ansible安装

（1）环境准备
在两台机器上关闭防火墙和SELinux，并修改/etc/hosts文件。
[root@ansible-test1 ~]# systemctl stop firewalld
[root@ansible-test1 ~]# systemctl disable firewalld
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.
[root@ansible-test1 ~]# setenforce 0
[root@ansible-test1 ~]# cat /etc/selinux/config
…
disabled - No SELinux policy is loaded.
SELINUX=disabled //将此处改为disabled
SELINUXTYPE= can take one of three two values:
…
[root@ansible-test1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.2.10 ansible-test1 //添加两台主机的ip和主机名
192.168.2.20 ansible-test2
（2）安装ansible
准备两台机器anisble-01和anisble-02，只需要在anisble-01上安装ansible，先安装epel仓库。
[root@ansible-test1 ~]# yum install epel-release -y
[root@ansible-test1 ~]# yum install -y ansible
[root@ansible-test1 ~]# ansible --version
ansible 2.9.10
config file = /etc/ansible/ansible.cfg
configured module search path = [u’/root/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’]
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Nov 20 2015, 02:00:19) [GCC 4.8.5 20150623 (Red Hat 4.8.5-4)]
（3）免密配置
anisble-01上生成密钥对 ssh-keygen -t rsa ，把公钥放到anisble-02上，设置密钥认证。
注：需要将本机也配置免密。
[root@ansible-test1 ~]# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory ‘/root/.ssh’.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
0a:47:86:44:83:a2:7c:c3:0c:1b:33:1c:03:88:0c:09 root@ansible-test1
The key’s randomart image is:
±-[ RSA 2048]----+
|E+.o+ |
|=Bo. o |
|o.O . o |
|.o = o |
| . o . S |
| o . |
| . |
| |
| |
±----------------+
[root@ansible-test1 ~]# ssh-copy-id 192.168.2.20
The authenticity of host ‘192.168.2.20 (192.168.2.20)’ can’t be established.
ECDSA key fingerprint is dc:a5:08:4d:9a:40:8a:be:ee:68:dd:41:61:7d:d7:05.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed – if you are prompted now it is to install the new keys
root@192.168.2.20’s password:

Number of key(s) added: 1

Now try logging into the machine, with: “ssh ‘192.168.2.20’”
and check to make sure that only the key(s) you wanted were added.

[root@ansible-test1 ~]# ssh 192.168.2.20
Last login: Sat Jul 4 16:49:18 2020 from 192.168.2.3
[root@ansible-test2 ~]# 登出
Connection to 192.168.2.20 closed.
（4）主机组设置
在/etc/ansible/hosts文件中添加本机和另一台机器的ip
[root@ansible-test1 ~]# grep ^[#] /etc/ansible/hosts
[testhost]
127.0.0.1
192.168.2.20
说明： testhost为自定义的主机组名字，下面两个ip为组内的机器ip。
**

ansible远程执行命令

**
这样就可以批量执行命令了。这里的testhost 为主机组名，-m后边是模块名字，-a后面是命令。当然我们也可以直接写一个ip，针对某一台机器来执行命令。
还有一个模块就是shell同样也可以实现 。
[root@ansible-test1 ~]# ansible testhost -m command -a “hostname”
127.0.0.1 | CHANGED | rc=0 >>
ansible-test1
192.168.2.20 | CHANGED | rc=0 >>
ansible-test2
[root@ansible-test1 ~]# ansible 192.168.2.20 -m command -a “hostname”
192.168.2.20 | CHANGED | rc=0 >>
ansible-test2

