EX294配置指引

安装和配置Ansible

安装Ansible

[root@bastion ~]#安装Ansible服务
[root@bastion ~]yum install ansible.noarch -y

配置Ansible

[greg@bastion ~]$ # 定义静态清单文件
[greg@bastion ~]$ vim ./ansible/inventory
[greg@bastion ~]$ cat ./ansible/inventory 
[dev]
172.25.250.9
[test]
172.25.250.10
[prod]
172.25.250.11
172.25.250.12
[balancers]
172.25.250.13
[webservers:children]
prod
[greg@bastion ansible]$ cat ansible.cfg 
[defaults]
inventory      = /home/greg/ansible/inventory
roles_path    = /home/greg/ansible/roles
[privilege_escalation]
become=True
become_method=sudo
become_user=root
[greg@bastion ansible]$ mkdir /home/greg/ansible/roles
[greg@bastion ansible]$ #可通过Ansible默认的配置文件来参考,路径为/etc/ansible/ansible.cfg

配置yum源

[greg@bastion ansible]$ cat /home/greg/ansible/adhoc.sh
#!/bin/bash
ansible all -m yum_repository -a "name=EX294_BASE description='EX294 base software' baseurl=ftp://host.domain8.example.com/dvd/BaseOS enabled=yes gpgcheck=yes gpgkey=tp://host.domain8.example.com/dvd/RPM-GPG-KEY-redhat-release "
ansible all -m yum_repository -a "name=EX294_STREAM description='EX294 stream software' baseurl=ftp://host.domain8.example.com/dvd/AppStream enabled=yes gpgcheck=yes gpgkey=ftp://host.domain8.example.com/dvd/RPM-GPG-KEY-redhat-release "
[greg@bastion ansible]$ chmod +x /home/greg/ansible/adhoc.sh

安装软件包

---
- hosts: [dev,test,prod]
  tasks:
  - name: Install php and mariadb services
    yum:
     name: php,mariadb
     state: installed
- hosts: [dev]
  tasks:
  - name: Install RPM Development Tools
    yum:
     name: '@RPM Development Tools'
     state: installed
  - name: Update the service version
    yum:
     name: '*'
     state: latest

使用RHEL系统角色之 rhel-system-roles.timesync

#按照题目要求将系统rhel-system-roles.timesync角色内容复制到题目指定位置
[greg@bastion roles]$ cp -r /usr/share/ansible/roles/rhel-system-roles.timesync/ /home/greg/ansible/roles/timesync
[greg@bastion ansible]$ cat timesync.yml 
---
- hosts: all
  vars: 
        timesync_ntp_servers:
                - hostname: 172.25.250.250
                  pool: yes
                  iburst: yes
  roles:
          - role: timesync
[greg@bastion ansible]$ #运行playbook
[greg@bastion ansible]$ ansible-playbook timesync.yml

使用Ansible Galaxy安装角色

#通过角色文件安装
[greg@bastion ansible]$ ansible-galaxy install -r roles/requirements.yml -p roles
[greg@bastion roles]$ cat requirements.yml 
---
- src: http://host.domain8.example.com/ex300/haproxy.tar.gz
  name: balancer
- src: http://host.domain8.example.com/ex300/phpinfo.tar.gz
  name: phpinfo
[greg@bastion roles]$ 
#查看已下载角色
[greg@bastion ansible]$ ansible-galaxy list
# /home/greg/ansible/roles
- timesync, (unknown version)
- balancer, (unknown version)
- phpinfo, (unknown version)
[greg@bastion ansible]$

通过角色创建http服务

#在roles目录下创建apache角色
[greg@bastion roles]$ ansible-galaxy init apache
- apache was created successfully
[greg@bastion roles]$ ls
apache   balancer  requirements.yml  timesync
[greg@bastion roles]$ 
#编写task文件
[greg@bastion apache]$ cd tasks/
[greg@bastion tasks]$ cat main.yml 
---
# tasks file for apache
- name: Install httpd service
  yum:
          name: httpd
          state: installed
- name: Enable httpd service
  service:
          name: httpd
          state: started
          enabled: true
- name: Enable firewall service
  service:
          name: firewalld
          state: started
          enabled: true
- name: Enable http service in firewall
  firewalld:
          service: http
          immediate: yes
          permanent: yes
          state: enabled
- name: Copy http index.html
  template:
          src: index.html.j2
          dest: /var/www/html/index.html
[greg@bastion tasks]$ 
# 创建j2文件
[greg@bastion apache]$ 
[greg@bastion apache]$ cd ./templates/
[greg@bastion templates]$ cat index.html.j2 
Welcome to {{ansible_fqdn}} on {{ansible_default_ipv4.address}}
[greg@bastion templates]$ 
# 创建playbook
[greg@bastion ansible]$ cat newroles.yml 
---
- hosts: webservers
  name: Init http service
  roles:
          - role: apache
[greg@bastion ansible]$

