Ad-Hoc 介绍
一、什么是 ad-hoc 命令?
ad-hoc 命令是一种可以快速输入的命令,而且不需要保存起来的命令。就相当于 bash 中的一句话 shell。这也是一个好的地方,在学习 ansible playbooks 时可以先了解另外一种 ansible 基本的快速用法,不一定非要写一个 palybook 文件。
一般来说,ansible 的强大之处在于它的 playbook 剧本。但为什么我们还要使用这种临时的命令呢?
临时命令适用于下面类似的场景,如果你想在圣诞节到来之时,关掉实验室的电脑,只需要 ansible 的一行命令即可,而不必编写一个 playbook 文件来完成这个工作。
不过,对于配置管理和应用部署这种工作,还是需要使用 "/usr/bin/ansible-playbook" 命令。
1、并行和 Shell 命令
接上文,ansible 服务器已经配置好使用密钥进行认证,管理主机,如果不想使用密钥的话,那么可以使用 --ask-pass (-k) 来用密码管理。但是最好还是用密钥的方式。
如下:使用以下命令来查看 webserver 组内主机的端口开放状况:
- [root@docker ~]# ansible webserver -a 'netstat -ulntp'
- 172.17.0.3 | SUCCESS | rc=0 >>
- Active Internet connections (only servers)
- Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
- tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
- tcp6 0 0 :::22 :::* LISTEN -
- web1 | SUCCESS | rc=0 >>
- Active Internet connections (only servers)
- Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
- tcp 0 0 0.0.0.0:222 0.0.0.0:* LISTEN -
- tcp6 0 0 :::222 :::* LISTEN -
命令的最后也可以加 -f number ,表示使用的并发进程数目,默认是 5 个,如下:
- ansible webserver -a 'netstat -ulntp' -f 15
/usr/bin/ansible 默认使用当前 ansible 服务器登陆的用户来进行管理,如果你不喜欢这样,也可以使用 -u username 的方式来指定用户,如下:
注:(zhangsan 这个用户必须是被管理主机上真实存在的)
- [root@docker ~]# ansible webserver -a "w" -u zhangsan -k
如果你不想使用当前的用户来管理运行命令,也可以使用 --become -K 命令提升权限.
以上是关于 ansible 的基础,ansible 有许多的模块,以上的栗子中,没有指定模块,因为 默认的模块是 command ,如果要想使用其它模块,可以用 - m 模块名 来指定。
注:command 模块不支持扩展的 shell 语法,如使用管道和重定向。当然如果需要特殊的 shell 语法,可以使用 shell 模块来完成任务。像下面这样:
- [root@docker ~]# ansible webserver -m shell -a 'echo $TERM'
- web1 | SUCCESS | rc=0 >>
- xterm-256color
- 172.17.0.3 | SUCCESS | rc=0 >>
- xterm-256color
2、文件传输管理
这里是 / usr/bin/ansible 命令行的另外一个用例,Ansible 可以将多个文件并发的拷贝到多台机器上。使用 copy 模块,将文件直接传输到多个服务器上,如下:
- [root@docker ~]# ansible webserver -m copy -a "src=/etc/hosts dest=/tmp/hosts"
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "checksum": "ba0ed35ca3f16342b883784ec7928491d359b8ab",
- "dest": "/tmp/hosts",
- "gid": 0,
- "group": "root",
- "md5sum": "9e979f3a6509f8d829209613343f90b9",
- "mode": "0644",
- "owner": "root",
- "size": 117,
- "src": "/root/.ansible/tmp/ansible-tmp-1487773694.97-103709947729677/source",
- "state": "file",
- "uid": 0
- }
- web1 | SUCCESS => {
- "changed": true,
- "checksum": "ba0ed35ca3f16342b883784ec7928491d359b8ab",
- "dest": "/tmp/hosts",
- "gid": 0,
- "group": "root",
- "md5sum": "9e979f3a6509f8d829209613343f90b9",
- "mode": "0644",
- "owner": "root",
- "size": 117,
- "src": "/root/.ansible/tmp/ansible-tmp-1487773694.94-149872215856203/source",
- "state": "file",
- "uid": 0
- }
检查一下:
- [root@docker ~]# ansible webserver -a 'stat /tmp/hosts'
- web1 | SUCCESS | rc=0 >>
- File: '/tmp/hosts'
- Size: 117 Blocks: 8 IO Block: 4096 regular file
- Device: fc03h/64515d Inode: 25186117 Links: 1
- Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
- Access: 2017-02-22 22:28:58.946882890 +0800
- Modify: 2017-02-22 22:28:15.001562188 +0800
- Change: 2017-02-22 22:28:15.355564788 +0800
- Birth: -
- 172.17.0.3 | SUCCESS | rc=0 >>
- File: '/tmp/hosts'
- Size: 117 Blocks: 8 IO Block: 4096 regular file
- Device: fc02h/64514d Inode: 41950463 Links: 1
- Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
- Access: 2017-02-22 22:28:58.949882912 +0800
- Modify: 2017-02-22 22:28:15.041562482 +0800
- Change: 2017-02-22 22:28:15.349564744 +0800