ansible拷贝文件或目录

源目录会放到目标目录下面去，如果目标指定的目录不存在，它会自动创建。如果拷贝的是文件，dest指定的名字和源如果不同，并且它不是已经存在的目录，相当于拷贝过去后又重命名。但相反，如果desc是目标机器上已经存在的目录，则会直接把文件拷贝到该目录下面。
[root@ansible-test1 ~]# ansible 192.168.2.20 -m copy -a “src=/etc/passwd dest=/tmp/123”
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“checksum”: “8f3ebea24b1558e6207af80195aa12931d96345f”,
“dest”: “/tmp/123”,
“gid”: 0,
“group”: “root”,
“md5sum”: “ca8f3327c9a73cb6fd96ba88ec4d18ee”,
“mode”: “0644”,
“owner”: “root”,
“secontext”: “unconfined_u:object_r:admin_home_t:s0”,
“size”: 1040,
“src”: “/root/.ansible/tmp/ansible-tmp-1593856449.24-11462-53060923085626/source”,
“state”: “file”,
“uid”: 0
}
这里的/tmp/123和源机器上的/etc/passwd是一致的，但如果目标机器上已经有/tmp/123目录，则会再/tmp/123目录下面建立passwd文件。
**

ansible远程执行脚本

**
首先创建一个shell脚本。
[root@ansible-test1 ~]# cat /tmp/test.sh
#!/bin/bash
echo date > /tmp/ansible_test.txt
然后把该脚本分发到各个机器上。
[root@ansible-test1 ~]# ansible testhost -m copy -a “src=/tmp/test.sh dest=/tmp/test.sh
mode=0755”
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“checksum”: “1a6e4af02dba1bda6fc8e23031d4447efeba0ade”,
“dest”: “/tmp/test.sh”,
“gid”: 0,
“group”: “root”,
“md5sum”: “edfaa4371316af8c5ba354e708fe8a97”,
“mode”: “0755”,
“owner”: “root”,
“secontext”: “unconfined_u:object_r:admin_home_t:s0”,
“size”: 48,
“src”: “/root/.ansible/tmp/ansible-tmp-1593856700.7-11499-220274653312920/source”,
“state”: “file”,
“uid”: 0
}
127.0.0.1 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“checksum”: “1a6e4af02dba1bda6fc8e23031d4447efeba0ade”,
“dest”: “/tmp/test.sh”,
“gid”: 0,
“group”: “root”,
“mode”: “0755”,
“owner”: “root”,
“path”: “/tmp/test.sh”,
“secontext”: “unconfined_u:object_r:user_tmp_t:s0”,
“size”: 48,
“state”: “file”,
“uid”: 0
}
最后是批量执行该shell脚本。
[root@ansible-test1 ~]# ansible testhost -m shell -a “/tmp/test.sh”
127.0.0.1 | CHANGED | rc=0 >>

192.168.2.20 | CHANGED | rc=0 >>

shell模块，还支持远程执行命令并且带管道。
[root@ansible-test1 ~]# ansible testhost -m shell -a "cat /etc/passwd |wc -l "
127.0.0.1 | CHANGED | rc=0 >>
21
192.168.2.20 | CHANGED | rc=0 >>
21
[root@ansible-test1 ~]# cat /tmp/ansible_test.txt //
2020年 07月 04日 星期六 18:00:51 CST
运行成功。
**

ansible管理任务计划

**
创建任务计划，命名并定义工作。
[root@ansible-test1 ~]# ansible testhost -m cron -a “name=‘test cron’ job=’/bin/bash
/tmp/test.sh’ weekday=6”
127.0.0.1 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“envs”: [],
“jobs”: [
“test cron”
]
}
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“envs”: [],
“jobs”: [
“test cron”
]
}
若要删除该cron 只需要加一个字段 state=absent 。
[root@ansible-test1 ~]# ansible testhost -m cron -a “name=‘test cron’ state=absent”
127.0.0.1 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“envs”: [],
“jobs”: []
}
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“envs”: [],
“jobs”: []
}
其他的时间表示：分钟 minute 小时 hour 日期 day 月份 month。
**

