RHCE（ansible基础）

安装步骤：
1.下载源码包 解压源码包
wget https://releases.ansible.com/ansible/ansible-2.9.0.tar.gz
tar -xzf ansible-2.9.0.tar.gz
2.进入解压后的目录
cd ansible-2.9.0
2. pyhton3 setup.py build 构建源码包
3. python3 setup.py install 安装源码包　

[root@server ~]# cat /etc/ansible/hosts
172.25.250.20
client
client1　　

[root@server ~]# cat /etc/ansible/hosts
172.25.250.20
client
client1
[server]
client1
client　

[root@server ~]# cat /etc/ansible/hosts
172.25.250.20
client
client1
[c]
client1
client
[server:children]
c　

[root@server ansible]# cat hosts
172.25.250.20
client
client1
[c]
client1
client
[server:children]
c
www.[a:c].com

ansible node1 --list-hosts        单个主机查询
ansible node1,node2 --list-hosts 多个主机查询
ansible webserver --list-hosts		主机组查询
ansible ungrouped --list-hosts    查询不属于任何主机组的主机　　

ansible exam* --list-hosts  查看以exam开头的所有主机
ansible *com --list-hosts 	查看以com结尾的所有主机
ansible *ple* --list-hosts  查看存在ple的所有主机

ansible '~^(e|t)' --list-hosts    正则查询，以e或者t开头的主机
ansible 'webserver,!mysqlserver' --list-hosts   取反   
ansible 'webserver,&mysqlserver' --list-hosts   取交集 逻辑与
ansible 'userserver,&webserver,!mysqlserver' --list-hosts 组合使用

ansible all --limit @hosts.txt --list-hosts  通过主机文件来查询（主机文件中的主机必须在 hosts主机清单中有）
ansible all --limit node1 --list-hosts			 在所有的主机里面查询node1主机　　

[defaults]  					远程登录的用户、密码（密钥）、远程端口等
[inventory]					与主机清单相关的配置
									是不是要设置主机清单的变量，配置主机清单的路径
[privilege_escalation]  提权相关的配置项
									普通用户进行连接，要提权到哪个用户
									提权的方式？是不是sudo
[paramiko_connection]  ansible管控被控节点的连接，后面都使用了ssh进行管控
[ssh_connection]			ssh连接项
									定义SSH的版本，端口，身份验证方式，加速器
[persistent_connection] 持久化连接的配置项
									定义多久时间没有任务执行，则退出连接
[accelerate]				 加速模式配置
								是否要对数据进行压缩加速 传输
[selinux]					SELinux相关配置项
								selinux是否开启？
[colors]					ansible命令输出提示的颜色
[diff]						在运行ansible命令的时候，是否打印变更前和变更后差异

[default]
inventory =  /etc/ansible/hosts  #定义主机清单的路径
ask_sudo_pass = false   #使用sudo的时候，不输入密码
ask_pass = false   #使用密钥进行验证
remote_user = devops   #登录到被控节点的用户为devops

[privilege_escalation]
become = true       #是否进行提权    
become_method = sudo   #提权的方式是什么
become_user = root      #提权到的用户是什么
become_ask_pass = false    #提权的时输入密码吗

#映射
[root@server ansible]# cat /etc/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.250.10 server
172.25.250.20 client

#在被控节点上创建devops用户，并且发送密钥给devops用户，进行提权
[root@server ansible]# ssh root@client useradd devops 
The authenticity of host 'client (172.25.250.20)' can't be established.
ED25519 key fingerprint is SHA256:t6Zf1PYsUmDXG5LuUFM2JfwCfALpTonT4kuGnaGCaaI.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'client' (ED25519) to the list of known hosts.
root@client's password: 
[root@server ansible]# ssh root@client "echo "000000" | passwd --stdin devops"
root@client's password: 
Changing password for user devops.
passwd: all authentication tokens updated successfully.

#密钥
[root@server ansible]# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /root/.ssh/id_rsa
Your public key has been saved in /root/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:aPxuLk7kdeaEXxFj5kjuIGZZfBByEoGPD9X4KYF1PVY root@server
The key's randomart image is:
+---[RSA 3072]----+
|     +***+..E    |
|    o +Boo== o   |
|     +=o.+o.o    |
|    o+ooo+   .   |
|     o=.S = .    |
|     +.o * .     |
|      o . o      |
|     ....        |
|     ..+o        |
+----[SHA256]-----+
[root@server ansible]# ssh-copy-id devops@client
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
devops@client's password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'devops@client'"
and check to make sure that only the key(s) you wanted were added.

#对devops用户进行提权
[root@server ansible]# ssh root@client "echo 'devops ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers"
root@client's password: 


#编写主机清单文件
[root@server ansible]# cat hosts
client


#进行测试
[root@server ansible]# ansible all -m ping
[DEPRECATION WARNING]: Distribution rhel 9.0 on host client should use 
/usr/libexec/platform-python, but is using /usr/bin/python for backward 
compatibility with prior Ansible releases. A future Ansible release will default to 
using the discovered platform python for this host. See 
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html
 for more information. This feature will be removed in version 2.12. Deprecation 
warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
client | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

[defaults]
inventory = /etc/ansible/hosts   ##定义主机清单的
remote_user = devops         #被控节点登录的用户
deprecation_warnings=False    ##警告不提醒
ask_pass = False                   ##连接远程主机的时候不需要输入密码
host_key_checking = True       ##在连接远程主机的时候，检查密钥


[privilege_escalation]   ##提权相关的配置
become=True          ##是否提权
become_method=sudo     ##提权的方式为sudo
become_user=root           ##提权到用户为root
become_ask_pass=False    ##提权的时候，不用输入密码