自动化之Ansible

likeyou~coucou2025-01-17 7:02

一、Ansible介绍

Ansible是一个同时管理多个远程主机的软件(任何可以通过SSH协议登录的机器)，因此Ansible可以管理 运程虚拟机、物理机，也可以是本地主机(linux、windows)。

Ansible通过SSH协议实现 管理节点、远程节点的通信。

只要是能够SSH登录的主机完成的操作，都可以通Ansible自动化操作，比如批量复制、批量除、批量修改、批量查看、批量安装、重启、更新等。

1.ansible是基于python语言开发的自动运维工具(由于python是解释器的特点，机器上必须要安装python运行环境)

2.ansible基于ssh协议实现安全通信。

二、ansible安装部署

1、准备机器

master-61 10.0.0.61 管理主机

web-7 10.0.0.7 web服务器

web-8 10.0.0.8 web服务器

web-9 10.0.0.9 web服务器

rsync 10.0.0.41 备份服务器

nfs 10.0.0.31 存储服务器

注：以上机器在后续中会使用到，如何创建这些机器可以看这篇教程Linux 网站架构_soft.aijiaer11.cn-CSDN博客

master-61管理主机安装ansible和python

yum install -y epel-release ansible libselinux-python

2、ansible基于公私钥认证

2.1将master-61的公钥复制到对应机器上

bash 复制代码 
[master-61 root ~] # ssh-copy-id root@10.0.0.7
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '10.0.0.7 (10.0.0.7)' can't be established.
ECDSA key fingerprint is SHA256:p+Y8oREDmNYotbNk8uqZv6KTTFKFnLhOxXp3D+Jet6Q.
ECDSA key fingerprint is MD5:d4:45:1d:1c:9f:5f:9f:8e:c7:86:d3:03:ee:f1:78:f4.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@10.0.0.7's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'root@10.0.0.9'"
and check to make sure that only the key(s) you wanted were added.

另外两台机器也是一样的
[master-61 root ~] # ssh-copy-id root@10.0.0.8
[master-61 root ~] # ssh-copy-id root@10.0.0.9

2.2 配置.ssh/config 配置文件，方便ssh登录

bash 复制代码 
[master-61 root ~] # cat .ssh/config 
Host web-7
  HostName 10.0.0.7
  User root
  Port 22
  IdentityFile ~/.ssh/id_rsa

Host web-8
  HostName 10.0.0.8
  User root
  Port 22
  IdentityFile ~/.ssh/id_rsa

Host web-9
  HostName 10.0.0.8
  User root
  Port 22
  IdentityFile ~/.ssh/id_rsa

2.3 测试是否免密登录成功

bash 复制代码 
[master-61 root ~] # ssh web-7
Last login: Thu Jan  9 15:40:38 2025 from 172.16.1.61
[web-7 root ~] # exit
logout
Connection to 10.0.0.7 closed.
[master-61 root ~] # ssh web-8
Last login: Thu Jan  9 15:40:37 2025 from 172.16.1.61
[web-8 root ~] # exit
logout
Connection to 10.0.0.8 closed.
[master-61 root ~] # ssh web-9
Last login: Thu Jan  9 15:40:36 2025 from 172.16.1.61
[web-9 root ~] # exit
logout
Connection to 10.0.0.9 closed.
[master-61 root ~] #

3、配置ansible主机清单文件

bash 复制代码 
[master-61 root ~] # cat  /etc/ansible/hosts
[web]
172.16.1.7
172.16.1.8
172.16.1.9

[nfs]
172.16.1.31

[backup]
172.16.1.41

ansible管理所有主机组(all)，管理对应主机组（定义的主机组名如：web,nfs,bakcup）

ansible 语法

ansible <组名> -m <模块> -a <参数列表>

nfs和backup主机没有开机所以执行报错了

4、基于密码认证

ansible主机清单配置文件语法

https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html#connecting-to-hosts-behavioral-inventory-parameters

参数 参数类型 参数说明
ansible_host 主机地址 远程主机ip
ansible_port 主机端口 设置SSH连接端口，默认22
ansible_user 主机用户 默认SSH远程连接的用户身份
ansible_password 用户密码 指定SSH远程主机密码

4.1给rsync机器，添加密码，端口信息

bash 复制代码 
[master-61 root ~] # tail -2  /etc/ansible/hosts
[backup]
172.16.1.41  ansible_port=22  ansible_user=root ansible_password='1' 