从Ansible Galaxy中使用角色

[greg@bastion ansible]$ cat roles.yml 
---
- hosts: all
- hosts: balancers
  roles:
          - role: balancer
- hosts: webservers
  roles:
          - role: phpinfo

创建和使用逻辑卷

[greg@bastion ansible]$ cat /home/greg/ansible/lv.yml
---
- hosts: lvgroup
  tasks:
          - name: volume exsit or not
            shell: 'vgdisplay research'
            register: exsit_or_not
            ignore_errors: yes
          - name: if not exsit, will display the message
            fail: 
              msg: "Volume group done not exist"
            when: exsit_or_not.rc != 0
          - name: if exsit, will create the lv
            block:
                    - name: Create the lv for 1500M
                      lvol: 
                        vg: research 
                        lv: data 
                        size: 1500m
            rescue:
                    - name: Display the message,if does not have enough spaces
                      debug: 
                        msg: "Could not create logical volume of that size"
                    - name: Create the lv for 800M
                      lvol: 
                        vg: research 
                        lv: data 
                        size: 800m
          - name: Format the lv for ext4
            filesystem: 
              dev: /dev/research/data 
              fstype: ext4 
              force: yes

创建并使用磁盘分区

[greg@bastion ansible]$ cat partition.yml 
---
- hosts: diskgroup
  tasks:
          - name: Disk exist or not
            shell: 'ls /dev/vdb'
            register: disk_exist_or_not
            ignore_errors: yes
          - name: If disk does not exsit, will display message
            fail: 
              msg: "disk does not exist"
            when: disk_exist_or_not.rc != 0
          - name: If disk exsit, Create a main partition
            block:
                    - name: Create a main partition for 1500M
                      parted: 
                        device: /dev/vdb 
                        number: 1 
                        part_end: 1500MiB 
                        state: present
            rescue:
                    - name: Can not create a 1500M partition
                      debug: 
                        msg: 'could not create partation of that size'
                    - name: Create a main partition for 800M
                      parted: 
                        device: /dev/vdb 
                        number: 1 
                        part_end: 800MiB 
                        state: present
          - name: Format the partition
            filesystem: 
              dev: /dev/vdb1 
              fstype: ext4 
              force: yes
          - name: Mount the partition
            mount: 
              src: /dev/vdb1 
              path: /newpart 
              fstype: ext4 
              state: mounted

生成主机文件

[greg@bastion ansible]$ cat hosts.j2
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
{% for host in groups['all'] %}
{{ hostvars[host]['ansible_default_ipv4']['address']}} {{ hostvars[host]['ansible_fqdn'] }} {{ hostvars[host]['ansible_hostname'] }}
{% endfor %}
[greg@bastion ansible]$ 
[greg@bastion ansible]$ cat hosts.yml 
---
- hosts: all
- hosts: dev
  tasks:
          - name: Generate the host file of server
            template: 
              src: /home/greg/ansible/hosts.j2 
              dest:  /etc/myhosts
[greg@bastion ansible]$

修改文件内容

[greg@bastion ansible]$ cat issue.yml 
---
- hosts: all
  tasks:
          - name: For dev
            copy: 
              content: "Development\n" 
              dest: /etc/issue
            when: inventory_hostname in groups['dev']
          - name: For test
            copy: 
              content: "Test\n" 
              dest: /etc/issue
            when: inventory_hostname in groups['test']
          - name: For production
            copy: 
              content: "Production\n" 
              dest: /etc/issue
            when: inventory_hostname in groups['prod']
[greg@bastion ansible]$

创建Web内容目录

[greg@bastion ansible]$ cat webcontent.yml 
---
- hosts: dev
  roles:
          - role: apache
  tasks:
          - name: Create group
            group: 
              name: webdev
          - name: Create Directory
            file: 
              path: /webdev 
              group: webdev 
              state: directory 
              mode: 2775 
              setype: httpd_sys_content_t
          - name: Create softlink
            file: 
              src: /webdev 
              dest: /var/www/html/webdev 
              state: link
          - name: Create a file
            copy: 
              content: "Development\n" 
              dest: /webdev/index.html 
              setype: httpd_sys_content_t
[greg@bastion ansible]$