ansible安装rpm包/管理服务

**
使用yum模块安装httpd服务。
[root@ansible-test1 ~]# ansible testhost -m yum -a “name=httpd”
127.0.0.1 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“changes”: {
“installed”: [
“httpd”
]
},
“msg”: “”,
“rc”: 0,
“results”: [
…
…
\n\nComplete!\n"
]
}
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“changes”: {
“installed”: [
“httpd”
]
},
“msg”: “”,
“rc”: 0,
“results”: [
…
\n\nComplete!\n"
]
}
在name后面还可以加上state=installed/removed
设置服务状态，这里的name是centos系统里的服务名，可以通过chkconfig --list查到。
[root@ansible-test1 ~]# ansible testhost -m service -a “name=httpd state=started enabled=yes”
127.0.0.1 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“enabled”: true,
“name”: “httpd”,
“state”: “started”,
“status”: {
…
“WatchdogTimestampMonotonic”: “0”,
“WatchdogUSec”: “0”
}
}
192.168.2.20 | CHANGED => {
“ansible_facts”: {
“discovered_interpreter_python”: “/usr/bin/python”
},
“changed”: true,
“enabled”: true,
“name”: “httpd”,
“state”: “started”,
“status”: {
…
“WatchdogUSec”: “0”
}
}
Ansible文档的使用
[root@ansible-test1 ~]# ansible-doc -l //列出所有模块
fortios_router_community_list Configure community lists in Fortinet’s FortiOS …
azure_rm_devtestlab_info Get Azure DevTest Lab facts
ecs_taskdefinition register a task definition in ecs
avi_alertscriptconfig Module for setup of AlertScriptConfig Avi RESTfu…
tower_receive Receive assets from Ansible Tower
netapp_e_iscsi_target NetApp E-Series manage iSCSI target configuratio…
azure_rm_acs Manage an Azure Container Service(ACS) instance
…
[root@ansible-test1 ~]# ansible-doc yum //查看指定模块的文档

YUM (/usr/lib/python2.7/site-packages/ansible/modules/packaging/os/yum.py)

    Installs, upgrade, downgrades, removes, and lists packages and groups with the `yum'package manager. This module only works on Python 2. If you require Python 3 supportsee the [dnf] module.

• This module is maintained by The Ansible Core Team
• note: This module has a corresponding action plugin.

OPTIONS (= is mandatory):

• allow_downgrade
  Specify if the named package and version is allowed to downgrade a maybe already
  installed higher version of that package. Note that setting allow_downgrade=True can
  make this module behave in a non-idempotent way. The task could end up with a set of
  packages that does not match the complete list of specified packages to install
  (because dependencies between the downgraded package and others can cause changes to
  the packages which were in the earlier transaction).
  [Default: no]
  type: bool
  version_added: 2.4

**

ansible playbook使用

**

ansible playbook中的使用

相当于把模块写入到配置文件里面，例：
[root@ansible-test1 ansible]# cat /etc/ansible/test.yml

• hosts: 192.168.2.20
  remote_user: root
  tasks:
  • name: test_playbook
    shell: touch /tmp/playbook_test.txt
    说明：第一行需要有三个杠，hosts参数指定了对哪些主机进行参作，如果是多台机器可以用逗号作为分隔，也可以使用主机组，在/etc/ansible/hosts里定义，user参数指定了使用什么用户登录远程主机操作，tasks指定了一个任务，其下面的name参数同样是对任务的描述，在执行过程中会打印出来，shell是ansible模块名字
    [root@ansible-test1 ansible]# ansible-playbook test.yml

PLAY [192.168.2.20] ***********************************************************************************************

TASK [Gathering Facts] ********************************************************************************************
ok: [192.168.2.20]

TASK [test_playbook] **********************************************************************************************
[WARNING]: Consider using the file module with state=touch rather than running ‘touch’. If you need to use
command because file is insufficient you can add ‘warn: false’ to this command task or set
‘command_warnings=False’ in ansible.cfg to get rid of this message.
changed: [192.168.2.20]

PLAY RECAP ********************************************************************************************************
192.168.2.20 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
再来一个创建用户的例子：
[root@ansible-test1 ansible]# cat create_user.yml

• name: create_user
  hosts: 192.168.2.20
  user: root
  gather_facts: false
  vars:
  • user: “test”
    tasks:
  • name: create user
    user: name="{{ user }}"
    说明：name参数对该playbook实现的功能做一个概述，后面执行过程中，会打印 name变量的值 ，可以省略；gather_facts参数指定了在以下任务部分执行前，是否先执行setup模块获取主机相关信息，这在后面的task会使用到setup获取的信息时用到；vars参数，指定了变量，这里指字一个user变量，其值为test ，需要注意的是，变量值一定要用引号引住；user提定了调用user模块，name是user模块里的一个参数，而增加的用户名字调用了上面user变量的值。
    [root@ansible-test1 ansible]# ansible-playbook create_user.yml

