• Ansible上通过roles简化playbook演示介绍

    目录

    一.roles介绍

    1.作用

    2.role的目录结构

    3.role和tasks的执行优先级顺序

    二.自定义一个httpd的角色

    1.完整目录结构展示

    2.主要的各个目录配置

    （1）vars目录和templates目录

    （2）tasks目录和handlers目录

    （3）运行playbook测试

    三.ansible galaxy安装roles

    1.在线网站

    2.配置roles_path

    3.ansible-galaxy安装role

    4.其他管理

    四.系统角色

    1.安装系统角色包

    2.更改配置文件role路径便于对系统角色进行操作

    3.介绍rhel提供的部分系统角色

    4.timesync和selinux示例

    （1）timesync

    （2）selinux

     

    一.roles介绍

    1.作用

    主要适用于层次性、结构化来组织playbook任务。根据层次型结构自动装载变量文件、tasks、和handlers等。主要应用于基于主机构建服务和构建进程场景、代码服用程度较高的场景。

    2.role的目录结构

    在playbook中通过“roles: role文件”来引用role，role的目录结构不要求全部完整，根据role要实现的功能来添加目录和文件

    名称含义
    tasks至少要包含一个main.yaml，用来定义这个角色的任务列表，可以使用include引入其他tasks
    files存放copy或script模块调用的文件
    templatestemplate模块寻找jinja2模版的目录
    handlers要包含一个main.yaml，来定义这个角色用到的handlers
    vars要包含一个main.yaml，用来定义这个角色要用到的变量
    mate要包含一个main.yaml，用来定义这个角色的特殊设置

    3.role和tasks的执行优先级顺序

    pre_tasks > roles > tasks > post_tasks

    二.自定义一个httpd的角色

    1.完整目录结构展示

    1. [root@main roles]# tree .
    2. .
    3. ├── ansible.cfg    #存放ansible配置文件
    4. ├── httpd     #role目录
    5. │   ├── handlers    #存放handlers
    6. │   │   └── main.yaml   
    7. │   ├── tasks   #存放主要执行的任务
    8. │   │   ├── config.yaml   #关于配置httpd
    9. │   │   ├── group.yaml   #关于配置httpd属组
    10. │   │   ├── install.yaml   #关于安装httpd
    11. │   │   ├── main.yaml   #关于所有任务的引入
    12. │   │   ├── start.yaml   #关于启动httpd
    13. │   │   └── user.yaml   #关于配置httpd属主
    14. │   ├── templates       #存放要部署下发的文件
    15. │   │   └── httpd.conf.j2
    16. │   └── vars   #存放变量
    17. │       └── main.yaml
    18. ├── httpd_roles.yaml   #最终指定执行role的playbook文件
    19. └── myhosts   #主机清单文件

    2.主要的各个目录配置

    （1）vars目录和templates目录

    1. [root@main httpd]# cat vars/main.yaml   #自定义在受管节点的httpd服务要用到的参数
    2. port: 8090
    3. user: sulibao
    4. group: sulibao
    5. ​
    6. [root@main httpd]# cp httpd.conf /root/roles/httpd/templates/httpd.conf.j2  
    7. #从本地拷贝httpd的配置文件到templates目录，且为j2格式
    8. #需要修改参数的话就按照j2变量格式去修改
    9. [root@main httpd]# cat templates/httpd.conf.j2 | grep Listen;cat templates/httpd.conf.j2 | grep User;cat templates/httpd.conf.j2 | grep Group
    10. # Listen: Allows you to bind Apache to specific IP addresses and/or
    11. # Change this to Listen on specific IP addresses as shown below to 
    12. #Listen 12.34.56.78:80
    13. Listen "{{ port }}"         #       
    14. # User/Group: The name (or #number) of the user/group to run httpd as.
    15. User "{{ user }}"    #
    16.     LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    17.       LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    18. # User/Group: The name (or #number) of the user/group to run httpd as.
    19. Group "{{ group }}"    #

