$npx -y skills add chaterm/terminal-skills --skill ansibleAnsible 自动化运维
| 1 | # Ansible 自动化运维 |
| 2 | |
| 3 | ## 概述 |
| 4 | Playbook 编写、角色管理、动态 inventory 等技能。 |
| 5 | |
| 6 | ## 基础命令 |
| 7 | |
| 8 | ### Ad-hoc 命令 |
| 9 | ```bash |
| 10 | # 测试连通性 |
| 11 | ansible all -m ping |
| 12 | ansible webservers -m ping |
| 13 | |
| 14 | # 执行命令 |
| 15 | ansible all -m command -a "uptime" |
| 16 | ansible all -m shell -a "df -h | grep /dev" |
| 17 | |
| 18 | # 复制文件 |
| 19 | ansible all -m copy -a "src=/local/file dest=/remote/file" |
| 20 | |
| 21 | # 安装软件 |
| 22 | ansible all -m apt -a "name=nginx state=present" --become |
| 23 | ansible all -m yum -a "name=nginx state=present" --become |
| 24 | |
| 25 | # 管理服务 |
| 26 | ansible all -m service -a "name=nginx state=started" --become |
| 27 | |
| 28 | # 收集信息 |
| 29 | ansible all -m setup |
| 30 | ansible all -m setup -a "filter=ansible_distribution*" |
| 31 | ``` |
| 32 | |
| 33 | ### 常用参数 |
| 34 | ```bash |
| 35 | -i inventory # 指定 inventory |
| 36 | -m module # 指定模块 |
| 37 | -a arguments # 模块参数 |
| 38 | -b, --become # 提权 |
| 39 | -K # 询问 sudo 密码 |
| 40 | -u user # 指定用户 |
| 41 | -k # 询问 SSH 密码 |
| 42 | --limit host # 限制主机 |
| 43 | -v, -vv, -vvv # 详细输出 |
| 44 | --check # 检查模式(不执行) |
| 45 | --diff # 显示差异 |
| 46 | ``` |
| 47 | |
| 48 | ## Inventory |
| 49 | |
| 50 | ### 静态 inventory |
| 51 | ```ini |
| 52 | # inventory/hosts |
| 53 | [webservers] |
| 54 | web1.example.com |
| 55 | web2.example.com ansible_host=192.168.1.10 |
| 56 | |
| 57 | [dbservers] |
| 58 | db1.example.com ansible_user=admin |
| 59 | db2.example.com |
| 60 | |
| 61 | [production:children] |
| 62 | webservers |
| 63 | dbservers |
| 64 | |
| 65 | [all:vars] |
| 66 | ansible_python_interpreter=/usr/bin/python3 |
| 67 | ``` |
| 68 | |
| 69 | ### YAML 格式 |
| 70 | ```yaml |
| 71 | # inventory/hosts.yml |
| 72 | all: |
| 73 | children: |
| 74 | webservers: |
| 75 | hosts: |
| 76 | web1.example.com: |
| 77 | web2.example.com: |
| 78 | ansible_host: 192.168.1.10 |
| 79 | dbservers: |
| 80 | hosts: |
| 81 | db1.example.com: |
| 82 | ansible_user: admin |
| 83 | vars: |
| 84 | ansible_python_interpreter: /usr/bin/python3 |
| 85 | ``` |
| 86 | |
| 87 | ### 动态 inventory |
| 88 | ```bash |
| 89 | # 使用脚本 |
| 90 | ansible-inventory -i inventory.py --list |
| 91 | |
| 92 | # AWS EC2 |
| 93 | ansible-inventory -i aws_ec2.yml --list |
| 94 | |
| 95 | # 示例 aws_ec2.yml |
| 96 | plugin: amazon.aws.aws_ec2 |
| 97 | regions: |
| 98 | - us-east-1 |
| 99 | filters: |
| 100 | tag:Environment: production |
| 101 | keyed_groups: |
| 102 | - key: tags.Role |
| 103 | prefix: role |
| 104 | ``` |
| 105 | |
| 106 | ## Playbook |
| 107 | |
| 108 | ### 基础结构 |
| 109 | ```yaml |
| 110 | # playbook.yml |
| 111 | --- |
| 112 | - name: Configure web servers |
| 113 | hosts: webservers |
| 114 | become: yes |
| 115 | vars: |
| 116 | http_port: 80 |
| 117 | |
| 118 | tasks: |
| 119 | - name: Install nginx |
| 120 | apt: |
| 121 | name: nginx |
| 122 | state: present |
| 123 | update_cache: yes |
| 124 | |
| 125 | - name: Start nginx |
| 126 | service: |
| 127 | name: nginx |
| 128 | state: started |
| 129 | enabled: yes |
| 130 | |
| 131 | - name: Copy config |
| 132 | template: |
| 133 | src: nginx.conf.j2 |
| 134 | dest: /etc/nginx/nginx.conf |
| 135 | notify: Restart nginx |
| 136 | |
| 137 | handlers: |
| 138 | - name: Restart nginx |
| 139 | service: |
| 140 | name: nginx |
| 141 | state: restarted |
| 142 | ``` |
| 143 | |
| 144 | ### 执行 Playbook |
| 145 | ```bash |