PLAY [create_user] ************************************************************************************************

TASK [create user] ************************************************************************************************
changed: [192.168.2.20]

PLAY RECAP ********************************************************************************************************
192.168.2.20 : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
**

ansible playbook中的循环

**
创建while.yml文件
[root@ansible-test1 ansible]# cat while.yml

• hosts: testhost
  user: root
  tasks:
  • name: change mode for files
    file: path=/tmp/{{ item }} mode=600
    with_items:
    • 1.txt
    • 2.txt
    • 3.txt
      说明: with_items为循环的对象
      执行while.yml。
      [root@ansible-test1 ansible]# ansible-playbook while.yml

PLAY [testhost] ***************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************
ok: [127.0.0.1]
ok: [192.168.2.20]

TASK [change mode for files] **************************************************************************************
ok: [127.0.0.1] => (item=1.txt)
changed: [192.168.2.20] => (item=1.txt)
ok: [127.0.0.1] => (item=2.txt)
changed: [192.168.2.20] => (item=2.txt)
ok: [127.0.0.1] => (item=3.txt)
changed: [192.168.2.20] => (item=3.txt)

PLAY RECAP ********************************************************************************************************
127.0.0.1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.2.20 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
**

ansible playbook中的条件判断

**
创建when.yml文件。
[root@ansible-test1 ansible]# cat when.yml

• hosts: testhost
  user: root
  gather_facts: True
  tasks:
  • name: use when
    shell: touch /tmp/when.txt
    when: ansible_eno16777736.ipv4.address == “192.168.2.20”
    说明：ansible anisble-02 -m setup 可以查看到所有的facter信息
    执行when.yml。
    [root@ansible-test1 ansible]# ansible-playbook when.yml

PLAY [testhost] ***************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************
ok: [127.0.0.1]
ok: [192.168.2.20]

TASK [use when] ***************************************************************************************************
skipping: [127.0.0.1]
[WARNING]: Consider using the file module with state=touch rather than running ‘touch’. If you need to use
command because file is insufficient you can add ‘warn: false’ to this command task or set
‘command_warnings=False’ in ansible.cfg to get rid of this message.
changed: [192.168.2.20]

PLAY RECAP ********************************************************************************************************
127.0.0.1 : ok=1 changed=0 unreachable=0 failed=0 skipped=1 rescued=0 ignored=0
192.168.2.20 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

ansible playbook中的handlers

执行task之后，服务器发生变化之后要执行的一些操作，比如我们修改了配置文件后，需要重启一下服务，创建handlers.yml文件加入如下内容
[root@ansible-test1 ansible]# cat handlers.yml

• name: handlers test
  hosts: 192.168.2.20
  user: root
  tasks:
  • name: copy file
    copy: src=/etc/passwd dest=/tmp/aaa.txt
    notify: test handlers
    handlers:
  • name: test handlers
    shell: echo “111111” >> /tmp/aaa.txt
    说明，只有copy模块真正执行后，才会去调用下面的handlers相关的操作。也就是说如果1.txt和2.txt内容是一样的，并不会去执行handlers里面的shell相关命令。 这种比较适合配置文件发生更改后，重启服务的操作。
    [root@ansible-test1 ansible]# ansible-playbook handlers.yml

PLAY [handlers test] **********************************************************************************************

TASK [Gathering Facts] ********************************************************************************************
ok: [192.168.2.20]

TASK [copy file] **************************************************************************************************
changed: [192.168.2.20]

RUNNING HANDLER [test handlers] ***********************************************************************************
changed: [192.168.2.20]