    （2）tasks目录和handlers目录

    1. [root@main httpd]# cat tasks/user.yaml #创建用户
    2. - name: create user
    3.   user:
    4.     name: "sulibao"
    5.     uid: 1050
    6.     system: yes
    7.     shell: /sbin/nologin
    8. [root@main httpd]# cat tasks/group.yaml   #创建组
    9. - name: create group
    10.   group:
    11.     name: "sulibao"
    12.     gid: 1050
    13.     system: yes
    14. [root@main httpd]# cat tasks/install.yaml   #安装httpd
    15. - name: install httpd
    16.   yum:
    17.     name: httpd
    18.     state: present
    19. [root@main httpd]# cat tasks/start.yaml    #启动httpd
    20. - name: start httpd
    21.   service:
    22.     name: httpd
    23.     state: started
    24.     enabled: yes
    25. [root@main httpd]# cat tasks/config.yaml    #将templates内的配置文件推送给受管节点用
    26. - name: config httpd
    27.   template:
    28.     src: /root/roles/httpd/templates/httpd.conf.j2
    29.     dest: /etc/httpd/conf/httpd.conf
    30.   notify: restart httpd
    31. [root@main httpd]# cat tasks/main.yaml  #引用所有的任务
    32. - import_tasks: user.yaml
    33. - import_tasks: group.yaml
    34. - import_tasks: install.yaml
    35. - import_tasks: start.yaml
    36. - import_tasks: config.yaml
    37. ​
    38. [root@main httpd]# cat handlers/main.yaml 
    39. - name: restart httpd
    40.   service:
    41.     name: httpd
    42.     state: restarted

    （3）运行playbook测试

    1. [root@main roles]# cat httpd_roles.yaml 
    2. ---
    3. - hosts: servera
    4.   roles:
    5.     - role: httpd   #指定httpd角色目录
    6. ​
    7. [root@main roles]# ansible-playbook httpd_roles.yaml
    8. ​
    9. [root@main roles]# ansible servera -m shell -a 'ss -lntup | grep 8090'   #端口变量运行正常
    10. servera | CHANGED | rc=0 >>
    11. tcp    LISTEN     0      128    [::]:8090               [::]:*                   users:(("httpd",pid=2749,fd=4),("httpd",pid=2748,fd=4),("httpd",pid=2747,fd=4),("httpd",pid=2746,fd=4),("httpd",pid=2745,fd=4),("httpd",pid=2744,fd=4))
    12. ​
    13. [root@main roles]# ansible servera -m shell -a 'ps u 2748'    #进程确实是我们指定用户
    14. servera | CHANGED | rc=0 >>
    15. USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
    16. sulibao    2748  0.0  0.0 250100  3572 ?        S    14:09   0:00 /usr/sbin/httpd -DFOREGROUND
    17. ​
    18. [root@main roles]# ansible servera -m shell -a 'echo hello > /var/www/html/index.html'
    19. servera | CHANGED | rc=0 >>
    20. ​
    21. [root@main roles]# ansible servera -m shell -a 'curl localhost:8090'      #能够正常访问
    22. servera | CHANGED | rc=0 >>
    23. hello  

    三.ansible galaxy安装roles

    ansible-galaxy基于在线网站的公共内容资源库，可以在内进行搜索所需roles，便于从在线网站获取role和git存储库的role。

    1.在线网站

    Galaxy NG (ansible.com)

    时而可用时而不可用，找到role后复制命令进行下载

     a2e170ec940f4eb58f1e8e3540bb2852.png

    2.配置roles_path

    1. [root@main roles]# cat ansible.cfg | grep role
    2. roles_path=/root/roles/myroles