如果被管理主机更改l用户，密码，端口,这里也需要更改成相同的

测试执行

bash 复制代码 
[master-61 root ~] # ansible backup -m ping
172.16.1.41 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

4.2添加web机器组的信息

bash 复制代码 
[master-61 root ~] # cat  /etc/ansible/hosts
[web]
172.16.1.7 ansible_port=22 ansible_user=root ansible_password=1
172.16.1.8 ansible_port=22 ansible_user=root ansible_password=1
172.16.1.9 ansible_port=22 ansible_user=root ansible_password=1


测试是否能通
[master-61 root ~] # ansible web -m ping
172.16.1.7 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.8 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.9 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

4.3 ansible故障问题解决

如果出现机器的指纹问题确认，如下

复制代码 
[master-61 root ~] # ansible web -m ping
172.16.1.7 | FAILED! => {
    "msg": "Using a SSH password instead of a key is not possible because Host Key checking is enabled and sshpass does not support this.  Please add this host's fingerprint to your known_hosts file to manage this host."
}
172.16.1.8 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.9 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

解决办法1，手动ssh连接，进行指纹确认，写入到本机的

bash 复制代码 
[master-61 root ~] # ssh root@172.16.1.7
The authenticity of host '172.16.1.7 (172.16.1.7)' can't be established.
ECDSA key fingerprint is SHA256:p+Y8oREDmNYotbNk8uqZv6KTTFKFnLhOxXp3D+Jet6Q.
ECDSA key fingerprint is MD5:d4:45:1d:1c:9f:5f:9f:8e:c7:86:d3:03:ee:f1:78:f4.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.1.7' (ECDSA) to the list of known hosts.
root@172.16.1.7's password: 
Last login: Fri Jan 10 09:35:07 2025 from 172.16.1.61
[web-7 root ~] # exit
logout
Connection to 172.16.1.7 closed.
[master-61 root ~] # ansible web -m ping
172.16.1.9 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.8 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.7 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

解决办法2，ansible配置文件中忽略指纹确认

bash 复制代码 
将配置文件中注释取消掉
[master-61 root ~] # grep 'host_key_checking' /etc/ansible/ansible.cfg
#host_key_checking = False
[master-61 root ~] #

4.4 公共变量配置

当主机清单里，很多主机组，有相同的变量属性，可以写成公共变量

bash 复制代码 
[master-61 root ~] # vim /etc/ansible/hosts
[web:vars]
ansible_port=22
ansible_user=root
ansible_password=1

[web]
172.16.1.7
172.16.1.8
172.16.1.9

[master-61 root ~] # ansible web -m ping
172.16.1.7 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}
172.16.1.8 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

ansible远程执行命令

bash 复制代码 
在web的所有机器/opt/目录下创建test1.txt文件
[master-61 root ~] # ansible web -m shell -a "touch /opt/test1.txt"
[WARNING]: Consider using the file module with state=touch rather than running 'touch'.  If you need
to use command because file is insufficient you can add 'warn: false' to this command task or set
'command_warnings=False' in ansible.cfg to get rid of this message.
172.16.1.8 | CHANGED | rc=0 >>

172.16.1.9 | CHANGED | rc=0 >>

172.16.1.7 | CHANGED | rc=0 >>

[master-61 root ~] #

三、ansible命令执行方式（主要）

ansible执行命令结果（状态颜色）

命令成功：

绿色：命令以用户期望的执行了，但是状态没有发生改变；

黄色：命令以用户期望的执行了，并且状态发生了改变；

命令没有执行成功：

紫色：警告信息，说明ansible提示你有更合适的用法；出现了warning警告

红色：命令错误，执行失败；

蓝色： 详细的执行过程；

1、ansible命令

语法：

ansible <host-pattern> -m <module> -a "<module-arguments>"

<host-pattern>：指定主机或主机组，可以是单个主机、主机组或模式（如 all、web、db）。

-m <module>：指定 Ansible 模块，比如 ping、command、copy 等。

-a "<module-arguments>"：指定模块的参数。

command模块是ansible默认的模块，也就是默认就指定了 -m command。

该模块作用：在远程节点上执行一个命令

执行 command 模块，获取 web 主机组中主机的主机名

ansible web -m command -a "hostname"

