ansible Roles与优化

[1.include 文件包含](#1.include 文件包含)

1.nfs_server_tasks.yml

2.nfs_client_tasks.yml

3.main_nfs.yml

1.include 文件包含

当一个ansible剧本的内容过多时涉及到多个play时较为复杂时可以通过include把小的剧本拼接成大的剧本

例如我们可以将NFS 服务客户端和服务端两个剧本写到一个剧本中通过include_tasks引入

例如

1.nfs_server_tasks.yml

复制代码

---
- name: Install NFS server on CentOS
  yum:
    name: nfs-utils
    state: present

- name: Start and enable NFS service
  service:
    name: nfs-server
    state: started
    enabled: true

- name: Configure firewall for NFS on CentOS
  firewalld:
    service: nfs
    permanent: true
    state: enabled
    immediate: true

2.nfs_client_tasks.yml

复制代码

---
- name: Install NFS client on CentOS
  yum:
    name: nfs-utils
    state: present

- name: Create mount point directory on client
  file:
    path: /mnt/nfs
    state: directory

- name: Mount NFS share on client
  mount:
    name: /mnt/nfs
    src: "{{ nfs_server_ip }}:/export/nfs"
    fstype: nfs
    opts: defaults

3.main_nfs.yml

复制代码

---
- name: Configure NFS client and server on CentOS
  hosts: all
  become: true

  tasks:
    - name: Install NFS packages on server
      yum:
        name:
          - nfs-utils
          - nfs-utils-lib
          - nfs-kernel-server
      when: inventory_hostname in groups['nfs-server']

    - name: Create export directory on server
      file:
        path: /export/nfs
        state: directory
      when: inventory_hostname in groups['nfs-server']

    - name: Set up NFS server exports
      nfs_export:
        path: /export/nfs
        clients:
          - client_ip_or_network/24(rw,sync,no_subtree_check)
      when: inventory_hostname in groups['nfs-server']

    - name: Restart NFS server
      service:
        name: nfs-server
        state: restarted
      when: inventory_hostname in groups['nfs-server']

    - name: Install NFS client packages on client
      yum:
        name: nfs-utils
      when: inventory_hostname in groups['nfs-client']

  # Include tasks for NFS server configuration
  - include_tasks: nfs_server_tasks.yml
    when: inventory_hostname in groups['nfs-server']

  # Include tasks for NFS client configuration
  - include_tasks: nfs_client_tasks.yml
    when: inventory_hostname in groups['nfs-client']

2.Roles

当我们使用剧本时发现存放混乱这时候我们可以使用 Roles让文件剧本存放的更为简洁明了

实际上就是换个地方存放目录更为简洁更为规范是一种模块化思想

3.vault

加密指定文件 ansible-vault用于加密高敏感信息

hosts 加密

变量文件加密

4.Galaxy

在官网上下载别人写好的剧本进行使用十分方便简洁

5.优化

5.1性能优化

ssh连接速度优化,关闭UseDNS,GSSAPIAuthcation ...

不要让ansible运行交互式的命令，非要用使用命令的非交互模式

需要使用ans,yum安装软件,可以自建本地yum仓库,然后ans安装.(自建yum源,自己制作的rpm包)

调整ansible并发数量(-f 调整并发数量默认是5 ansible.cfq forks=5,实际调整根据负载情况。)

给ansible配置缓存(redis)队列.缓存facts.

给主机进行分组操作与管理.

关闭gather_facts,如果不用facts变量可以关闭，剧本中:qather_facts: false配置文件:gathering=explicit

关闭host,key，check 一般使用密码认证的时候需要关闭,如果不关闭 ansible配置文件host key checking = False

5.2安全

配置sudo用户 ans ALL=(ALL) NOPASSWD:ALL 密码是1,ssh端口是 22

配合vpn，jms一起使用

用户--->vpn---->ims(跳板机)---->ansible。

用户的密码,进行加密( hash，ansible-vault)