python ansible服务及剧本编写

http://docs.ansible.com/ansible/intro_installation.html
http://www.ansible.com.cn/
http://docs.ansible.com/modules_by_category.html
http://www.ansible.cn/docs/

ssh-keygen -t dsa -P '' -f ~/.ssh/id_dsa >/dev/null 2>&1

 sshpass -p123456 ssh-copy-id -i ~/.ssh/id_dsa.pub "-o StrictHostChecking=no 172.16.1.41"
 sshpass -p123456 ssh -o StrictHostChecking=no root@172.16.1.41 "uptime"
 sshpass -p123456 scp -o StrictHostChecking=no /etc/hosts root@172.16.1.41:~
 <- -p：指定ssh连接用户的密码
 <- -o：StrictHostChecking=no 避免第一次登录出现公钥检查

sed -i.bak 's#keepcache=0#keepcache=1#g' /etc/yum.conf 2 grep keepcache /etc/yum.conf 

yum install libselinux-python -y

yum install ansible -y

 [root@m01 ~]# ansible --version
 ansible 2.3.2.0
 config file = /etc/ansible/ansible.cfg #告知ansible软件配置文静路径
 configured module search path = Default w/o overrides
 python version = 2.6.6 (r266:84292, Aug 18 2016, 15:13:37) [GCC 4.4.7 20120313 (Red Hat 4.4.7-17)]

[root@m01 ~]# rpm -ql ansible|egrep -v '/usr/share/|/usr/lib'
/etc/ansible
/etc/ansible/ansible.cfg #ansible配置文件
/etc/ansible/hosts  #定义ansible可以管理的主机信息
/etc/ansible/roles  #主要在自动化部署多台主机时应用
/usr/bin/ansible
/usr/bin/ansible-playbook #执行ansible剧本命令

[root@m01 ~]# tree /etc/ansible/
 /etc/ansible/
 ├── ansible.cfg #ansible配置
 ├── hosts #被ansible管理的主机名单(分组)
 └── roles 

cp /etc/ansible/hosts{,.bak}
[root@m01 ~]# vim /etc/ansible/hosts #配置文件编写举例
[banana] #定义组名称
172.16.1.8
172.16.1.31
172.16.1.41
[root@m01 ~]# tail /etc/ansible/hosts

[root@m01 ~]# ansible banana -m command -a "hostname" #-m指定命令的模块 -a指定参数(action)
172.16.1.31 | SUCCESS | rc=0 >> #主机IP|请求状态|返回值(0即成功，否则失败)
nfs01       #命令输出结果
172.16.1.8 | SUCCESS | rc=0 >>
web01
172.16.1.41 | SUCCESS | rc=0 >>
backup

[root@m01 ~]# ansible banana -m ping
172.16.1.41 | SUCCESS => {
 "changed": false,
 "ping": "pong"
}
172.16.1.31 | SUCCESS => {
 "changed": false,
 "ping": "pong"
}

ansible 172.16.1.8 -m ping
172.16.1.8 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,password).\r\n",
"unreachable": true
}

连接正常返回pong通过帮助信息可以获得：
ansible-doc -v ping 可以获得该模块的说明
ansible-doc -s file 参看模块的具体信息

[root@m01 ~]# ansible-doc -v ping
 Using /etc/ansible/ansible.cfg as config file
 > PING (/usr/lib/python2.6/site-packages/ansible/modules/system/ping.py)
 A trivial test module, this module always returns `pong' on successful contact. It does not make sense in playbooks, but it is useful from `/usr/bin/ansible' to verify the ability to login and that a usable python is configured. This is NOT ICMP ping, this is just a trivial test module.

[root@m01 ~]# ansible all -m command -a "date"
172.16.1.8 | SUCCESS | rc=0 >>
Thu Oct 19 17:12:27 CST 2017
172.16.1.31 | SUCCESS | rc=0 >>
Thu Oct 19 17:12:28 CST 2017
172.16.1.41 | SUCCESS | rc=0 >>
Thu Oct 19 17:12:27 CST 2017

[root@m01 ~]# ansible banana -m command -a "chdir=/tmp pwd"
172.16.1.31 | SUCCESS | rc=0 >>
/tmp
172.16.1.8 | SUCCESS | rc=0 >>
/tmp
172.16.1.41 | SUCCESS | rc=0 >>
/tmp