PLAY RECAP ********************************************************************************************************
192.168.2.20 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

ansible playbook实战

ansible自动化安装nginx

（1）编译安装nginx
1）使用wget下载nginx包，下载地址：http://mirrors.sohu.com/nginx/nginx-1.9.6.tar.gz
2）解压下载的nginx包
./configure --prefix=/usr/local/nginx
make && make install
3）编写/etc/init.d/nginx文件
内容如下：
#!/bin/bash
chkconfig: - 30 21
description: http service.
Source Function Library
. /etc/init.d/functions
Nginx Settings
NGINX_SBIN="/usr/local/nginx/sbin/nginx"
NGINX_CONF="/usr/local/nginx/conf/nginx.conf"
NGINX_PID="/usx/local/nginx/logs/nginx.pid"
RETVAL=0
prog=“Nginx”

start()
{
echo -n $"Starting $prog: "
mkdir -p /dev/shm/nginx_temp
daemon $NGINX_SBIN -c $NGIN{X}_{C}ONFRETVAL=$?
echo
return $RETVAL
}
stop()
{
echo -n $"Stopping $prog: "
killproc -p $NGINX_PID $NGIN{X}_{S}BIN-TERMrm-rf/dev/shm/ngin{x}_{t}empRETVAL=$?
echo
return $RETVAL
}
reload()
{
echo -n $"Reloading $prog: "
killproc -p $NGINX_PID $NGIN{X}_{S}BIN-HUPRETVAL=$?
echo
return $RETVAL
}
restart()
{
stop
start
}
configtest()
{
$NGINX_SBIN -c $NGINX_CONF -t
return 0
}
case “$1” in
start)
start
;;
stop)
stop
;;
reload)
reload
;;
restart)
restart
;;
configtest)
configtest
;;
*)
echo $“Usage: $0 {start|stop|reload|restart|configtest}”
RETVAL=1
esac

exit $RETVAL
4）清空配置文件并重新编写

> /usr/local/nginx/conf/nginx.conf
内容如下：
user nobody nobody;		//定义nginx运行的用户和用户组
worker_processes 2;		//nginx进程数，一般为CPU总核心数
error_log /usr/local/nginx/logs/nginx_error.log crit;	//全局错误日志定义类型
pid /usr/local/nginx/logs/nginx.pid;	//进程文件
worker_rlimit_nofile 51200;
events		//工作模式与连接数上限
{
use epoll;
worker_connections 6000;
}
http		//http下的一些配置
{
include mime.types;		//文件扩展名与文件类型映射表
default_type application/octet-stream;		//默认文件类型
server_names_hash_bucket_size 3526;
server_names_hash_max_size 4096;
log_format combined_realip '$remote_addr $http_x_forwarded_for [$time_local]'
'$host "$request_uri" $status'
'"$http_referer" "$http_user_agent"';
sendfile on;		//开启高效文件传输模式
tcp_nopush on;		//防止网络阻塞
keepalive_timeout 30;		//长连接超时时间，单位为秒
client_header_timeout 3m;
client_body_timeout 3m;
send_timeout 3m;
connection_pool_size 256;
client_header_buffer_size 1k;
large_client_header_buffers 8 4k;
request_pool_size 4k;
output_buffers 4 32k;
postpone_output 1460;
client_max_body_size 10m;
client_body_buffer_size 256k;
client_body_temp_path /usr/local/nginx/client_body_temp;
proxy_temp_path /usr/local/nginx/proxy_temp;
fastcgi_temp_path /usr/local/nginx/fastcgi_temp;
fastcgi_intercept_errors on;
tcp_nodelay on;		//防止网络阻塞
gzip on;		//开启gzip压缩输出
gzip_min_length 1k;
gzip_buffers 4 8k;
gzip_comp_level 5;
gzip_http_version 1.1;
gzip_types text/plain application/x-javascript text/css text/htm
application/xml;
server		//虚拟主机配置
{
listen 80;
server_name localhost;
index index.html index.htm index.php;
root /usr/local/nginx/html;
location ~ \.php$
{
include fastcgi_params;
fastcgi_pass unix:/tmp/php-fcgi.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/1ocal/nginx/html$fastcgi_script_name;
}
}
}

5）编写完成后可以检查一下
/usr/local/nginx/sbin/nginx -t
6）启动nginx
service nginx start
编译安装完成
（2）环境准备
1）将nginx.tar.gz复制到/etc/ansible/nginx_install/roles/install/files下
启动脚本和配置文件都放到/etc/ansible/nginx_install/roles/install/template下
mv nginx.tar.gz /etc/ansible/nginx_install/roles/install/files/
cp nginx/conf/nginx.conf /etc/ansible/nginx_install/roles/install/templates/
cp /etc/init.d/nginx /etc/ansible/nginx_install/roles/install/templates/
2）编写需要的yml文件
[root@ansible2 nginx_install]# cat install.yml