2、ansible-playbook 命令

用于运行 Ansible Playbook，Playbook 是一组预定义的任务，它描述了如何配置远程主机。

语法：

ansible-playbook <playbook.yml> options

<playbook.yml>：指定要执行的 playbook 文件。

options：可选参数，如 -i 指定库存文件，-u 指定用户等。

3、ansible-inventory 命令

用于查看和管理 Ansible 的库存（inventory）。可以列出、检查库存的内容，以及验证库存文件的格式。

语法：

ansible-inventory options

图形化的方式展示主机和组的关系；列出所有的主机组

ansible-inventory --graph

ansible-inventory --list

4、ansible-galaxy 命令

用于管理 Ansible Galaxy 上的角色和集合。可以使用它来安装、创建和管理 Ansible 角色

语法：

ansible-galaxy <command> options

5、ansible-doc 命令

用于查看 Ansible 模块的文档。

语法：

ansible-doc <module>

6、ansible-vault 命令

用于加密和解密敏感信息（如密码）。它允许你安全地管理 playbook 中的敏感数据

语法：

ansible-vault <command> options

master-61 root \~ # ansible-vault -help

usage: ansible-vault -h --version -v

{create,decrypt,edit,view,encrypt,encrypt_string,rekey}

...

ansible-vault: error: argument -h/--help: ignored explicit argument u'elp'

7、ansible-console 命令

ansible-console 提供了一个交互式命令行界面，可以在其中执行 Ansible 模块命令，非常适合调试和快速执行

语法：

ansible-console

执行后会出现很多的命令

8、ansible-config 命令

用于查看和管理 Ansible 配置。可以检查当前的配置设置，或者创建和编辑自定义的配置文件

语法：

ansible-config <command> options

列出所有的 Ansible 配置选项，截图只截取了一部分

四、ansible模块

1、command 命令模块

ansible.buildin.command 模块 -- 在目标上执行命令 --- Ansible 社区文档https://docs.ansible.com/ansible/latest/collections/ansible/builtin/command_module.html#ansible-collections-ansible-builtin-command-module

该模块作用：在远程节点上执行一个命令

command模块是ansible默认的模块，也就是默认就指定了 -m command

只支持简单命令命令执行，比如你想远程看下服务器的资源信息，普通的linux命令

command模块是ansible命令基本模块

使用command模块执行远程命令，命令不得用变量（$HOME）

不得出现特殊符号

< 、>、|、；、&

远程查看web主机内存

ansible web -a "free -m"

远程创建文件、查看文件

ansible web -m command -a "touch /opt/haha.log"

ansible web -m command -a "cat /opt/haha.log"

远程获取机器负载

ansible web -a "uptime"

关闭告警信息，执行不会出现WARNING警告

command提供的专有命令

这些命令用于编写ansible-playbook，完成服务器部署的各种复杂条件限定。

选项参数 选项说明
chdir 在执行命令执行，通过cd命令进入指定目录
creates 定义一个文件是否存在，若不存在，则运行相应命令；存在则跳过
free_form（必须） 参数信息中可以输入任何系统命令，实现远程管理
removes 定义一个文件是否存在，如果存在，则运行相应命令；如果不存在则跳过

2、shell 命令模块（万能模块）

ansible.builtin.shell module -- Execute shell commands on targets --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/builtin/shell_module.html#ansible-collections-ansible-builtin-shell-modulev

shell模块可以识别特殊符号，就等于远程执行命令

远程过滤ssh进程信息

ansible web -m shell -a "ps -ef|grep ssh"

使用重定向符号，创建文件

远程获取时间信息，且写入到文件中

command模块就没法使用重定向

ansible web -m command -a "date > /tmp/date.log"

远程执行复杂的Linux命令

  • 创建文件夹

  • 生成sh脚本文件(查看主机名)

  • 赋予脚本可执行权限

  • 执行脚本

  • 忽略warning信息

ansible web -m shell -a "mkdir /0110/;echo 'hostname' > /0110/hostname.sh;chmod +x /0110/hostname.sh;/0110/hostname.sh; warn=false"