[root@m01 ~]# ansible banana -m command -a "pwd creates=/tmp/banana_file"
172.16.1.31 | SUCCESS | rc=0 >>
skipped, since /tmp/banana_file exists
172.16.1.8 | SUCCESS | rc=0 >>
/root
172.16.1.41 | SUCCESS | rc=0 >>
/root

[root@m01 ~]# ansible banana -m debug -a "msg=banana"
172.16.1.8 | SUCCESS => {
 "msg": "banana"
}
172.16.1.31 | SUCCESS => {
 "msg": "banana"
}
172.16.1.41 | SUCCESS => {
 "msg": "banana"
}

[root@m01 ~]# ansible banana -m copy -a "src=/etc/hosts dest=/tmp/ mode=0600 owner=banana group=banana "
172.16.1.8 | SUCCESS => {
 "changed": true,
 "checksum": "b3c1ab140a1265cd7f6de9175a962988d93c629b",
 "dest": "/tmp/hosts",
 "gid": 500,
 "group": "banana",
 "md5sum": "8c2b120b4742a806dcfdc8cfff6b6308",
 "mode": "0600",
 "owner": "banana",
 "size": 357,
 "src": "/root/.ansible/tmp/ansible-tmp-1508410846.63-224022812989166/source",
 "state": "file",
 "uid": 500
}

[root@m01 ~]# ansible banana -m copy -a "remote_src=true src=/etc/hosts dest=/opt"

172.16.1.41 | SUCCESS => {
 "changed": false,
 "checksum": "545f587595b5c60d66243fca48e052ed34eed782",
 "dest": "/opt/hosts",
 "gid": 0,
 "group": "root",
 "md5sum": "fe08440ffebed54cab7a9b4cb3c3beda",
 "mode": "0644",
 "owner": "root",
 "size": 371,
 "src": "/etc/hosts",
 "state": "file",
 "uid": 0
}

[root@m01 ~]# ansible banana -m copy -a "content=bananaedu.com dest=/opt/banana.txt"

172.16.1.31 | SUCCESS => {
 "changed": true,
 "checksum": "291694840cd9f9c464263ea9b13421d8e74b7d00",
 "dest": "/opt/banana.txt",
 "gid": 500,
 "group": "banana",
 "md5sum": "0a6bb40847793839366d0ac014616d69",
 "mode": "0600",
 "owner": "banana",
 "size": 13,
 "src": "/root/.ansible/tmp/ansible-tmp-1508649097.07-180967115147583/source",
 "state": "file",
 "uid": 500
}

[root@m01 ~]# ansible banana -m shell -a "/bin/sh /server/scripts/ssh-key.sh"
172.16.1.31 | SUCCESS | rc=0 >> 
fenfa 172.16.1.31 [ OK ]
fenfa 172.16.1.41 [ OK ] 
fenfa 172.16.1.8 [ OK ]

[root@m01 ~]# ansible banana -m shell -a "cat /etc/hosts >/banana.txt"
172.16.1.41 | SUCCESS | rc=0 >>
172.16.1.8 | SUCCESS | rc=0 >>
172.16.1.31 | SUCCESS | rc=0 >>

[root@m01 ~]# ansible banana -m script -a "/server/scripts/ip.sh"
172.16.1.8 | SUCCESS => {
 "changed": true,
 "rc": 0,
 "stderr": "Shared connection to 172.16.1.8 closed.\r\n",
 "stdout_lines": [
  "eth0  Link encap:Ethernet HWaddr 00:0C:29:4B:16:9D ",
  "   inet addr:10.0.0.8 Bcast:10.0.0.255 Mask:255.255.255.0",
  "   UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1",
  "   RX bytes:86527 (84.4 KiB) TX bytes:76532 (74.7 KiB)",
 ]
}

[root@m01 ~]# ansible banana -m file -a "dest=/tmp/banana_dir state=directory"

172.16.1.41 | SUCCESS => {
 "changed": true,
 "gid": 0,
 "group": "root",
 "mode": "0755",
 "owner": "root",
 "path": "/tmp/banana_dir",
 "size": 4096,
 "state": "directory",
 "uid": 0
}

[root@m01 ~]# ansible banana -m file -a "dest=/tmp/banana_file state=touch"

172.16.1.8 | SUCCESS => {
 "changed": true,
 "dest": "/tmp/banana_file",
 "gid": 0,
 "group": "root",
 "mode": "0644",
 "owner": "root",
 "size": 0,
 "state": "file",
 "uid": 0
}

[root@m01 ~]# ansible banana -m yum -a "name=nmap state=installed"
172.16.1.41 | SUCCESS => {
 "changed": false,
 "msg": "",
 "rc": 0,
 "results": [
  "nmap-2:5.51-6.el6.x86_64 providing nmap is already installed"
 ]
}