    3.ansible-galaxy安装role

    （1）默认通过网站在线安装

    [root@main playkongzhi]# ansible-galaxy install role名称

    （2）通过文件安装，需要是yaml格式的文件

    [root@main playkongzhi]# ansible-galaxy install -r 指定文件 -p 指定安装路径

    4.其他管理

    （1）初始化角色结构

    [root@main playkongzhi]# ansible-galaxy init role名称

    （2）列出角色名称

    [root@main playkongzhi]# ansible-galaxy list

    （3）删除已安装角色

    [root@main playkongzhi]# ansible-galaxy remove role名称

    （4）搜索角色

    可以通过“--author（作者）”、“--platform（平台）”、“--galaxy-tags（标签）“等选项来缩小范围

    [root@main playkongzhi]# ansible-galaxy search role名称 选项

    四.系统角色

    1.安装系统角色包

    注意：

    角色默认是下载到/usr/share/ansible/roles

    其帮助文档位于/usr/share/doc/rhel-system-roles-1.21.2（含示例）

    1. [root@main roles]# yum list | grep roles
    2. rhel-system-roles.noarch                 1.21.2-1.el7_9                extras 
    3. [root@main roles]# yum install -y rhel-system-roles.noarch

    2.更改配置文件role路径便于对系统角色进行操作

    roles目录路径后再使用":"跟上下载的系统角色目录路径，再就可以查看到我们可用的角色了，若不需要就再把路径改回来即可

    1. [root@main roles]# cat ansible.cfg | grep role
    2. roles_path=/root/roles/myroles:/usr/share/ansible/roles
    3. ​
    4. [root@main roles]# ansible-galaxy list
    5. # /root/roles/myroles
    6. # /usr/share/ansible/roles
    7. - linux-system-roles.ad_integration, (unknown version)
    8. - linux-system-roles.certificate, (unknown version)
    9. - linux-system-roles.cockpit, (unknown version)
    10. - linux-system-roles.crypto_policies, (unknown version)
    11. - linux-system-roles.firewall, (unknown version)
    12. - linux-system-roles.ha_cluster, (unknown version)
    13. - linux-system-roles.journald, (unknown version)
    14. - linux-system-roles.kdump, (unknown version)
    15. - linux-system-roles.kernel_settings, (unknown version)
    16. - linux-system-roles.logging, (unknown version)
    17. - linux-system-roles.metrics, (unknown version)
    18. - linux-system-roles.nbde_client, (unknown version)
    19. - linux-system-roles.nbde_server, (unknown version)
    20. - linux-system-roles.network, (unknown version)
    21. - linux-system-roles.podman, (unknown version)
    22. - linux-system-roles.postfix, (unknown version)
    23. - linux-system-roles.rhc, (unknown version)
    24. - linux-system-roles.selinux, (unknown version)
    25. - linux-system-roles.ssh, (unknown version)
    26. - linux-system-roles.sshd, (unknown version)
    27. - linux-system-roles.storage, (unknown version)
    28. - linux-system-roles.timesync, (unknown version)
    29. - linux-system-roles.tlog, (unknown version)
    30. - linux-system-roles.vpn, (unknown version)
    31. - rhel-system-roles.ad_integration, (unknown version)
    32. - rhel-system-roles.certificate, (unknown version)
    33. - rhel-system-roles.cockpit, (unknown version)
    34. - rhel-system-roles.crypto_policies, (unknown version)
    35. - rhel-system-roles.firewall, (unknown version)
    36. - rhel-system-roles.ha_cluster, (unknown version)
    37. - rhel-system-roles.journald, (unknown version)
    38. - rhel-system-roles.kdump, (unknown version)
    39. - rhel-system-roles.kernel_settings, (unknown version)
    40. - rhel-system-roles.logging, (unknown version)
    41. - rhel-system-roles.metrics, (unknown version)
    42. - rhel-system-roles.nbde_client, (unknown version)
    43. - rhel-system-roles.nbde_server, (unknown version)
    44. - rhel-system-roles.network, (unknown version)
    45. - rhel-system-roles.podman, (unknown version)
    46. - rhel-system-roles.postfix, (unknown version)
    47. - rhel-system-roles.rhc, (unknown version)
    48. - rhel-system-roles.selinux, (unknown version)
    49. - rhel-system-roles.ssh, (unknown version)
    50. - rhel-system-roles.sshd, (unknown version)
    51. - rhel-system-roles.storage, (unknown version)
    52. - rhel-system-roles.timesync, (unknown version)
    53. - rhel-system-roles.tlog, (unknown version)
    54. - rhel-system-roles.vpn, (unknown version)

