Ansible自动化运维实战：从安装到Playbook编写全攻略

┌─────────────────────────────────────────────────────────────┐
│                    Ansible Control Node                      │
│                     (控制节点 - Python)                      │
└──────────────────────┬──────────────────────────────────────┘
                       │ SSH / WinRM
        ┌──────────────┼──────────────┐
        ▼              ▼              ▼
   ┌─────────┐   ┌─────────┐   ┌─────────────┐
   │  Linux  │   │ Windows │   │  Network    │
   │  Hosts  │   │  Hosts  │   │  Devices    │
   └─────────┘   └─────────┘   └─────────────┘
 

// bash
sudo wget -O /etc/yum.repos.d/epel.repo https://mirrors.aliyun.com/repo/epel-7.repo
 

// bash
# 使用普通用户 wuge 登录控制节点
[wuge@control ~]$ sudo yum -y install ansible
 

# 验证安装
[wuge@control ~]$ ansible --version
ansible 2.9.27
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/wuge/.ansible/plugins/modules']
  python version = 3.6.8
 

// bash
[wuge@control ~]$ mkdir shixun && cd shixun/

[wuge@control shixun]$ cp /etc/ansible/ansible.cfg .
 

// ini
[defaults]
inventory      = ./inventory     # 指定清单文件路径
remote_user    = wuge            # 远程连接用户名
ask_pass      = False            # 不询问密码（使用 SSH 密钥）

[privilege_escalation]
become         = True            # 启用权限提升
become_method  = sudo            # 使用 sudo 提权
become_user    = root            # 提权到 root 用户
become_ask_pass = False          # 不询问 sudo 密码
 

最佳实践：

- 生产环境中建议使用 SSH 密钥认证，避免密码传输

- 权限提升使用 sudo，保持最小权限原则

- 配置文件应纳入版本控制

// ini
[prod]
node1
node2

[balancers]
node3

[webservers:children]
prod
 

// bash
# 验证清单中定义的主机
[wuge@control shixun]$ ansible all --list-hosts
 

# 测试主机连通性（使用 ping 模块）
[wuge@control shixun]$ ansible all -m ping
 

// bash
ansible <主机或组> -m <模块名> -a <模块参数>
 

// bash
# 在所有主机上执行 ping
ansible all -m ping

# 在 prod 组主机上查看内存使用
ansible prod -m command -a "free -h"

# 在所有主机上查看系统信息
ansible all -m setup
 

学习提示：每个模块都包含功能介绍、常用参数、Playbook 范文和 Ad-hoc 命令四种形式，方便读者全面理解和快速查阅。

// yaml
---
- name: copy a file
  hosts: all
  tasks:
    - name: copy testfile to all nodes
      copy:
        src: ./testfile
        dest: /opt/testfile
        owner: root
        group: wuge
        mode: 0444
 

// bash
# 复制文件到远程主机
ansible all -m copy -a "src=./testfile dest=/opt/testfile owner=root group=wuge mode=0444"

# 直接写入内容到文件
ansible all -m copy -a "content='Hello Ansible' dest=/tmp/hello.txt"
 

// yaml
---
- name: create a user
  hosts: all
  tasks:
    - name: create a user zhangsan
      user:
        name: zhangsan
        uid: 2234
        groups: root,wuge
        append: yes
        comment: 'small zhangsan'
        shell: /bin/bash
 

// bash
# 创建用户
ansible all -m user -a "name=zhangsan uid=2234 groups=root,wuge append=yes comment='small zhangsan'"

# 删除用户（同时删除家目录）
ansible all -m user -a "name=zhangsan state=absent remove=yes"
 

// yaml
---
- name: file module examples
  hosts: all
  tasks:
    # 创建目录
    - name: create a directory
      file:
        path: /opt/mydir
        state: directory
        owner: wuge
        group: wuge
        mode: 0755

    # 创建文件
    - name: create an empty file
      file:
        path: /opt/myfile.txt
        state: touch
        mode: 0644

    # 创建符号链接
    - name: create a symbolic link
      file:
        src: /opt/testfile
        dest: /opt/testfile_link
        state: link
        force: yes

    # 删除文件/目录
    - name: remove a directory
      file:
        path: /opt/mydir
        state: absent
 

// bash
# 创建目录
ansible all -m file -a "path=/opt/mydir state=directory owner=wuge mode=0755"

# 创建符号链接
ansible all -m file -a "src=/opt/testfile dest=/opt/testfile_link state=link"

# 创建空文件
ansible all -m file -a "path=/opt/myfile.txt state=touch"

# 删除文件/目录
ansible all -m file -a "path=/opt/mydir state=absent"
 

// yaml
---
- name: configure yum repositories
  hosts: all
  tasks:
    # 添加阿里云 EPEL 仓库
    - name: add aliyun EPEL repository
      yum_repository:
        name: epel
        description: Extra Packages for Enterprise Linux 7
        baseurl: https://mirrors.aliyun.com/epel/7/x86_64/
        gpgcheck: no
        enabled: yes