[root@m01 ~]# ansible banana -m service -a "name=crond state=restarted"

172.16.1.8 | SUCCESS => {
 "changed": true,
 "name": "crond",
 "state": "started"
}

[root@m01 ~]# ansible banana -m cron -a "name=01 minute=*/5 job='/usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1'" #name识别定时任务唯一性的标识，但只管理ansible信息

172.16.1.41 | SUCCESS => {
 "changed": true,
 "envs": [],
 "jobs": [
  "None",
  "banana666"
 ]
}

[root@m01 ~]# ansible banana -m cron -a "name=None minute=*/5 job='/usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1' state=absent"
172.16.1.41 | SUCCESS => {
 "changed": true,
 "envs": [],
 "jobs": [
  "banana666"
 ]
}

[root@m01 ~]# ansible banana -m shell -a "crontab -l"
172.16.1.8 | SUCCESS | rc=0 >>
#time sync by banana at 2017-10-1
#web_backup by rsync
#*/5 * * * * /bin/sh /server/scripts/web_backup.sh &>/dev/null
#Ansible: banana666
#00 00 * * * /bin/sh /server/scripts/ip.sh &>/dev/null

[root@m01 ~]# ansible banana -m fetch -a "dest=/tmp src=/etc/hosts"
172.16.1.8 | SUCCESS => {
 "changed": true,
 "checksum": "bd9a0f82db17051a305f6a5974fa1fd95ead73d5",
 "dest": "/tmp/172.16.1.8/etc/hosts",
 "md5sum": "27b1ddf7c360698b439627b057f77d51",
 "remote_checksum": "bd9a0f82db17051a305f6a5974fa1fd95ead73d5",
 "remote_md5sum": null
}

[root@m01 ~]# ansible banana -m fetch -a "dest=/tmp/ src=/etc/hosts flat=yes"

172.16.1.41 | SUCCESS => {
 "changed": true,
 "checksum": "bcb7c85bad6008ede9e73d18ae0bb78f2b11f612",
 "dest": "/tmp/hosts",
 "md5sum": "211bd00bf9ba8a735db1c7953d7cebc4",
 "remote_checksum": "bcb7c85bad6008ede9e73d18ae0bb78f2b11f612",
 "remote_md5sum": null
}

[root@m01 ~]#ansible banana -m mount -a “fstype=nfs opts=ro src=172.16.1.31:/data path=/mnt state=mounted”
172.16.1.41 | SUCCESS => {
 "changed": true,
 "dump": "0",
 "fstab": "/etc/fstab",
 "fstype": "nfs",
 "name": "/mnt",
 "opts": "ro",
 "passno": "0",
 "src": "172.16.1.31:/data/w"
}

[root@m01 tmp]# ansible banana -m mount -a "fstype=nfs opts=ro src=172.16.1.31:/data path=/mnt state=unmounted"

 172.16.1.8 | SUCCESS => {
 "changed": false,
 "dump": "0",
 "fstab": "/etc/fstab",
 "fstype": "nfs",
 "name": "/mnt",
 "opts": "ro",
 "passno": "0",
 "src": "172.16.1.31:/data"
}

剧本的开头，可以不写
 - hosts: all  #处理所有服务器，找到所有服务器; -(空)hosts:(空)all
 tasks:  #剧本所要干的事情;          -(空)(空)task:
 - command: echo hello banana linux.
 (空)(空)(空)(空)-(空)模块名称:(空)模块中对应的功能
 ansible all -m command -a "echo hello banana linux"

 - hosts: 172.16.1.7  #处理指定服务器          -(空)hosts:(空)all
 task:  #剧本所要干的事情;             -(空)(空)task:
 - name:
 command: echo hello banana linux.         
 (空)(空)(空)(空)-(空)模块名称:(空)模块中对应的功能

[root@m01 ansible-playbook]# vim rsync_sever.yml
 
 - hosts: 172.16.1.41
  tasks:
   - name: install rsync
    yum: name=rsync state=installed

ansible-playbook --syntax-check 01.yml  进行剧本配置信息语法检查
ansible-playbook -C 01.yml  模拟剧本执行（彩排）

[root@m01 ansible-playbook]# ansible-playbook --syntax-check 01.yml
 playbook: 01.yml 