生成硬件报告

[greg@bastion ansible]$ cat hwreport.yml 
---
- hosts: all
  tasks:
          - name: Remove the file, if exist
            shell: "rm -rf /root/hwreport.txt"
          - name: Download the file
            get_url: 
              url: "http://host/ex300/hwreport.empty" 
              dest: /root/hwreport.txt
          - name: Edit the value of the HOST
            lineinfile: 
              path: /root/hwreport.txt 
              regexp: '^HOST' 
              line: 'HOST={{inventory_hostname}}'
          - name: Edit the value of the MEMORY
            lineinfile: 
              path: /root/hwreport.txt 
              regexp: '^MEMORY' 
              line: 'MEMORY={{ansible_memtotal_mb}}MB'
          - name: Edit the value of the BIOS
            lineinfile: 
              path: /root/hwreport.txt 
              regexp: '^BIOS' 
              line: 'BIOS={{ansible_bios_version}}'
          - name: Edit the value of the DISK_SIZE_VDA
            lineinfile: 
              path: /root/hwreport.txt 
              regexp: '^DISK_SIZE_VDA' 
              line: 'DISK_SIZE_VDA={{ansible_devices.vda.size}}'
          - name: Edit the value of the DISK_SIZE_VDB
            block:
                    - name: If DISK VDB exist
                      lineinfile: 
                        path: /root/hwreport.txt 
                        regexp: '^DISK_SIZE_VDB' 
                        line: 'DISK_SIZE_VDB={{ansible_devices.vdb.size}}'
            rescue:
                    - name: If DISK VDB does not exist
                      lineinfile: 
                        path: /root/hwreport.txt 
                        regexp: '^DISK_SIZE_VDB' 
                        line: 'DISK_SIZE_VDB=NONE' 
[greg@bastion ansible]$ 
[greg@bastion ansible]$ 
[greg@bastion ansible]$ 
[greg@bastion ansible]$

创建密码库

[greg@bastion ansible]$ cat /home/greg/ansible/secret.txt
redhat
[greg@bastion ansible]$ cat locker.yml 
pw_developer: redhat
pw_manager: redhat
[greg@bastion ansible]$ ansible-vault encrypt --vault-id=secret.txt locker.yml
Encryption successful
[greg@bastion ansible]$ ansible-vault view --vault-id=secret.txt locker.yml
pw_developer: redhat
pw_manager: redhat
[greg@bastion ansible]$ cat locker.yml 
$ANSIBLE_VAULT;1.1;AES256
31343035333566653262653461353839316365373937393961343732386431386262373838323830
6163323965323630346330346461623362663964623666610a343536653564303464373535376530
35623033353330663666613234363539656666633132656531663333646532363935643164313633
3636653166373039620a376536623764643137346333646335383139633039353063356162663466
66643830623933336634336530366162366363633861333465393532303235376363643238326262
6436363666633533396461383264346635396136343130383134
[greg@bastion ansible]$

创建用户账号

---
- hosts: [dev,test]
  vars_files:
          - user_list.yml
          - locker.yml
  tasks:
          - name: Create a group
            group:
                    name: devops
                    state: present
          - name: Create a user
            user:
                    name: "{{ item.name }}"
                    comment: "{{ item.job }}"
                    groups: devops
                    password: "{{ pw_developer | password_hash('sha512') }}"
            when: item.job == 'developer'
            loop: "{{users}}"
- hosts: [prod]
  vars_files:
          - user_list.yml
          - locker.yml
  tasks:
          - name: Create a group
            group:
                    name: opsmgr
                    state: present
          - name: Create a user
            user:
                    name: "{{ item.name }}"
                    groups: opsmgr
                    comment: "{{ item.job }}"
                    password: "{{ pw_manager | password_hash('sha512') }}"
            when: item.job == 'manager'
            loop: "{{users}}"

更新Ansible库的密码

[greg@bastion ansible]$ ansible-vault rekey salaries.yml 
Vault password: 
New Vault password: 
Confirm New Vault password: 
Rekey successful
[greg@bastion ansible]$

配置Selinux

[greg@bastion ansible]$ cp -r /usr/share/ansible/roles/rhel-system-roles.selinux/ roles/selinux
[greg@bastion ansible]$ ls
[greg@bastion ansible]$ cp /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml selinux.yml
[greg@bastion ansible]$ ls

配置Cron任务

[greg@bastion ansible]$ cat cron.yml 
---
- hosts: all
  tasks:
          - name: Create a user for cron task
            user:
                    name: natasha
                    state: present
          - name: Create a cron task
            cron: 
                    name: logger
                    minute: '*/2' 
                    user: natasha 
                    job: logger "EX200 in progress"
[greg@bastion ansible]$