3、copy命令模块

copy模块是远程推送数据模块，只能把数据推送给远程主机节点，无法拉取数据到本地。

语法：ansible 主机组 -m copy -a "参数"

src 地文件或目录的路径

dest 目标主机上的文件或目录路径

mode 文件的权限模式（类似于 chmod）

owner 设置目标文件的拥有者，可以是用户名或用户ID

group 设置目标文件的所属组，可以是组名或组ID

backup 是否在文件复制之前备份目标文件

force 是否强制复制文件，忽略现有文件是否相同

recurse 是否递归复制目录

directory_mode 当复制一个目录时，设置目标目录的权限

3.1 发送文件到对应机器目录

bash 复制代码 
[master-61 root ~] # ansible web -m copy -a "src=/tmp/61-dnf.log dest=/tmp/web-dnf.log"
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "88da829f8dad48fa08e9328591dda9db", 
    "mode": "0644", 
    "owner": "root", 
    "size": 5, 
    "src": "/root/.ansible/tmp/ansible-tmp-1736494608.32-11558-63842889014971/source", 
    "state": "file", 
    "uid": 0
}
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "88da829f8dad48fa08e9328591dda9db", 
    "mode": "0644", 
    "owner": "root", 
    "size": 5, 
    "src": "/root/.ansible/tmp/ansible-tmp-1736494608.32-11555-248987136082372/source", 
    "state": "file", 
    "uid": 0
}
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "88da829f8dad48fa08e9328591dda9db", 
    "mode": "0644", 
    "owner": "root", 
    "size": 5, 
    "src": "/root/.ansible/tmp/ansible-tmp-1736494608.27-11554-90016176294629/source", 
    "state": "file", 
    "uid": 0
}
[master-61 root ~] #
bash 复制代码 
[web-7 root ~] # ls /tmp/web-dnf.log -l
-rw-r--r-- 1 root root 5 Jan 10 15:36 /tmp/web-dnf.log

[web-8 root ~] # ls /tmp/web-dnf.log -l
-rw-r--r-- 1 root root 5 Jan 10 15:36 /tmp/web-dnf.log

[web-9 root ~] # ls /tmp/web-dnf.log -l
-rw-r--r-- 1 root root 5 Jan 10 15:36 /tmp/web-dnf.log

3.2 发送文件且指定文件属性，权限改为600，修改为www用户

bash 复制代码 
先创建用户
[master-61 root ~] # ansible web -m user -a "name=www state=present"
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "comment": "", 
    "create_home": true, 
    "group": 1000, 
    "home": "/home/www", 
    "name": "www", 
    "shell": "/bin/bash", 
    "state": "present", 
    "system": false, 
    "uid": 1000
}
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "comment": "", 
    "create_home": true, 
    "group": 1000, 
    "home": "/home/www", 
    "name": "www", 
    "shell": "/bin/bash", 
    "state": "present", 
    "system": false, 
    "uid": 1000
}
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "comment": "", 
    "create_home": true, 
    "group": 1000, 
    "home": "/home/www", 
    "name": "www", 
    "shell": "/bin/bash", 
    "state": "present", 
    "system": false, 
    "uid": 1000
}


修改所属主为www和文件权限为600
[master-61 root ~] # ansible web -m copy -a "src=/tmp/61-dnf.log dest=/tmp/web-dnf.log group=www owner=www mode=600"
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}

远程检查文件信息

3.3 发送文件且先做好备份

bash 复制代码 
[master-61 root ~] # ansible web -m copy -a "src=/tmp/61-dnf.log  dest=/tmp/web-dnf.log backup=yes"
172.16.1.9 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}
172.16.1.8 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}
172.16.1.7 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "checksum": "48579c730bab923a58386c5cb48fe95a025dd4be", 
    "dest": "/tmp/web-dnf.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0600", 
    "owner": "www", 
    "path": "/tmp/web-dnf.log", 
    "size": 5, 
    "state": "file", 
    "uid": 1000
}

4、 file文件操作模块

file模块主要用于创建文件、目录数据，以及对现有的文件、目录权限进行修改对文件属性各种操作。

file专门用于在远程机器上，关于文件的所有操作

官网：

ansible.builtin.file module -- Manage files and file properties --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/modules/file_module.html#file-module

命令查看帮助

ansible-doc -s file

file文件模块主要参数

path(必填) 指定文件、目录或符号链接的路径。

state (必填) 定义文件或目录的目标状态

mode 设置文件的权限模式，类似于 chmod 命令中的权限设置

owner 设置文件或目录的所有者。

group 设置文件或目录的用户组

4.1 远程在web服务器中，创建一个文本hello_ansible.log

bash 复制代码 
[master-61 root ~] # ansible web -m file -a "path=/opt/hello_ansible.log state=touch"
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello_ansible.log", 
    "gid": 0, 
    "group": "root", 
    "mode": "0644", 
    "owner": "root", 
    "size": 0, 
    "state": "file", 
    "uid": 0
}
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello_ansible.log", 
    "gid": 0, 
    "group": "root", 
    "mode": "0644", 
    "owner": "root", 
    "size": 0, 
    "state": "file", 
    "uid": 0
}
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello_ansible.log", 
    "gid": 0, 
    "group": "root", 
    "mode": "0644", 
    "owner": "root", 
    "size": 0, 
    "state": "file", 
    "uid": 0
}

