice;

error_log /var/log/nginx/error.log info;

pid /var/run/nginx.pid;

events {
worker_connections {{ max_open_file }};
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

log_format  main  '$remote_addr - $remote_user [$time_local] "$request" ' 
                  '$status $body_bytes_sent "$http_referer" ' 
                  '"$http_user_agent" "$http_x_forwarded_for"'; 

access_log  /var/log/nginx/access.log  main; 

sendfile        on; 
#tcp_nopush     on; 

#keepalive_timeout  0; 
keepalive_timeout  65; 

#gzip  on; 
   
# Load config files from the /etc/nginx/conf.d directory 
# The default server is in conf.d/default.conf 
#include /etc/nginx/conf.d/*.conf; 
server { 
    listen       80 default_server; 
    server_name  _; 

    #charset koi8-r; 

    #access_log  logs/host.access.log  main; 

    location / { 
        root   {{ root }}; 
        index  index.html index.htm; 
    } 

    error_page  404              /404.html; 
    location = /404.html { 
        root   /usr/share/nginx/html; 
    } 

    # redirect server error pages to the static page /50x.html 
    # 
    error_page   500 502 503 504  /50x.html; 
    location = /50x.html { 
        root   /usr/share/nginx/html; 
    } 

} 

}
　　

Tip: worker_processes, num_cpus, max_open_file, root等参数会调用group_vars目录下配置文件中相应的变量值

1

cp /etc/ansible/roles/nginx01/templates/nginx.conf /etc/ansible/roles/nginx02/templates/nginx.conf

8.执行playbook

1

ansible-playbook -i /etc/ansible/hosts /etc/ansible/site.yml -f 10

Tips: -f 为启动10个并行进程执行playbook, -i 定义inventory host文件, site.yml 为入口文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
PLAY [webservers] *************************************************************

GATHERING FACTS ***************************************************************
ok: [client02.example.com]
ok: [client01.example.com]

TASK: [base_env | Create the contains common plays that will run on all nodes] ***
ok: [client01.example.com]
ok: [client02.example.com]

TASK: [base_env | Create the GPG key for EPEL] ********************************
ok: [client02.example.com]
ok: [client01.example.com]

TASK: [base_env | test to see if selling is running] **************************
ok: [client01.example.com]
ok: [client02.example.com]

TASK: [base_env | remove the default iptables rules] **************************
changed: [client02.example.com]
changed: [client01.example.com]

TASK: [base_env | save iptables rules] ****************************************
changed: [client01.example.com]
changed: [client02.example.com]

PLAY [nginx01] ****************************************************************

GATHERING FACTS ***************************************************************
ok: [client01.example.com]

TASK: [nginx01 | ensure nginx is at the latest version] ***********************
ok: [client01.example.com]

TASK: [nginx01 | write the nginx config file] *********************************
ok: [client01.example.com]

TASK: [nginx01 | Create Web Root] *********************************************
ok: [client01.example.com]

TASK: [nginx01 | ensure nginx is running] *************************************
changed: [client01.example.com]

PLAY [nginx02] ****************************************************************

GATHERING FACTS ***************************************************************
ok: [client02.example.com]

TASK: [nginx02 | ensure nginx is at the latest version] ***********************
ok: [client02.example.com]

TASK: [nginx02 | write the nginx config file] *********************************
ok: [client02.example.com]

TASK: [nginx02 | Create Web Root] *********************************************
ok: [client02.example.com]

TASK: [nginx02 | ensure nginx is running] *************************************
changed: [client02.example.com]

PLAY RECAP ********************************************************************
client01.example.com : ok=11 changed=3 unreachable=0 failed=0
client02.example.com : ok=11 changed=3 unreachable=0 failed=0
最终部署目录结构如下

tree /etc/ansible/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
/etc/ansible/
├── ansible.cfg
├── group_vars
│ ├── nginx01
│ └── nginx02
├── hosts
├── hosts.bak
├── roles
│ ├── base_env
│ │ ├── files
│ │ │ ├── epel.repo
│ │ │ └── RPM-GPG-KEY-EPEL-6
│ │ └── tasks
│ │ └── main.yml
│ ├── nginx01
│ │ ├── tasks
│ │ │ └── main.yml
│ │ └── templates
│ │ └── nginx.conf
│ └── nginx02
│ ├── tasks
│ │ └── main.yml
│ └── templates
│ └── nginx.conf
└── site.yml
jenkins关联配置
Choice Parameter
　　deploy_environment　　定义部署环境名　dev,test,uat,pdt
Execute shell
　　开头和结尾的set +x, set -x用来打开和关闭该部分的扩展参数及命令
　　cd $WORKSPACE/leon-playbook-phpcms1.1
　　ansible --version
　　ansible-playbook -i inventory/$deploy_environment ./deploy.yml -e project=phpcms -e branch=$branch_selector -e env=$deploy_environment
　　-i 用来自定义ansible host文件路径, ./deploy.yml为ansible-playbook入口文件, -e 后可跟给当前session添加的环境变量.

linux 系统管理（5） ansible 批管理

原文：https://www.cnblogs.com/linengier/p/11038030.html