- Birth: -
说下另外一个模块 file ,它允许更改文件的宿主以及权限,这些相同的选项同样适用 copy 模块,如下:
- [root@docker ~]# ansible webserver -m file -a "dest=/tmp/hosts mode=600"
- web1 | SUCCESS => {
- "changed": true,
- "gid": 0,
- "group": "root",
- "mode": "0600",
- "owner": "root",
- "path": "/tmp/hosts",
- "size": 117,
- "state": "file",
- "uid": 0
- }
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "gid": 0,
- "group": "root",
- "mode": "0600",
- "owner": "root",
- "path": "/tmp/hosts",
- "size": 117,
- "state": "file",
- "uid": 0
- }
更改文件的宿主以及属组:
- [root@docker ~]# ansible webserver -m file -a "dest=/tmp/hosts mode=600 owner=zhangsan group=zhangsan"
- web1 | SUCCESS => {
- "changed": true,
- "gid": 1000,
- "group": "zhangsan",
- "mode": "0600",
- "owner": "zhangsan",
- "path": "/tmp/hosts",
- "size": 117,
- "state": "file",
- "uid": 1000
- }
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "gid": 1000,
- "group": "zhangsan",
- "mode": "0600",
- "owner": "zhangsan",
- "path": "/tmp/hosts",
- "size": 117,
- "state": "file",
- "uid": 1000
- }
使用 file 模块来创建目录,类似于 mkdir -p,如下:
- [root@docker ~]# ansible webserver -m file -a "dest=/tmp/zhangsan/pp/1 mode=755 owner=zhangsan group=zhangsan state=directory"
- web1 | SUCCESS => {
- "changed": true,
- "gid": 1000,
- "group": "zhangsan",
- "mode": "0755",
- "owner": "zhangsan",
- "path": "/tmp/zhangsan/pp/1",
- "size": 6,
- "state": "directory",
- "uid": 1000
- }
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "gid": 1000,
- "group": "zhangsan",
- "mode": "0755",
- "owner": "zhangsan",
- "path": "/tmp/zhangsan/pp/1",
- "size": 6,
- "state": "directory",
- "uid": 1000
- }
以及删除目录(递归)和删除文件,如下:
- [root@docker ~]# ansible webserver -m file -a "dest=/tmp/zhangsan/pp/1 state=absent"
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "path": "/tmp/zhangsan/pp/1",
- "state": "absent"
- }
- web1 | SUCCESS => {
- "changed": true,
- "path": "/tmp/zhangsan/pp/1",
- "state": "absent"
- }
3. 软件包管理
包括 yum 和 apt,以下是一些 yum 的示例。
确保该软件包已经安装,但不要更新它,相当于检查改软件是否安装:
- [root@docker ~]# ansible webserver -m yum -a "name=vim state=present"
- 172.17.0.3 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "vim-enhanced-2:7.4.160-1.el7_3.1.x86_64 providing vim is already installed"
- ]
- }
- web1 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "vim-enhanced-2:7.4.160-1.el7_3.1.x86_64 providing vim is already installed"
- ]
- }
确保软件安装的是最新的版本,如下:
- [root@docker ~]# ansible webserver -m yum -a "name=vim state=latest"
- 172.17.0.3 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "All packages providing vim are up to date",
- ""
- ]
- }
- web1 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "All packages providing vim are up to date",
- ""
- ]
- }
确保软件没有被安装:
- [root@docker ~]# ansible webserver -m yum -a "name=vim state=absent"
4. 用户和组管理
"user" 模块允许轻松的创建和管理现有的用户账号,以及删除可能存在的用户账号,如下:
创建一个用户,并设置密码(这里的密码可以是明文,也可以是加密后的。注意安全问题)
- [root@docker ~]# ansible webserver -m user -a "name=xiaoming password=cleartext"
- web1 | SUCCESS => {
- "changed": true,
- "comment": "",
- "createhome": true,
- "group": 1001,
- "home": "/home/xiaoming",
- "name": "xiaoming",
- "password": "NOT_LOGGING_PASSWORD",
- "shell": "/bin/bash",
- "state": "present",
- "system": false,
- "uid": 1001
- }
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "comment": "",