• hosts: 192.168.2.101 //入口文件
  remote_user: root
  gather_facts: True
  roles:
  • common
  • install
    [root@ansible2 nginx_install]# cat roles/common/tasks/main.yml
• name: install initialization require software //安装需要的依赖
  yum: name={{ item }} state=installed
  with_items:
  • zlib-devel
  • pcre-devel
  • gcc
    [root@ansible2 nginx_install]# cat roles/install/vars/main.yml
    nginx_user: www //定义所需变量
    nginx_port: 80
    nginx_basedir: /usr/local/nginx
    [root@ansible2 nginx_install]# cat roles/install/tasks/copy.yml
• name: Copy Nginx Software //复制压缩包
  copy: src=nginx.tar.gz dest=/tmp/nginx.tar.gz owner=root group=root
• name: Uncompression Nginx Software //解压压缩包
  shell: tar zxf /tmp/nginx.tar.gz -C /usr/local/
• name: Copy Nginx Start Script //复制启动脚本
  template: src=nginx dest=/etc/init.d/nginx owner=root group=root mode=0755
• name: Copy Nginx Config //复制nginx配置文件
  template: src=nginx.conf dest={{ nginx_basedir }}/conf/ owner=root group=root
  mode=0644
  [root@ansible2 nginx_install]# cat roles/install/tasks/install.yml
• name: create nginx user //创建用户
  user: name={{ nginx_user }} state=present createhome=no shell=/sbin/nologin
• name: start nginx service //开启服务
  shell: /etc/init.d/nginx start
• name: add boot start nginx service //加入开机启动
  shell: chkconfig --level 345 nginx on
• name: delete nginx compression files //删除压缩包
  shell: rm -rf /tmp/nginx.tar.gz
  [root@ansible2 nginx_install]# cat roles/install/tasks/main.yml
• include: copy.yml //调用copy.yml和install.yml
• include: install.yml
  （3）执行文件
  运行install.yml文件
  ansible-playbook /etc/ansible/nginx_install/install.yml
  注：要检查远程机器存在端口占用，及时卸载。
  结果如下：
  [root@ansible-01 ~]# ansible-playbook /etc/ansible/nginx_install/install.yml

PLAY [192.168.2.31] ****************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [192.168.2.31]

TASK [common : install initializtion requre software] ******************************************************************
[DEPRECATION WARNING]: Invoking “yum” only once while using a loop via squash_actions is deprecated. Instead of using a
loop to supply multiple items and specifying name: "{{ item }}", please use name: ['zlib-devel', 'pcre-devel'] and
remove the loop. This feature will be removed in version 2.11. Deprecation warnings can be disabled by setting
deprecation_warnings=False in ansible.cfg.
ok: [192.168.2.31] => (item=[u’zlib-devel’, u’pcre-devel’])

TASK [install : Copy Nginx Software] ***********************************************************************************
changed: [192.168.2.31]

TASK [install : Uncompression Nginx Software] **************************************************************************
[WARNING]: Consider using the unarchive module rather than running ‘tar’. If you need to use command because unarchive
is insufficient you can add ‘warn: false’ to this command task or set ‘command_warnings=False’ in ansible.cfg to get
rid of this message.
changed: [192.168.2.31]

TASK [install : Copy Nginx Start Script] *******************************************************************************
ok: [192.168.2.31]

TASK [install : Copy Nginx Config] *************************************************************************************
ok: [192.168.2.31]

TASK [install : Create Nginx User] *************************************************************************************
ok: [192.168.2.31]

TASK [install : Start Nginx Service] ***********************************************************************************
changed: [192.168.2.31]

TASK [install : Add Boot start Nginx service] **************************************************************************
changed: [192.168.2.31]

TASK [install : Delete Nginx compression files] ************************************************************************
[WARNING]: Consider using the file module with state=absent rather than running ‘rm’. If you need to use command
because file is insufficient you can add ‘warn: false’ to this command task or set ‘command_warnings=False’ in
ansible.cfg to get rid of this message.
changed: [192.168.2.31]