4.2 远程创建文件夹

bash 复制代码 
[master-61 root ~] # ansible web -m file -a "path=/opt/hello_ansible state=directory"
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "gid": 0, 
    "group": "root", 
    "mode": "0755", 
    "owner": "root", 
    "path": "/opt/hello_ansible", 
    "size": 6, 
    "state": "directory", 
    "uid": 0
}
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "gid": 0, 
    "group": "root", 
    "mode": "0755", 
    "owner": "root", 
    "path": "/opt/hello_ansible", 
    "size": 6, 
    "state": "directory", 
    "uid": 0
}
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "gid": 0, 
    "group": "root", 
    "mode": "0755", 
    "owner": "root", 
    "path": "/opt/hello_ansible", 
    "size": 6, 
    "state": "directory", 
    "uid": 0
}

4.3 创建文件且设定所属组和文件权限

bash 复制代码 
[master-61 root ~] # ansible web -m file -a "path=/opt/hello-test.log state=touch owner=www group=www mode=777"
172.16.1.8 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello-test.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0777", 
    "owner": "www", 
    "size": 0, 
    "state": "file", 
    "uid": 1000
}
172.16.1.9 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello-test.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0777", 
    "owner": "www", 
    "size": 0, 
    "state": "file", 
    "uid": 1000
}
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/hello-test.log", 
    "gid": 1000, 
    "group": "www", 
    "mode": "0777", 
    "owner": "www", 
    "size": 0, 
    "state": "file", 
    "uid": 1000
}

file模块中playbook写法，yaml写法

ansible.builtin.file module -- Manage files and file properties --- Ansible Community Documentation

5、script脚本模块

script模块的功能参数

选项参数 选项说明
creates 定义一个文件是否存在，若不存在，则运行相应命令；存在则跳过
free_form（必须） 参数信息中可以输入任何系统命令，实现远程管理
removes 定义一个文件是否存在，如果存在，则运行相应命令；如果不存在则跳过

例如：打印一下基本的信息，脚本如下

bash 复制代码 
[master-61 root ~] # ansible web -m script -a "/root/server_info.sh"
172.16.1.9 | CHANGED => {
    "changed": true, 
    "rc": 0, 
    "stderr": "Shared connection to 172.16.1.9 closed.\r\n", 
    "stderr_lines": [
        "Shared connection to 172.16.1.9 closed."
    ], 
    "stdout": "", 
    "stdout_lines": []
}
172.16.1.7 | CHANGED => {
    "changed": true, 
    "rc": 0, 
    "stderr": "Shared connection to 172.16.1.7 closed.\r\n", 
    "stderr_lines": [
        "Shared connection to 172.16.1.7 closed."
    ], 
    "stdout": "", 
    "stdout_lines": []
}
172.16.1.8 | CHANGED => {
    "changed": true, 
    "rc": 0, 
    "stderr": "Shared connection to 172.16.1.8 closed.\r\n", 
    "stderr_lines": [
        "Shared connection to 172.16.1.8 closed."
    ], 
    "stdout": "", 
    "stdout_lines": []
}