    3.介绍rhel提供的部分系统角色

    名称描述功能
    rhel-system-roles.timesync配置时间同步，使用网络时间协议配置
    rhel-system-roles.selinux配置selinux的模式、文件、端口上下文、用户等
    rhel-system-roles.network配置网络接口
    rhel-system-roles.kdump配置kdump崩溃恢复服务
    rhel-system-roles.postfix配置使用postfix配置邮件传输代理
    rhel-system-roles.firewall配置防火墙

    4.timesync和selinux示例

    （1）timesync

    实际上，example文件已经给出了完整的模版，按照其中的参数修改为自己需求即可

    1. [root@main roles]# cat /usr/share/doc/rhel-system-roles-1.21.2/timesync/example-multiple-ntp-servers-playbook.yml 
    2. ---
    3. - name: Example with multiple servers
    4.   hosts: "{{ targets }}"   #更改为自己管理的主机
    5.   vars:
    6.     timesync_ntp_servers:
    7.       - hostname: 0.pool.ntp.org    #hostname表示要同步的ntp服务器
    8.         iburst: true
    9.       - hostname: 1.pool.ntp.org
    10.         iburst: true
    11.       - hostname: 2.pool.ntp.org
    12.         iburst: true
    13.       - hostname: 3.pool.ntp.org
    14.         iburst: true
    15.   roles:
    16.     - rhel-system-roles.timesync
    17.  
    18. #将模板文件拷贝过来并改名
    19. [root@main roles]# cp /usr/share/doc/rhel-system-roles-1.21.2/timesync/example-multiple-ntp-servers-playbook.yml timesync.yaml
    20. [root@main roles]# cat timesync.yaml 
    21. ---
    22. - name: Example with multiple servers
    23.   hosts: servera   #修改hosts
    24.   vars:
    25.     timesync_ntp_servers:
    26.       - hostname: 0.pool.ntp.org   #就使用模版提供的ntp也行
    27.         iburst: true     #填写布尔值，启用或禁用快速初始化同步，默认为no，一般设置yes
    28.       - hostname: 1.pool.ntp.org
    29.         iburst: true
    30.       - hostname: 2.pool.ntp.org
    31.         iburst: true
    32.       - hostname: 3.pool.ntp.org
    33.         iburst: true
    34.   roles:
    35.     - rhel-system-roles.timesync
    36. ​
    37.  
    38. [root@main roles]# ansible servera -m shell -a 'head /etc/chrony.conf'  
    39. #查看是否应用成功
    40. servera | CHANGED | rc=0 >>
    41. #
    42. # Ansible managed
    43. #
    44. # system_role:timesync
    45. ​
    46. ​
    47. server 0.pool.ntp.org iburst
    48. server 1.pool.ntp.org iburst
    49. server 2.pool.ntp.org iburst
    50. server 3.pool.ntp.org iburst
    51. ​
    52.  
    53. [root@main roles]# ansible servera -m shell -a 'chronyc sources'
    54. servera | CHANGED | rc=0 >>
    55. 210 Number of sources = 4
    56. MS Name/IP address         Stratum Poll Reach LastRx Last sample               
    57. ===============================================================================
    58. ^+ electrode.felixc.at           2   6    37    96    +49ms[+8671us] +/-  140ms
    59. ^- ntp5.flashdance.cx            2   6    75    34    +48ms[  +48ms] +/-  149ms
    60. ^* makaki.miuku.net              3   6    77    35    -29ms[  -69ms] +/-  128ms
    61. #测试第一次这个可用，成功
    62. ^- a.chl.la                      2   6    75    35    +48ms[  +48ms] +/-  139ms

