Ansible安装配置

Ansible安装配置

官方网站：

http://docs.ansible.com/ansible/intro_installation.html

简介：

Ansible by default manages machines over the SSH protocol. 

Once Ansible is installed, it will not add a database, and there will be no daemons to start or keep running. You only need to install it on one machine (which could easily be a laptop) and it can manage an entire fleet of remote machines from that central point. When Ansible manages remote machines, it does not leave software installed or running on them, so there’s no real question about how to upgrade Ansible when moving to a new version.

依赖SSH,无需安装任何daemon,database,agent,无需考虑升级ansible,很适合跳板机.

目前授控主机不支持windows,支持装有python2.6-2.7(目前不支持python3)的Unix-like操作系统

目前被收编到开源领袖红帽麾下

	Puppet	Saltstack	ansible
开发语言	Ruby	Python	Python
是否有客户端	有	有	无
是否支持二次开发	不支持	支持	支持
服务器与远程机器是否相互验证	是	是	是
服务器与远程机器通信是否加密	是，标准 SSL 协议	是，使用 AES 加密	是，使用 OpenSSH
平台支持	支持 AIX、BSD、HP-UX、Linux、 MacOSX、Solaris、 Windows	支持 BSD、Linux、Mac OS X、Solaris、 Windows	支持 AIX、BSD、 HP-UX、 Linux、Mac OSX、Solaris
是否提供 web ui	提供(Forman,PuppetDashboard)	提供	商业版(Ansible Tower)
配置文件格式	Ruby 语法格式	YAML	YAML
命令行执行	不支持，但可通过配置模块实现	支持	支持

环境：

CentOS7.1 x64

安装：

方式一:yum安装

cat >/etc/yum.repos.d/ansible.repo <<HERE

[epel]

name=epel

baseurl=http://mirrors.sohu.com/fedora-epel/7/x86_64/

gpgcheck=0

enabled=1

HERE

yum -y install ansible

提示：官方建议，如果使用tower管控，请使用包管理器或pip安装

还可以打成rpm或deb,如：

apt-get  install git debhelper cdbs python-setuptools python-jinja2 python-sphinx asciidoc devscripts -y --force-yes

git clone git://github.com/ansible/ansible.git --recursive

cd ./ansible

git branch -a

git checkout remotes/origin/stable-2.3

make deb

或

yum -y install git python-setuptools python-jinja2 asciidoc rpm-build

git clone git://github.com/ansible/ansible.git --recursive

cd ./ansible

git branch -a
git checkout remotes/origin/stable-2.3

make rpm

方式二：pip安装

yum –y install python-setuptools

easy_install pip

pip install ansible

Ubuntu可通过PPA方式安装

sudo apt-get install software-properties-common

sudo apt-add-repository ppa:ansible/ansible

sudo apt-get update

sudo apt-get install ansible

配置：

Ansible will try to default to using OpenSSH as a connection method. This is suitable when using SSH keys to authenticate, but when using SSH passwords, Ansible relies on sshpass.

1.配置远程主机列表或组

http://docs.ansible.com/ansible/intro_inventory.html

http://docs.ansible.com/ansible/intro_patterns.html

cat >> /etc/ansible/hosts <<HERE

[foo]

192.168.8.100

192.168.8.150

HERE

默认该ansible hosts文件有很多模板，无需过多解释，我这里加添了一个加foo的主机组，有两台主机

再比如

[apache]

192.168.8.101

[nginx]

node2 ansible_host=192.168.8.102 ansible_port=22 ansible_user=root ansible_connection=paramiko

[nginx:vars]

nginx_basedir=/opt/nginx

[test:children]

apache

nginx

[self]

self ansible_host=127.0.0.1 ansible_connection=local

[docker]

192.168.8.10[1:2]

2.生成ssh公私钥对

ssh-keygen

可以为密钥设置密码

root@jlive:~#ssh-keygen 

Generating public/private rsa key pair.

Enter file in which to save the key (/root/.ssh/id_rsa): 

Enter passphrase (empty for no passphrase): 

Enter same passphrase again: 

Your identification has been saved in /root/.ssh/id_rsa.

Your public key has been saved in /root/.ssh/id_rsa.pub.

The key fingerprint is:

c3:33:36:f9:3c:a4:04:1c:20:3c:7e:4a:92:31:bf:66 root@jlive.example.com

The key's randomart image is:

+--[ RSA 2048]----+

| .. ...          |

|o o. . .         |

| * .  o          |

|o + .  o .       |

| o +    S .      |

|  E    o X       |

| o      . +      |

|           .     |

|                 |

 

+-----------------+

3.将ssh钥匙(通常是公钥)导入到远程主机的授权文件

chmod 600 ~/.ssh/id_rsa*

ssh-copy-id -i ~/.ssh/id_rsa.pub 192.168.8.100

ssh-copy-id -i ~/.ssh/id_rsa.pub 192.168.8.150

提示：默认情况下ssh-copy-id可以自动将公钥导入到远程主机的~/.ssh/authorized_keys

4.测试ansible

root@jlive:~#ssh-agent bash

root@jlive:~#ssh-add ~/.ssh/id_rsa

Enter passphrase for /root/.ssh/id_rsa:  

Identity added: /root/.ssh/id_rsa (/root/.ssh/id_rsa)

提示：ssh-agent可以代理密码输入，在整个ansible期间不需要每台主机都输入一次密码

root@jlive:~#ansible foo -m ping

192.168.8.100 | success >> {

    "changed": false, 

    "ping": "pong"

}

192.168.8.150 | success >> {

    "changed": false, 

    "ping": "pong"

 

}

root@jlive:~#ansible foo -a "echo hello"

192.168.8.150 | success | rc=0 >>

hello

192.168.8.100 | success | rc=0 >>

hello

root@jlive:~#ansible foo -a "uptime"

192.168.8.150 | success | rc=0 >>

 23:52:23 up 34 min,  2 users,  load average: 0.00, 0.01, 0.01

192.168.8.100 | success | rc=0 >>

 

 23:52:23 up 35 min,  2 users,  load average: 0.00, 0.01, 0.01

sudo范例

# With latest version of ansible `sudo` is deprecated so use become
# as bruce, sudoing to root
$ ansible all -m ping -u bruce -b
# as bruce, sudoing to batman
$ ansible all -m ping -u bruce -b --become-user batman

5.禁用Host Key Checking

系统一旦重装，ssh校验'known_hosts'就会报错

针对该问题，可以

1.修改known_hosts

2.禁用Host Key Checking

cat >>~/.ansible.cfg <<HERE

[defaults]

host_key_checking = False

HERE

或者添加到ansible全局配置文件/etc/ansible/ansible.cfg

还可以申明全局变量

export ANSIBLE_HOST_KEY_CHECKING=False