cat查看对应的log内容

查看命令执行的详细过程

-vvvvv参数显示详细过程，v越多，越详细

bash 复制代码 
[master-61 root ~] # ansible web -v  -m shell -a "free -h"
Using /etc/ansible/ansible.cfg as config file
172.16.1.9 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        131M        1.7G        9.5M        101M        1.7G
Swap:            0B          0B          0B
172.16.1.8 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        130M        1.7G        9.5M        100M        1.7G
Swap:            0B          0B          0B
172.16.1.7 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        132M        1.7G        9.5M        103M        1.7G
Swap:            0B          0B          0B
[master-61 root ~] # ansible web -vv  -m shell -a "free -h"
ansible 2.9.27
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Jun 28 2022, 15:30:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]
Using /etc/ansible/ansible.cfg as config file
Skipping callback 'actionable', as we already have a stdout callback.
Skipping callback 'counter_enabled', as we already have a stdout callback.
Skipping callback 'debug', as we already have a stdout callback.
Skipping callback 'dense', as we already have a stdout callback.
Skipping callback 'dense', as we already have a stdout callback.
Skipping callback 'full_skip', as we already have a stdout callback.
Skipping callback 'json', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'null', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.
Skipping callback 'selective', as we already have a stdout callback.
Skipping callback 'skippy', as we already have a stdout callback.
Skipping callback 'stderr', as we already have a stdout callback.
Skipping callback 'unixy', as we already have a stdout callback.
Skipping callback 'yaml', as we already have a stdout callback.
META: ran handlers
172.16.1.7 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        132M        1.7G        9.5M        103M        1.7G
Swap:            0B          0B          0B
172.16.1.8 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        130M        1.7G        9.5M        100M        1.7G
Swap:            0B          0B          0B
172.16.1.9 | CHANGED | rc=0 >>
              total        used        free      shared  buff/cache   available
Mem:           1.9G        133M        1.7G        9.5M        101M        1.7G
Swap:            0B          0B          0B
META: ran handlers
META: ran handlers
[master-61 root ~] #

6、cron定时任务模块

官网文档：

https://docs.ansible.com/ansible/latest/modules/cron_module.html#cron-modulehttps://docs.ansible.com/ansible/latest/modules/cron_module.html#cron-module

cron模块用于管理定时任务的记录，编写任务

定时任务的记录，语法格式

* * * * * 要执行的命令

主要参数

name (必填) 定时任务的名称，通常是对任务的描述

job (必填) 指定要执行的命令或脚本

minute 指定定时任务的分钟部分，取值范围为 0-59

hour 指定定时任务的小时部分，取值范围为 0-23

day 指定定时任务的日期部分，取值范围为 1-31

month 指定定时任务的月份部分，取值范围为 1-12

weekday 指定定时任务的星期几部分，取值范围为 0-7，其中 0 和 7 都代表星期天

state 指定定时任务的状态

user 指定哪个用户的 crontab 中创建或修改该任务

添加ntpdate定时任务

添加每5分钟执行一次和阿里云时间同步

*/5 * * * * ntpdate -u ntp.aliyun.com

ansible nfs -m cron -a "name='ntp aliyun' minute=*/5 job='ntpdate -u ntp.aliyun'"

删除定时任务

ansible nfs -m cron -a "name='ntp aliyun' state=absent"

创建没分钟执行的任务；修改指定名称的定时任务

ansible nfs -m cron -a "name='test' job='echo "hello-world" >>/tmp/hello.log'"

ansible nfs -m cron -a "name='test' minute=30 hour=23 job='echo "hello-world" >>/tmp/hello.log'"

7、group模块

管理系统用户组的模块

官方文档：

ansible.builtin.group module -- Add or remove groups --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/builtin/group_module.html#group

模块参数 参数描述

name 创建指定的组名

gid 组的GID

state absent，移除远程主机的组

present，创建远端主机的组

创建nfs_ops组，gid=1234

ansible nfs -m group -a "name=nfs_ops gid=1234"

删除组

ansible nfs -m group -a "name=nfs_ops gid=1234 state=absent"

8、user用户模块

用户管理，也就是关于用户的

  • uid

  • 用户名

  • 用户主组

  • 用户附加组

  • 创建用户

  • 删除用户

  • 创建关于用户的公私钥

  • 用户过期时间

  • 用户密码过期时间

官网文档：

ansible.builtin.user module -- Manage user accounts --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/builtin/user_module.html#user-module

语法参数：

模块参数 参数描述
create_home 创建家目录，设置no则不创建家目录
group 创建用户组
name 创建用户的名字
password 创建用户的密码
uid 创建用户的UID
shell 用户登录解释器
state Absent（删除用户）present（默认参数，创建）
expires 账户过期时间

8.1创建一个test01用户，uid为8888

ansible nfs -m user -a "name=test01 uid=8888"

8.2创建test02用户，用户组，以及设置权限

bash 复制代码 
[master-61 root ~] # ansible nfs -m group -a "name=test02 gid=1999"
172.16.1.31 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "gid": 1999, 
    "name": "test02", 
    "state": "present", 
    "system": false
}
[master-61 root ~] # ansible nfs -m user -a "name=test02 uid=1999 group=1999 create_home=no shell=/sbin/nologin"
172.16.1.31 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "comment": "", 
    "create_home": false, 
    "group": 1999, 
    "home": "/home/test02", 
    "name": "test02", 
    "shell": "/sbin/nologin", 
    "state": "present", 
    "system": false, 
    "uid": 1999
}

