标签：miss 状态 配置 sftp 支持 varname 管理 stat 退出
三、Ansible的使用
1、Ansible命令执行过程及状态
过程：
状态:
2、Ansible系列命令
ansible ansible-doc ansible-playbook ansible-vault ansible-console ansible-galaxy ansible-pull
ansible-doc [options] [module...]
-a 显示所有模块的文档
-l --list 列出可用模块
-s --snippet 显示制定模块的playbook片段
示例：
ansible-doc -l 列出所有模块
ansible-doc ping 查看制定模块帮助用法
ansible-doc -s ping 查看制定模块帮助用法
ansible
--version 显示版本
-m module 制定模块默认为 command
-v 详细过程 -vv -vvv更详细
--list-hosts 显示主机列表 可以简写为--list
-k --ask-pass 提示数据ssh连接密码 默认key验证
-K --ask-become-pass 提示输入sodu的口令
-C check 检查并不执行
-T --timeout=TIMEOUT 执行命令的超时时间 默认10s
-u --user=REMOTE_USER 执行远程执行的用户
-b --become 代替旧版的sudo切换
试验：使用white用户连接web组下的服务器查看root家目录下的内容：
[root@ansible ~]# ansible web -u white -k -m command -a ‘ls /root‘
SSH password:
172.16.111.7 | FAILED | rc=2 >>
ls: cannot open directory /root: Permission deniednon-zero return code
172.16.111.8 | FAILED | rc=2 >>
ls: cannot open directory /root: Permission deniednon-zero return code显示没有权限
[root@ansible ~]# ansible web -m command -a ‘ls /root‘ -u white -k -b -K
SSH password:
SUDO password[defaults to SSH password]:
172.16.111.8 | FAILED! => {
"changed": false,
"module_stderr": "Shared connection to 172.16.111.8 closed.\r\n",
"module_stdout": "\r\nWe trust you have received the usual lecture from the local System\r\nAdministrator. It usually boils down to these three things:\r\n\r\n #1) Respect the privacy of others.\r\n #2) Think before you type.\r\n #3) With great power comes great responsibility.\r\n\r\n\r\nSorry, user white is not allowed to execute ‘/bin/sh -c echo BECOME-SUCCESS-mpdogqixumfmgqlscdyojejjgicjppfi; /usr/bin/python /home/white/.ansible/tmp/ansible-tmp-1540363523.36-270983856118240/command.py; rm -rf \"/home/white/.ansible/tmp/ansible-tmp-1540363523.36-270983856118240/\" > /dev/null 2>&1‘ as root on node2.\r\n",
"msg": "MODULE FAILURE",
"rc": 1
}
172.16.111.7 | SUCCESS | rc=0 >>
a
anaconda-ks.cfg
CentOS-Base.repo
checkout
elasticsearch-6.0.0.rpm
nginx-1.12.2
nginx-1.12.2.tar.gz
update此时发现 node1可以 2 不可以 查询由于white用户在node2没有sudo授权 ，visudo修改 visudo -c检测
[root@ansible ~]# ansible web -m command -a ‘ls /root‘ -u white -k -b -K
SSH password:
SUDO password[defaults to SSH password]:
172.16.111.7 | SUCCESS | rc=0 >>
a
anaconda-ks.cfg
CentOS-Base.repo
checkout
elasticsearch-6.0.0.rpm
nginx-1.12.2
nginx-1.12.2.tar.gz
update
172.16.111.8 | SUCCESS | rc=0 >>
315586643?lang=zh-CN
anaconda-ks.cfg
elasticsearch-2.3.5.rpm
elasticsearch-6.0.0.rpm
kibana-4.5.4-1.x86_64.rpm
logstash-2.3.4-1.noarch.rpm
nginx-1.12.2
nginx-1.12.2.tar.gz
rh-nginx112-nginx-1.12.1-2.el7.x86_64.rpm以上均是用口令验证 并且需要使用root权限，存在安全隐患，生产上推荐基于KEY的验证
3、基于key验证配置
在ansible主控端生成公钥，发送到所有被控端
[root@ansible ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:dOv+zF1JdDLy9dpJzfGf1cYl1zGuPC9m2w/0nsLFGPc root@ansible
The key‘s randomart image is:
+---[RSA 2048]----+
| o |
| . +|
| . . . ++*|
| . . ..+oXO|
| S . +Bo@|
| . o=BE|
| . .++==|
| . oo+++.|
| ..+.oo+|
+----[SHA256]-----+
You have new mail in /var/spool/mail/root
[root@ansible ~]# ssh-copy-id 172.16.111.7
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.16.111.7‘s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh ‘172.16.111.7‘"
and check to make sure that only the key(s) you wanted were added.
