Ansible 运维工具

[k8s_masters]
master0.c0.k8s.sb
  
[k8s_nodes]
node0.c0.k8s.sb
node1.c0.k8s.sb

[k8s:children]
k8s_masters
k8s_nodes

[k8s_masters:vars]
ansible_ssh_user=sbadmin
ansible_ssh_pass="***"
#ansible_ssh_private_key_file=/home/sbadmin/.ssh/id_rsa

[k8s_nodes:vars]
ansible_ssh_user=sbadmin
ansible_ssh_pass="***"
#ansible_ssh_private_key_file=/home/sbadmin/.ssh/id_rsa

/etc/ansible/ansible.cfg

[defaults]
host_key_checking = False

命令

# 运行时指定私钥
ansible all -m ping --key-file /home/user/.ssh/id_rsa

# 某一组机器执行ping
ansible k8s_nodes -m ping

# 不带参数默认走shell命令
ansible k8s -a "df -h" 
= 
ansible k8s -m shell -a "df -h"

# 查看所有主机
ansible all --list-hosts

# 查看所有分组及主机
ansible-inventory --list

# 查看所某分组主机
ansible php --list-hosts

剧本实战:

- 单个公钥分发

- hosts: k8s

  tasks:
  - name: Set authorized key took from file
    authorized_key:
      exclusive: True                                                 #清除远程主机之前所有的其他公钥
      key: "{{ lookup('file', '/home/sbadmin/.ssh/id_rsa.pub') }}"    #本机的公钥地址
      user: sbadmin                                                   #被控制的远程服务上的用户名
      state: present                                                  #模式为添加公钥

执行

ansible-playbook distribute_pub_keys.yaml

- 多个用户建立与公钥分发

deploy_php_users.yaml

- hosts: php
 
  vars:
    users:
      - root
      - ben
      - abc
 
  tasks:
    - name: "Create user accounts"
      user:
        name: "{{ item }}"
        groups: "website"
      with_items: "{{ users }}" 
    - name: "Add authorized keys"
      authorized_key:
        user: "{{ item }}"
        key: "{{ lookup('file', '/root/ansible_tasks/auths/'+ item + '/id_rsa.pub') }}"
      with_items: "{{ users }}"
    - name: "Allow website users to sudo without a password"
      lineinfile:
        dest: "/etc/sudoers" # path: in version 2.3
        state: "present"
        regexp: "^%website"
        line: "%website ALL=(ALL) NOPASSWD: ALL"

执行:

ansible-playbook deploy_php_users.yaml

- 删除/回收用户

revoke_users.yaml

- hosts: php
 
  vars:
    users:
      - user1
      - user2
 
  tasks:
    - name: Delete users
      user:
        name: "{{ item }}"
        state: absent
        remove: yes  # 同时删除用户的主目录和邮件文件等
      loop: "{{ users }}"

执行:

ansible-playbook revoke_users.yaml

- 安装npm

install_npm.yaml

---
- name: Batch install software on multiple servers
  hosts: python_npm
  become: yes
  tasks:
    - name: Install npm using yum
      yum:
        name: npm
        state: present

错误处理

Failed to connect to the host via ssh: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nIT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\r\nSomeone could be eavesdropping on you right now (man-in-the-middle attack)!\r\nIt is also possible that a host key has just been changed.

处理: 清理 ~/.ssh/known_hosts文件中对应的ip主机