| 146 | # 执行 |
| 147 | ansible-playbook playbook.yml |
| 148 | |
| 149 | # 指定 inventory |
| 150 | ansible-playbook -i inventory/hosts playbook.yml |
| 151 | |
| 152 | # 限制主机 |
| 153 | ansible-playbook playbook.yml --limit web1 |
| 154 | |
| 155 | # 检查模式 |
| 156 | ansible-playbook playbook.yml --check --diff |
| 157 | |
| 158 | # 指定标签 |
| 159 | ansible-playbook playbook.yml --tags "install,config" |
| 160 | ansible-playbook playbook.yml --skip-tags "test" |
| 161 | |
| 162 | # 传递变量 |
| 163 | ansible-playbook playbook.yml -e "version=1.0" |
| 164 | ansible-playbook playbook.yml -e "@vars.yml" |
| 165 | ``` |
| 166 | |
| 167 | ### 条件与循环 |
| 168 | ```yaml |
| 169 | tasks: |
| 170 | # 条件 |
| 171 | - name: Install on Debian |
| 172 | apt: |
| 173 | name: nginx |
| 174 | when: ansible_os_family == "Debian" |
| 175 | |
| 176 | - name: Install on RedHat |
| 177 | yum: |
| 178 | name: nginx |
| 179 | when: ansible_os_family == "RedHat" |
| 180 | |
| 181 | # 循环 |
| 182 | - name: Install packages |
| 183 | apt: |
| 184 | name: "{{ item }}" |
| 185 | state: present |
| 186 | loop: |
| 187 | - nginx |
| 188 | - git |
| 189 | - curl |
| 190 | |
| 191 | # 字典循环 |
| 192 | - name: Create users |
| 193 | user: |
| 194 | name: "{{ item.name }}" |
| 195 | groups: "{{ item.groups }}" |
| 196 | loop: |
| 197 | - { name: 'user1', groups: 'admin' } |
| 198 | - { name: 'user2', groups: 'developers' } |
| 199 | ``` |
| 200 | |
| 201 | ### 变量与模板 |
| 202 | ```yaml |
| 203 | # vars/main.yml |
| 204 | http_port: 80 |
| 205 | server_name: example.com |
| 206 | workers: 4 |
| 207 | |
| 208 | # templates/nginx.conf.j2 |
| 209 | server { |
| 210 | listen {{ http_port }}; |
| 211 | server_name {{ server_name }}; |
| 212 | |
| 213 | {% for upstream in upstreams %} |
| 214 | upstream {{ upstream.name }} { |
| 215 | {% for server in upstream.servers %} |
| 216 | server {{ server }}; |
| 217 | {% endfor %} |
| 218 | } |
| 219 | {% endfor %} |
| 220 | } |
| 221 | ``` |
| 222 | |
| 223 | ## Roles |
| 224 | |
| 225 | ### 角色结构 |
| 226 | ``` |
| 227 | roles/ |
| 228 | └── nginx/ |
| 229 | ├── tasks/ |
| 230 | │ └── main.yml |
| 231 | ├── handlers/ |
| 232 | │ └── main.yml |
| 233 | ├── templates/ |
| 234 | │ └── nginx.conf.j2 |
| 235 | ├── files/ |
| 236 | ├── vars/ |
| 237 | │ └── main.yml |
| 238 | ├── defaults/ |
| 239 | │ └── main.yml |
| 240 | └── meta/ |
| 241 | └── main.yml |
| 242 | ``` |
| 243 | |
| 244 | ### 创建角色 |
| 245 | ```bash |
| 246 | # 创建角色骨架 |
| 247 | ansible-galaxy init roles/nginx |
| 248 | ``` |
| 249 | |
| 250 | ### 使用角色 |
| 251 | ```yaml |
| 252 | # playbook.yml |
| 253 | --- |
| 254 | - hosts: webservers |
| 255 | become: yes |
| 256 | roles: |
| 257 | - nginx |
| 258 | - { role: app, tags: ['app'] } |
| 259 | - role: database |
| 260 | vars: |
| 261 | db_name: mydb |
| 262 | ``` |
| 263 | |
| 264 | ### Ansible Galaxy |
| 265 | ```bash |
| 266 | # 安装角色 |
| 267 | ansible-galaxy install geerlingguy.nginx |
| 268 | ansible-galaxy install -r requirements.yml |
| 269 | |
| 270 | # requirements.yml |
| 271 | roles: |
| 272 | - name: geerlingguy.nginx |
| 273 | version: 3.1.0 |
| 274 | - name: geerlingguy.mysql |
| 275 | |
| 276 | collections: |
| 277 | - name: community.general |
| 278 | ``` |
| 279 | |
| 280 | ## 常见场景 |
| 281 | |
| 282 | ### 场景 1:部署应用 |
| 283 | ```yaml |
| 284 | --- |
| 285 | - name: Deploy application |
| 286 | hosts: appservers |
| 287 | become: yes |
| 288 | vars: |
| 289 | app_version: "1.0.0" |
| 290 | |
| 291 | tasks: |
| 292 | - name: Pull code |