- "createhome": true,
- "group": 1001,
- "home": "/home/xiaoming",
- "name": "xiaoming",
- "password": "NOT_LOGGING_PASSWORD",
- "shell": "/bin/bash",
- "state": "present",
- "system": false,
- "uid": 1001
- }
创建用户时使用加密后的密码来设置
先用 python 的 crypt 模块来对密码 进行加密,如:
- [root@docker ~]# python -c 'import crypt; print crypt.crypt("123456", "hello")'
- heepn6ZumUmSE
使用上述密码,创建用户:
- [root@docker ~]# ansible webserver -m user -a "name=huahua shell=/bin/bash password=heepn6ZumUmSE update_password=always"
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "comment": "",
- "createhome": true,
- "group": 1003,
- "home": "/home/huahua",
- "name": "huahua",
- "password": "NOT_LOGGING_PASSWORD",
- "shell": "/bin/bash",
- "state": "present",
- "system": false,
- "uid": 1003
- }
- web1 | SUCCESS => {
- "changed": true,
- "comment": "",
- "createhome": true,
- "group": 1003,
- "home": "/home/huahua",
- "name": "huahua",
- "password": "NOT_LOGGING_PASSWORD",
- "shell": "/bin/bash",
- "state": "present",
- "system": false,
- "uid": 1003
- }
删除用户并移除用户家目录(remove 要和 state 参数一起使用,相当于 userdel -r):
- [root@docker ~]# ansible webserver -m user -a "name=xiaoming state=absent remove=yes"
- 172.17.0.3 | SUCCESS => {
- "changed": true,
- "force": false,
- "name": "xiaoming",
- "remove": true,
- "state": "absent"
- }
- web1 | SUCCESS => {
- "changed": true,
- "force": false,
- "name": "xiaoming",
- "remove": true,
- "state": "absent"
- }
5. 从版本控制中部署程序
直接从 git 上部署 web 应用
使用 git 模块,要先保证远程主机上有 git 软件,如下所示,检查 git 已被安装:
- [root@docker ~]# ansible webserver -m yum -a "name=git state=present"
- 172.17.0.3 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "git-1.8.3.1-6.el7_2.1.x86_64 providing git is already installed"
- ]
- }
- web1 | SUCCESS => {
- "changed": false,
- "msg": "",
- "rc": 0,
- "results": [
- "git-1.8.3.1-6.el7_2.1.x86_64 providing git is already installed"
- ]
- }
确保已经安装之后,再来从 git 上拉取源码,如下:
- [root@docker ~]# ansible webserver -m git -a "repo=git://github.com/aliasmee/hello.git dest=/usr/myapp version=HEAD"
- web1 | SUCCESS => {
- "after": "f102d1927c4d42cfcca42aaa8e961be4c0b06e00",
- "before": null,
- "changed": true,
- "warnings": []
- }
- 172.17.0.3 | SUCCESS => {
- "after": "f102d1927c4d42cfcca42aaa8e961be4c0b06e00",
- "before": null,
- "changed": true,
- "warnings": []
- }
验证一下:
6. 服务管理确保 http 服务是打开的状态:
- [root@docker ~]# ansible webserver -a "ls /usr/myapp"
- 172.17.0.3 | SUCCESS | rc=0 >>
- README.md
- cpu_load.sh
- diyHttpServer.py
- look_IP.sh
- one.py
- two.txt
- web1 | SUCCESS | rc=0 >>
- README.md
- cpu_load.sh
- diyHttpServer.py
- look_IP.sh
- one.py
- two.txt
- ansible webserver -m service -a "name=httpd state=started"
重启 webserver 组内的 web 服务器:
- ansible webserver -m service -a "name=httpd state=restarted"
很遗憾,我的测试环境中,因为被管理机器都是 docker 容器,而且 ansible 的 service 模块,官方发文说现在还不支持容器的服务支持。详见此页面:https://github.com/ansible/ansible-modules-core/issues/4024
7. 收集信息
Facts 就是主机上已经发现的变量,在 playbooks 中有描述。可以用于实现指定的任务的条件或者获取特定的信息,可以通过下面来获得所有 facts:
- [root@docker ~]# ansible all -m setup
8. 脚本模块
scripts 脚本模块采用脚本名称,后面跟空格分隔的参数列表组成,如下所示:
- [root@docker ~]# ansible webserver -m script -a "/tmp/myapp/cpu_load.sh"
上面栗子中,位于本地路径的脚本将被传输到远程主机上并执行,适合本地写好的安装程序脚本,或其它自定义脚本。
好吧,模块还有很多很多,具体的只有等用到时仔细研究了,下一篇开始进入 playbooks 的学习了。新手上路,文中如果有错误的地方,还请大牛们多多指教。
来源: http://www.cnblogs.com/hanyifeng/p/6431450.html