[master-61 root ~] # ansible nfs -m shell -a "id test02"
172.16.1.31 | CHANGED | rc=0 >>
uid=1999(test02) gid=1999(test02) groups=1999(test02)
[master-61 root ~] #

9、yum模块

yum模块就是一个专门用于管理软件的模块。

官方文档：

ansible.builtin.yum_repository module -- Add or remove YUM repositories --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_repository_module.html#ansible-collections-ansible-builtin-yum-repository-module

语法参数：

name 安装、升级或卸载的软件包的名称，可以是单个包名，也可以是包名列表

state present：确保包已安装。如果包未安装，会进行安装。

absent：确保包已卸载。如果包安装了，会被卸载。

latest：确保包已安装最新版本。如果当前安装的版本不是最新，进行升级

list 用于列出软件包的状态

installed：列出已安装的软件包。

updates：列出可用的更新包。

available：列出可安装的包

安装和卸载net-tools最新版本

ansible backup -m yum -a "name=net-tools state=latest"

ansible backup -m yum -a "name=net-tools state=absent"

10、mount挂载模块

官方文档：

ansible.posix.mount module -- Control active and configured mount points --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/posix/mount_module.html#mount-

参数：

mounted 挂载设备且写入fstab

present 仅写入fstab 不挂载

absent 卸载且删除fstab记录

umounted 只卸载不删除fstab记录

给web-7机器挂载nfs目录（立即挂载且写入/etc/fstab）

bash 复制代码 
[master-61 root ~] # ansible web -m mount -a "src='172.16.1.31:/nfs-data' path=/nfs-test fstype=nfs state=mounted"

172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dump": "0", 
    "fstab": "/etc/fstab", 
    "fstype": "nfs", 
    "name": "/nfs-test", 
    "opts": "defaults", 
    "passno": "0", 
    "src": "172.16.1.31:/nfs-data"
}


[master-61 root ~] # ansible web -a "df -h"
172.16.1.7 | CHANGED | rc=0 >>
Filesystem               Size  Used Avail Use% Mounted on
devtmpfs                 979M     0  979M   0% /dev
tmpfs                    991M     0  991M   0% /dev/shm
tmpfs                    991M  9.6M  981M   1% /run
tmpfs                    991M     0  991M   0% /sys/fs/cgroup
/dev/mapper/centos-root   37G  2.0G   35G   6% /
/dev/sda1               1014M  140M  875M  14% /boot
tmpfs                    199M     0  199M   0% /run/user/0
172.16.1.31:/nfs-data     37G  2.1G   35G   6% /nfs-test


[master-61 root ~] # ansible web -a "cat /etc/fstab"
172.16.1.7 | CHANGED | rc=0 >>

#
# /etc/fstab
# Created by anaconda on Mon Dec  2 16:09:14 2024
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
UUID=be2d80b1-e200-4660-9df5-23fcd50e25cb /boot                   xfs     defaults        0 0
#/dev/mapper/centos-swap swap                    swap    defaults        0 0
172.16.1.31:/nfs-data /nfs-test nfs defaults 0 0

取消挂载，只需要把state的mounted改成absent即可

11、archive压缩模块

官方文档：

community.general.archive module -- Creates a compressed archive of one or more files or trees --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/community/general/archive_module.html

支持压缩类型

bz2

gz ← (default)

tar

xz

zip

压缩/etc配置文件到指定路径

bash 复制代码 
[master-61 root ~] # ansible web -m archive -a "path=/etc dest=/opt/etc.tgz"
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "archived": [
......
   ], 
    "arcroot": "//", 
    "changed": true, 
    "dest": "/opt/etc.tgz", 
    "expanded_exclude_paths": [], 
    "expanded_paths": [
        "/etc"
    ], 
    "gid": 0, 
    "group": "root", 
    "missing": [], 
    "mode": "0644", 
    "owner": "root", 
    "size": 10278190, 
    "state": "file", 
    "uid": 0
}


检查是否压缩成功
[master-61 root ~] # ansible web -a "ls /opt -l"
172.16.1.7 | CHANGED | rc=0 >>
total 10044
-rw-r--r-- 1 root root 10278190 Jan 16 15:24 etc.tgz