    （2）selinux

    修改过后需要重启

    1. [root@main roles]# cp /usr/share/doc/rhel-system-roles-1.21.2/selinux/example-selinux-playbook.yml selinux.yaml
    2. [root@main roles]# vim selinux.yaml 
    3. [root@main roles]# cat selinux.yaml 
    4. ---
    5. - name: Manage SELinux policy example
    6.   hosts: all
    7.   vars:
    8.     # Use "targeted" SELinux policy type
    9.     selinux_policy: targeted
    10.     # Set "enforcing" mode
    11.     selinux_state: enforcing    #模版默认设置的是enforcing
    12.     # Switch some SELinux booleans
    13.     selinux_booleans:
    14.       # Set the 'samba_enable_home_dirs' boolean to 'on' in the current
    15.       # session only
    16.       - {name: 'samba_enable_home_dirs', state: 'on'}
    17.       # Set the 'ssh_sysadm_login' boolean to 'on' permanently
    18.       - {name: 'ssh_sysadm_login', state: 'on', persistent: 'yes'}
    19.     # Map '/tmp/test_dir' and its subdirectories to the 'user_home_dir_t'
    20.     # SELinux file type
    21.     selinux_fcontexts:
    22.       - {target: '/tmp/test_dir(/.*)?', setype: 'user_home_dir_t', ftype: 'd'}
    23.     # Restore SELinux file contexts in '/tmp/test_dir'
    24.     selinux_restore_dirs:
    25.       - /tmp/test_dir
    26.     # Map tcp port 22100 to the 'ssh_port_t' SELinux port type
    27.     selinux_ports:
    28.       - {ports: '22100', proto: 'tcp', setype: 'ssh_port_t', state: 'present'}
    29.     # Map the 'sar-user' Linux user to the 'staff_u' SELinux user
    30.     selinux_logins:
    31.       - {login: 'sar-user', seuser: 'staff_u', serange: 's0-s0:c0.c1023',
    32.          state: 'present'}
    33.     # Manage modules
    34.     selinux_modules:
    35.       # Install the 'localpolicy.cil' with priority 300
    36.       - {path: "localpolicy.cil", priority: "300", state: "enabled"}
    37.       # Disable the 'unconfineduser' module with priority 100
    38.       - {name: "unconfineduser", priority: "100", state: "disabled"}
    39.       # Remove the 'temporarypolicy' module with priority 400
    40.       - {name: "temporarypolicy", priority: "400", state: "absent"}
    41. ​
    42.   # Prepare the prerequisites required for this playbook
    43.   tasks:
    44.     - name: Creates directory
    45.       file:
    46.         path: /tmp/test_dir
    47.         state: directory
    48.         mode: "0755"
    49.     - name: Add a Linux System Roles SELinux User
    50.       user:
    51.         comment: Linux System Roles SELinux User
    52.         name: sar-user
    53.     - name: Execute the role and catch errors
    54.       block:
    55.         - name: Include selinux role
    56.           include_role:
    57.             name: rhel-system-roles.selinux
    58.       rescue:
    59.         # Fail if failed for a different reason than selinux_reboot_required.
    60.         - name: Handle errors
    61.           fail:
    62.             msg: "role failed"
    63.           when: not selinux_reboot_required
    64. ​
    65.         - name: Restart managed host
    66.           reboot:
    67. ​
    68.         - name: Wait for managed host to come back
    69.           wait_for_connection:
    70.             delay: 10
    71.             timeout: 300
    72. ​
    73.         - name: Reapply the role
    74.           include_role:
    75.             name: rhel-system-roles.selinux

     

  • 相关阅读:
    @RepositoryRestResource 和 @RepositoryRestController 浅析
    Mybatis-Plus强大的条件构造器queryWrapper、updateWrapper
    c#学习笔记
    残差网络（ResNet）
    MySQL 的“回表”是什么
    第1关：Hive 的 Alter Table 操作
    一文带你了解动态NAT以及NAPT实验配置
    gdb调试程序教程
    不要用第三方日志包了Microsoft.Extensions.Logging功能就很强大
    自动气象站：无线数据传输、多场景应用
  • 原文地址：https://blog.csdn.net/weixin_64334766/article/details/134058254