Ansible(三)——Zabbix 监控系统部署与敏感信息加密

文章目录

剧本加密
整合zabbix
- 安装server端
- 安装agent端

剧本加密

读取外部变量文件，循环批量创建 Linux 系统用户，并设置加密密码。也就是说用userlist把用户和密码隐藏

bash 复制代码

[devops@server1 ansible]$ vim user.yml
---
- hosts: db
  gather_facts: no
  vars_files:
    - userlist.yml
  tasks:
    - name: Add the users
      ansible.builtin.user:
        name: "{{ item.user }}"
        password: "{{ item.pass | password_hash('sha512') }}"
        state: present
      loop: "{{ userlist }}"
[devops@server1 ansible]$ vim userlist.yml
---
userlist:
- {user: user1, pass: pass1}
- {user: user2, pass: pass2}
- {user: user3, pass: pass3}
[devops@server1 ansible]$ ansible-playbook user.yml --syntax-check
[devops@server1 ansible]$ ansible-playbook user.yml

给密码文件加密

bash 复制代码

[devops@server1 ansible]$ ansible-vault encrypt userlist.yml

给密码文件解密

bash 复制代码

[devops@server1 ansible]$ ansible-vault decrypt userlist.yml

playbook变量

变量文件推荐的管理方式

bash 复制代码

.
├── group_vars/                # 组变量目录
│   └── webservers/            # 针对 "webservers" 组的变量
│       ├── vars               # 纯文本变量文件（如端口、路径等）
│       └── vault              # 加密变量文件（如密码、API Key）
│
├── host_vars/                 # 主机变量目录
│   └── server2/               # 针对 "server2" 主机的变量
│       ├── vars               # 纯文本变量文件
│       └── vault              # 加密变量文件
│
├── inventory                  # 主机清单文件（定义哪些主机属于哪个组）
├── playbook.yml               # 主要的 Playbook 文件
└── haproxy.cfg.j2 / httpd.conf.j2   # Jinja2 模板文件yml
    
    
- group_vars管理主机组变量
- host_vars管理主机变量
- vars存放纯文本信息
- vault存放加密信息

存放 node 主机 的敏感变量（已加密）

bash 复制代码

[devops@server1 ansible]$ vim hosts
[web]
server2

[db]
node

[lamp:children]
web
db

[hacluster]
192.168.117.161 state=MASTER pri=100
192.168.117.162 state=BACKUP pri=80

[hacluster:vars]
interface=eth0
router_id=61
vip=192.168.117.200

[webservers]
server2
node

[webservers:vars]
http_port=80

[haproxy]
server1
[devops@server1 ansible]$ mkdir host_vars
[devops@server1 ansible]$ cd host_vars/
[devops@server1 host_vars]$ mkdir node
[devops@server1 host_vars]$ cd node
[devops@server1 node]$ cp ../../userlist.yml vault
[devops@server1 node]$ cat vault
[devops@server1 ansible]$ vim user.yml
---
- hosts: db
  gather_facts: no
    #vars_files:
    #  - userlist.yml
  tasks:
    - name: Add the users
      ansible.builtin.user:
        name: "{{ item.user }}"
        password: "{{ item.pass | password_hash('sha512') }}"
        state: present
      loop: "{{ userlist }}"
[devops@server1 node]$ ansible-vault encrypt vault
[devops@server1 node]$ cd ..
[devops@server1 host_vars]$ cd ..
[devops@server1 ansible]$ ansible-playbook user.yml --ask-vault-pass

存放 webservers 组 的非敏感变量

bash 复制代码

[devops@server1 ansible]$ vim apache.yml
---
- hosts: webservers
  #vars:
  #  http_port: 80
  tasks:
    - name: Install the Apache
      ansible.builtin.yum:
        name: httpd
        state: present
      tags: t1

    - name: Start service httpd, if not started
      ansible.builtin.service:
        name: httpd.service
        state: started
        enabled: yes
      tags: t2

    - name: create index.html
      ansible.builtin.copy:
        content: "{{ ansible_hostname }}\n"
        dest: /var/www/html/index.html
      tags: t3

          # - name: Ensure the default Apache port is {{ http_port }}
          #   ansible.builtin.lineinfile:
          #     path: /etc/httpd/conf/httpd.conf
          #     regexp: '^Listen '
          #     insertafter: '^#Listen '
          #     line: Listen {{ http_port }}
          #   notify: restart service httpd

    - name: Ensure the default Apache port is {{ http_port }}
      ansible.builtin.template:
        src: httpd.conf.j2
        dest: /etc/httpd/conf/httpd.conf
      notify: restart service httpd

  handlers:
    - name: restart service httpd
      ansible.builtin.service:
        name: httpd.service
        state: restarted
- hosts: localhost
  gather_facts: false
  become: false
  tasks:
    - name: Check that you can connect (GTE) to page and it returns a status 200
      ansible.builtin.uri:
        url: http://192.168.117.162
        return_content: true
      register: result

    - name: Print return information from the previous task
      ansible.builtin.debug:
        var: result.content
[devops@server1 ansible]$ mkdir group_vars
[devops@server1 ansible]$ cd group_vars/
[devops@server1 group_vars]$ mkdir webservers
[devops@server1 group_vars]$ cd webservers/
[devops@server1 webservers]$ vim vars
---
http_port: 80
[devops@server1 webservers]$ cd ..
[devops@server1 group_vars]$ cd ..
[devops@server1 ansible]$ vim hosts
[web]
server2