[root@ansible ~]# ssh-copy-id 172.16.111.8
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.16.111.8‘s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh ‘172.16.111.8‘"
and check to make sure that only the key(s) you wanted were added.
[root@ansible ~]# ssh-copy-id 172.16.111.9
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@172.16.111.9‘s password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh ‘172.16.111.9‘"
and check to make sure that only the key(s) you wanted were added.验证
[root@ansible ~]# ansible all -m ping
172.16.111.9 | SUCCESS => {
"changed": false,
"ping": "pong"
}
172.16.111.7 | SUCCESS => {
"changed": false,
"ping": "pong"
}
172.16.111.8 | SUCCESS => {
"changed": false,
"ping": "pong"
}4、 Ansible的工作模式
5、Ansible的Host-pattern
匹配主机的列表
综合逻辑
ansible ‘web:&app:!db‘ -m ping
正则表达式
ansible "web:&app:!db" -m ping #注意区别综合逻辑
ansible "~(web|db).*.white.com" -m ping
6、Ansible常用模块
command：在诚主机执行命令，默认模块 可以忽略 -m 选项
ansible web -m command -a ‘ls /data‘
此命令不支持@VARNAME < > | ; &等，需要用shell模块实现
[root@ansible ~]# ansible-doc command
- chdir #切换目录
- creates #如果如果文件创建，则不执行命令
= free_form #
- removes #如果文件不存在 则不执行命令
ansible web -m command -a ‘removes =/data ls /data‘shell ：和command类似 用shell执行命令
ansible web -m shell -a ‘echo white|passwd -stdin wange‘
调用bash执行命令 类似 cat /tmp/stanley.md|aws -F ‘|‘ ‘{print$1,$2}‘ &> /tmp/asd.txt 这些复杂命令 ，即使使用shell也可能会失败，解决办法：写到脚本时，copy到远程 执行 再把需要的结果拉回执行命令的机器
File：设置文件属性 state比较重要，可以根据state不同值实现不同效果
ansible ewb -m file -a "path=/root/a.sh owner=white mode=755"
ansible web -m file -a ‘src=/app/testfile dest=/app/testfile-link state=link‘
#创建文件
[root@ansible ~]# ansible all -m file -a ‘path=/tmp/ads state=touch‘
[root@ansible ~]# ansible all -m shell -a ‘ls -l /tmp|grep ads‘
172.16.111.9 | SUCCESS | rc=0 >>
-rw-r--r--. 1 root root 0 Oct 25 00:48 ads
172.16.111.7 | SUCCESS | rc=0 >>
-rw-r--r--. 1 root root 0 Oct 24 16:48 ads
172.16.111.8 | SUCCESS | rc=0 >>
-rw-r--r--. 1 root root 0 Oct 24 16:48 ads
#删除文件
[root@ansible ~]# ansible all -m file -a ‘path=/tmp/ads state=absent‘
[root@ansible ~]# ansible all -m shell -a ‘ls -l /tmp|grep ads‘
172.16.111.9 | FAILED | rc=1 >>
non-zero return code
172.16.111.7 | FAILED | rc=1 >>
non-zero return code
172.16.111.8 | FAILED | rc=1 >>
non-zero return code如果要创建文件夹 state=directory 删除也是用absent
#创建软链接
[root@ansible ~]# ansible all -m file -a ‘src=/etc/fstab dest=/data/fstab.link state=link‘
[root@ansible ~]# ansible all -m shell -a ‘ls -l /data‘
172.16.111.9 | SUCCESS | rc=0 >>
total 0
lrwxrwxrwx. 1 root root 10 Oct 25 00:58 fstab.link -> /etc/fstab
172.16.111.7 | SUCCESS | rc=0 >>
total 0
lrwxrwxrwx. 1 root root 10 Oct 24 16:58 fstab.link -> /etc/fstab
drwxr-xr-x. 3 root root 21 Oct 22 17:10 svndata
172.16.111.8 | SUCCESS | rc=0 >>
total 0
lrwxrwxrwx. 1 root root 10 Oct 24 16:58 fstab.link -> /etc/fstab
drwxr-xr-x. 3 root root 21 Oct 22 16:33 svndata
#删除软链接
[root@ansible ~]# ansible all -m file -a ‘dest=/data/fstab.link state=absent‘Group：组的管理
用法与user类似
创建组
ansible all -m group -a ‘name=nginx system=yes gid=80‘
删除组
ansible all -m group -a ‘name=nginx state=absent‘
标签：miss 状态 配置 sftp 支持 varname 管理 stat 退出
原文地址：https://www.cnblogs.com/wlbl/p/9844974.html