PLAY RECAP *************************************************************************************************************
192.168.2.31 : ok=10 changed=5 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

管理配置文件

生产环境中大多时候是需要管理配置文件的，安装软件包只是在初始化环境的时候用一下。下面我们来写个管理nginx配置文件的playbook。
[root@ansible2nginx_config]#cat
/etc/ansible/nginx_config/roles/new/handlers/main.yml

• name: restart nginx //用于重新加载nginx服务
  shell: /etc/init.d/nginx reload
  [root@ansible2nginx_config]# cat /etc/ansible/nginx_config/roles/new/tasks/main.yml
• name: copy conf file //复制.conf和hosts文件
  copy: src={{ item.src }} dest={{ nginx_basedir }}/{{ item.dest }} backup=yes owner=root group=root mode=0644
  with_items:
  • { src: nginx.conf, dest: conf/nginx.conf }
  • { src: vhosts, dest: conf/ }
    notify: restart nginx
    [root@ansible2 nginx_config]# cat /etc/ansible/nginx_config/roles/new/vars/main.yml
    nginx_basedir: /usr/local/nginx //定义变量
    [root@ansible2 nginx_config]# cat update.yml

---

• hosts: 192.168.2.101 //入口文件
  user: root
  roles:
  • new //这里只有new
    old目录中的yml文件与new目录中的相同，files中的配置文件不同。
    其中new为更新时用到的，old为回滚时用到的，files下面为nginx.conf和vhosts目录，handlers为重启nginx服务的命令
    在执行update.yml前，应备份当前配置文件，当执行之后发现错误，则进行回滚操作，
    关于回滚，需要在执行playbook之前先备份一下旧的配置，所以对于老配置文件的管理一定要严格，千万不能随便去修改线上机器的配置，并且要保证new/files下面的配置和线上的配置一致，命令如下：
    rsync -av /etc/ansible/nginx_config/roles/new/
    /etc/ansible/nginx_config/roles/old/
    回滚操作就是把旧的配置覆盖，然后重新加载nginx服务, 每次改动nginx配置文件之前先备份到old里，对应目录为/etc/ansible/nginx_config/roles/old/files。
    更新操作结果：
    [root@ansible-01 nginx_config]# ansible-playbook /etc/ansible/nginx_config/update.yml

PLAY [testhost] ********************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [192.168.2.31]
ok: [127.0.0.1]

TASK [new : copy conf file] ********************************************************************************************
ok: [192.168.2.31] => (item={u’dest’: u’conf/nginx.conf’, u’src’: u’nginx.conf’})
ok: [127.0.0.1] => (item={u’dest’: u’conf/nginx.conf’, u’src’: u’nginx.conf’})
ok: [127.0.0.1] => (item={u’dest’: u’conf/’, u’src’: u’vhosts’})
changed: [192.168.2.31] => (item={u’dest’: u’conf/’, u’src’: u’vhosts’})

RUNNING HANDLER [new : restart nginx] **********************************************************************************
changed: [192.168.2.31]

PLAY RECAP *************************************************************************************************************
127.0.0.1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.2.31 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
回滚操作结果：
[root@ansible-01 nginx_config]# ansible-playbook /etc/ansible/nginx_config/rollback.yml

PLAY [testhost] ********************************************************************************************************

TASK [Gathering Facts] *************************************************************************************************
ok: [192.168.2.31]
ok: [127.0.0.1]

TASK [old : copy conf file] ********************************************************************************************
ok: [192.168.2.31] => (item={u’dest’: u’conf/nginx.conf’, u’src’: u’nginx.conf’})
ok: [127.0.0.1] => (item={u’dest’: u’conf/nginx.conf’, u’src’: u’nginx.conf’})
ok: [192.168.2.31] => (item={u’dest’: u’conf/’, u’src’: u’vhosts’})
ok: [127.0.0.1] => (item={u’dest’: u’conf/’, u’src’: u’vhosts’})

PLAY RECAP *************************************************************************************************************
127.0.0.1 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
192.168.2.31 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

注：本次实验并未改变配置文件，故changed为0。