[db]
node

[lamp:children]
web
db

[hacluster]
192.168.117.161 state=MASTER pri=100
192.168.117.162 state=BACKUP pri=80

[hacluster:vars]
interface=eth0
router_id=61
vip=192.168.117.200

[webservers]
server2
node


[haproxy]
server1
[devops@server1 ansible]$ ansible-playbook apache.yml --syntax-check
[devops@server1 ansible]$ ansible-playbook apache.yml --ask-vault-pass

整合zabbix

安装server端

bash 复制代码

[devops@server1 ansible]$ ansible-galaxy collection install ansible.mysql
[devops@server1 ansible]$ vim hosts
[web]
server2

[db]
node

[lamp:children]
web
db

[hacluster]
192.168.117.161 state=MASTER pri=100
192.168.117.162 state=BACKUP pri=80

[hacluster:vars]
interface=eth0
router_id=61
vip=192.168.117.200

[webservers]
server2
node


[haproxy]
server1

[zabbix_server]
server2
[devops@server1 ansible]$ vim zabbix.yml
---
- hosts: zabbix_server
  tasks:
    - name: add zabbix repo rpm
      ansible.builtin.yum:
        name: https://repo.zabbix.com/zabbix/6.0/rhel/9/x86_64/zabbix-release-latest-6.0.el9.noarch.rpm
        state: present
        disable_gpg_check: yes

    - name: install zabbix related packages
      ansible.builtin.yum:
        name:
          - zabbix-server-mysql
          - zabbix-web-mysql
          - zabbix-apache-conf
          - zabbix-sql-scripts
          - zabbix-selinux-policy
          - zabbix-agent
        state: present

    - name: install mysql-server
      ansible.builtin.yum:
        name:
          - mysql-server
          - python3-PyMySQL
        state: present

    - name: start & enable mysqld service
      ansible.builtin.systemd:
        name: mysqld
        state: started
        enabled: yes

    - name: init zabbix database
      ansible.mysql.mysql_db:
        name: zabbix
        state: present
        encoding: utf8mb4
        collation: utf8mb4_bin
        login_user: root

    - name: create zabbix user
      ansible.mysql.mysql_user:
        name: zabbix
        state: present
        host: localhost
        password: zabbix
        priv: 'zabbix.*:ALL'

    - name: set log_bin_trust_function_creators to 1
      ansible.mysql.mysql_variables:
        variable: log_bin_trust_function_creators
        value: 1

    - name: import zabbix sql script
      ansible.builtin.shell: zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uzabbix -pzabbix zabbix && touch /etc/zabbix/.init_db_sql.lock
      args:
        creates: /etc/zabbix/.init_db_sql.lock

    - name: set log_bin_trust_function_creators to 0
      ansible.mysql.mysql_variables:
        variable: log_bin_trust_function_creators
        value: 0

    - name: modify zabbix.conf
      ansible.builtin.lineinfile:
        path: /etc/zabbix/zabbix_server.conf
        regexp: '^DBPassword='
        insertafter: '^# DBPassword='
        line: DBPassword=zabbix

    - name: enable service zabbix_server
      ansible.builtin.service:
        name: "{{ item }}"
        state: started
        enabled: yes
      loop:
        - zabbix-server
        - zabbix-agent
        - httpd
        - php-fpm

    - name: install chinese locale package glibc-langpack-zh
      ansible.builtin.dnf:
        name: glibc-langpack-zh
        state: present

[devops@server1 ansible]$ ansible-playbook zabbix.yml --syntax-check
[devops@server1 ansible]$ ansible-playbook zabbix.yml

验证：

访问：http://192.168.117.162/zabbix/

安装agent端

bash 复制代码

[devops@server1 ansible]$ vim hosts
[web]
server2

[db]
node

[lamp:children]
web
db

[hacluster]
192.168.117.161 state=MASTER pri=100
192.168.117.162 state=BACKUP pri=80

[hacluster:vars]
interface=eth0
router_id=61
vip=192.168.117.200

[webservers]
server2
node


[haproxy]
server1

[zabbix_server]
server2

[zabbix_agent]
node
[devops@server1 ansible]$ vim zabbix_agent.yml
---
- hosts: zabbix_agent
  tasks:
    - name: add Zabbix 6.0 yum repo(CentOS7)
      ansible.builtin.yum:
        name: https://repo.zabbix.com/zabbix/6.0/rhel/7/x86_64/zabbix-release-latest-6.0.el7.noarch.rpm
        state: present
        disable_gpg_check: yes

    - name: clean yum old
      ansible.builtin.command: yum clean all
      changed_when: false

    - name: install zabbix-agent
      ansible.builtin.yum:
        name: zabbix-agent
        state: present

    - name: modify agent file
      ansible.builtin.lineinfile:
        path: /etc/zabbix/zabbix_agentd.conf
        regexp: "{{ item.regex }}"
        line: "{{ item.line }}"
        backrefs: yes
      loop:
        - {regex: '^Server=', line: 'Server=192.168.117.162'}
        - {regex: '^ServerActive=', line: 'ServerActive=192.168.117.162'}
        - {regex: '^Hostname=', line: 'Hostname=node'}
      loop_control:
        label: "{{ item.line }}"

    - name: start & enable zabbix-agent
      ansible.builtin.systemd:
        name: zabbix-agent
        state: started
        enabled: yes
[devops@server1 ansible]$ ansible-playbook zabbix_agent.yml --ask-vault-pass

在网页端添加主机，成功