[master-61 root ~] # ansible web -a "file /opt/etc.tgz"
172.16.1.7 | CHANGED | rc=0 >>
/opt/etc.tgz: gzip compressed data, was "/opt/etc.tgz", last modified: Thu Jan 16 15:24:14 2025, max compression

12、unarchive解压缩模块

官网文档：

ansible.builtin.unarchive module -- Unpacks an archive after (optionally) copying it from the local machine --- Ansible Community Documentationhttps://docs.ansible.com/ansible/latest/collections/ansible/builtin/unarchive_module.html#examples

解压缩etc.tgz到指定目录（远程解压）

remote_src远程数据源

bash 复制代码 
检查指定目录必须存在
[master-61 root ~] # ansible web -m file -a "path=/opt/etc_file state=directory"
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "gid": 0, 
    "group": "root", 
    "mode": "0755", 
    "owner": "root", 
    "path": "/opt/etc_file", 
    "size": 6, 
    "state": "directory", 
    "uid": 0
}


解压缩etc.tgz
[master-61 root ~] # ansible web -m unarchive -a "src=/opt/etc.tgz dest=/opt/etcfile/ remote_src=yes"
172.16.1.7 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "dest": "/opt/etcfile/", 
    "extract_results": {
        "cmd": [
            "/usr/bin/gtar", 
            "--extract", 
            "-C", 
            "/opt/etcfile/", 
            "-z", 
            "-f", 
            "/opt/etc.tgz"
        ], 
        "err": "", 
        "out": "", 
        "rc": 0
    }, 
    "gid": 0, 
    "group": "root", 
    "handler": "TgzArchive", 
    "mode": "0755", 
    "owner": "root", 
    "size": 17, 
    "src": "/opt/etc.tgz", 
    "state": "directory", 
    "uid": 0
}


查看是否解压缩成功
[master-61 root ~] # ansible web -a "ls /opt/etcfile/etc/"
172.16.1.7 | CHANGED | rc=0 >>
adjtime
......
相关推荐
大树883 天前
金刚石散热越强，管路越先见顶
大数据·运维·服务器·人工智能·ai
摇滚侠3 天前
Linux CentOS7 rpm 安装 MySQL 5.7
linux·运维·mysql
霸道流氓气质3 天前
领域驱动设计（DDD）在 Spring Boot 微服务中的实践指南
运维·spring boot·微服务
Inhand陈工3 天前
基于台达PLC与映翰通IG502的智慧水产养殖精准投喂与远程运维解决方案
运维·人工智能·物联网·阿里云·信息与通信
酣大智3 天前
ARP代理--工作原理
运维·网络·arp·arp代理
shushangyun_3 天前
2026年快消品B2B系统推荐：支持终端门店订货、促销政策自动化的工具？
java·运维·网络·数据库·人工智能·spring·自动化
施努卡机器视觉3 天前
SNK施努卡侧滑门锁上滑轮总成自动化装配线，从零件到组件，全流程精密制造方案
运维·自动化·制造
dayuOK63073 天前
写作卡壳怎么办？我的“5分钟启动法”
人工智能·职场和发展·自动化·新媒体运营·媒体
AC赳赳老秦3 天前
用 OpenClaw 搭建服务器故障应急响应系统，自动处理 80% 常见运维故障
android·运维·服务器·python·rxjava·deepseek·openclaw
java_cj3 天前
深入kube-apiserver认证机制：从Bearer Token到mTLS的完整认证链解析
linux·运维·服务器·云原生·容器·kubernetes
热门推荐
012026年6月AI行业全景：从百模大战到Agent元年，这30天发生了什么？022026年6月AI大模型全景报告：GPT-5.6、Claude Opus 4.8、Gemini 3.5，中美AI三足鼎立谁主沉浮？032026 年 AI 编程工具终极横评：Cursor vs Claude Code vs Copilot vs Windsurf04【AI】2026 年具身智能模型和世界模型总结05GitHub 镜像站点06AI科技热点日报 | 2026年6月1日072026 AI 编程工具终极实战指南：Cursor vs Claude Code vs Copilot，开发者该怎么选？08AI一周事件 · 2026-06-03 至 2026-06-0909Claude Code、Codex、Cursor三分天下：2026年AI编程Agent生态全景剖析10上线仅72小时被强制下架：Claude Fable 5 的短命