[root@m01 ansible-playbook]# ansible-playbook -C 01.yml
PLAY [all] ***************************************************************
TASK [Gathering Facts] ***************************************************************
ok: [172.16.1.41]
ok: [172.16.1.8]
ok: [172.16.1.31]
TASK [cron] ***************************************************************
ok: [172.16.1.8]
ok: [172.16.1.41]
ok: [172.16.1.31]
PLAY RECAP ***************************************************************
172.16.1.31        : ok=2  changed=0  unreachable=0  failed=0
172.16.1.41        : ok=2  changed=0  unreachable=0  failed=0
172.16.1.8         : ok=2  changed=0  unreachable=0  failed=0

 - hosts: all
  tasks:
   - name: restart-network
    cron: name='restart network' minute=00 hour=00 job='/usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1'
   - name: sync time
    cron: name='sync time' minute=*/5 job="/usr/sbin/ntpdate pool.ntp.com >/dev/null 2>&1"

 - hosts: 172.16.1.7
 tasks:
   - name: restart-network
    cron: name='restart network' minute=00 hour=00 job='/usr/sbin/ntpdate time.nist.gov >/dev/null 2>&1'
   - name: sync time
    cron: name='sync time' minute=*/5 job="/usr/sbin/ntpdate pool.ntp.com >/dev/null 2>&1"
 - hosts: 172.16.1.31
  tasks:
   - name: show ip addr to file
    shell: echo $(hostname -i) >> /tmp/ip.txt

ansible banana -m yum -a "name=rsync state=installed"

sh -x /server/scripts/test.sh

[root@backup ~]# ps -ef|grep sshd
 root   35274   1 0 15:25 ?    00:00:00 /usr/sbin/sshd
 root   37004 35274 0 16:23 ?    00:00:00 sshd: root@pts/2
 root   37062 35274 0 16:55 ?    00:00:00 sshd: root@notty
 root   37154 37006 0 16:55 pts/2  00:00:00 grep --color=auto sshd

Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.6/site-packages/ansible/plugins/callback/__init__.pyc

META: ran handlers
Using module file /usr/lib/python2.6/site-packages/ansible/modules/system/ping.py
<172.16.1.8> ESTABLISH SSH CONNECTION FOR USER: None
<172.16.1.8> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/root/.ansible/cp/923ebeb605 172.16.1.8 '/bin/sh -c '"'"'echo ~ && sleep 0'"'"''

133 Subsystem    sftp  /usr/libexec/openssh/sftp-server

[root@m01 ~]# ansible -k 172.16.1.51 -m ping
 SSH password:
 [WARNING]: No hosts matched, nothing to do 

# ansible -k 172.16.1.51 -m ping
SSH password:
172.16.1.51|FAILED! => {
"failed": true,
"msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this. Please add this host's fingerprint to your known_hosts file to manage this host."
}

yum install -y pssh <-pssh软件下载需要依靠epel源

 wget http://peak.telecommunity.com/dist/ez_setup.py
 python ez_setup.py
 wget http://parallel-ssh.googlecode.com/files/pssh-2.2.2.tar.gz
 tar zxvf pssh-2.2.2.tar.gz
 cd pssh-2.2.2
 python setup.py install

[root@server pssh-2.2.2]# vim hosts_info.txt
 172.16.1.31:22
 172.16.1.41:22
 172.16.1.7:22 //注意我的端口号不仅是默认的22

-h HOST_FILE, --hosts=HOST_FILE    hosts file (each line "[user@]host[:port]")
-o OUTDIR,   --outdir=OUTDIR     output directory for stdout files (OPTIONAL)
-P,       --print          print output as we get it

[root@server pssh-2.2.2]# pscp -h test.txt /etc/sysconfig/network /tmp/network 

[root@server ~]# pssh -h test.txt -P mkdir /tmp/etc
[root@server ~]# prsync -h test.txt -l dongwm -a -r /etc/sysconfig /tmp/etc 

[root@server ~]# pslurp -h test.txt  -L /tmp/test -l root /tmp/network test 
[1] 14:53:54 [SUCCESS] 192.168.9.102 9922
[2] 14:53:54 [SUCCESS] 192.168.9.104 9922
[root@server ~]# ll /tmp/test/192.168.9.10
192.168.9.102/ 192.168.9.104/
[root@server ~]# ll /tmp/test/192.168.9.102/
总计 4.0K
-rw-r--r-- 1 root root 60 2011-04-22 14:53 test
[root@server ~]# ll /tmp/test/192.168.9.104/
总计 4.0K
-rw-r--r-- 1 root root 60 2011-04-22 14:53 test