    # 添加自定义仓库
    - name: add custom repository
      yum_repository:
        name: myrepo
        description: My Custom Repository
        baseurl: http://yum.example.com/custom/$releasever/$basearch/
        gpgcheck: yes
        gpgkey: http://yum.example.com/RPM-GPG-KEY-myrepo
        enabled: yes
 

// bash
# 添加 EPEL 仓库
ansible all -m yum_repository -a "name=epel description='EPEL YUM Repository' baseurl=https://mirrors.aliyun.com/epel/7/x86_64/ gpgcheck=no"

# 删除仓库
ansible all -m yum_repository -a "name=epel state=absent"
 

// yaml
---
- name: download files using get_url
  hosts: all
  tasks:
    # 下载 Nginx 官方 RPM 包
    - name: download nginx rpm
      get_url:
        url: https://nginx.org/packages/rhel/7/x86_64/RPMS/nginx-1.24.0-1.el7.ngx.x86_64.rpm
        dest: /tmp/nginx.rpm
        mode: 0644

    # 下载文件并校验
    - name: download with checksum verification
      get_url:
        url: https://example.com/software.tar.gz
        dest: /opt/software.tar.gz
        checksum: sha256:abc123...

    # 下载需要认证的文件
    - name: download from authenticated URL
      get_url:
        url: https://example.com/private/file.zip
        dest: /opt/file.zip
        url_username: myuser
        url_password: mypassword
        force_basic_auth: yes
 

// bash
# 下载文件
ansible all -m get_url -a "url=https://example.com/file.tar.gz dest=/opt/file.tar.gz"

# 下载并校验
ansible all -m get_url -a "url=https://example.com/file.tar.gz dest=/opt/file.tar.gz checksum=sha256:abc123..."
 

// yaml
---
- name: shell module examples
  hosts: all
  tasks:
    # 使用管道组合命令
    - name: check memory usage
      shell: free -h | grep Mem
      register: mem_info

    - name: display memory info
      debug:
        var: mem_info.stdout

    # 复杂的多行命令
    - name: execute multi-line command
      shell: |
        cd /opt && \
        tar -xzf app.tar.gz && \
        mv app-v1.0 app-current

    # 条件执行（文件不存在时）
    - name: run script only if output file doesn't exist
      shell: /opt/build.sh
      args:
        creates: /opt/output.log
 

// bash
# 执行简单命令
ansible all -m shell -a "free -h"

# 组合命令
ansible all -m shell -a "df -h | grep -v tmpfs"

# 多行命令
ansible all -m shell -a "cmd='cd /opt && tar -xzf app.tar.gz'"
 

注意：shell 模块功能强大但需谨慎使用，优先考虑其他专用模块（如 copy、yum、service 等），因为专用模块具有幂等性，而 Shell 命令可能产生意外结果。

// yaml
---
- name: command module examples
  hosts: all
  tasks:
    # 查看文件内容
    - name: cat file content
      command: cat /etc/hostname
      register: hostname_output

    - name: display hostname
      debug:
        var: hostname_output.stdout

    # 创建符号链接（需要完整路径）
    - name: create symlink
      command: ln -s /opt/app /usr/local/bin/app
      args:
        creates: /usr/local/bin/app
 

// bash
# 执行简单命令
ansible all -m command -a "uptime"

# 查看系统版本
ansible all -m command -a "cat /etc/redhat-release"
 

// yaml
---
- name: yum/dnf module examples
  hosts: all
  tasks:
    # 安装单个软件包
    - name: install nginx
      yum:
        name: nginx
        state: present

    # 安装多个软件包
    - name: install multiple packages
      yum:
        name:
          - httpd
          - httpd-tools
          - mod_ssl
        state: present

    # 安装最新版本
    - name: update nginx to latest
      yum:
        name: nginx
        state: latest

    # 删除软件包
    - name: remove nginx
      yum:
        name: nginx
        state: absent

    # 安装本地 RPM 包
    - name: install rpm from local file
      yum:
        name: /opt/nginx.rpm
        state: present
        disablerepo: "*"
 

// bash
# 安装软件包
ansible all -m yum -a "name=nginx state=present"

# 安装多个软件包
ansible all -m yum -a "name=httpd,httpd-tools state=present"

# 更新所有软件包
ansible all -m yum -a "name=* state=latest"

# 删除软件包
ansible all -m yum -a "name=nginx state=absent"
 

// yaml
---
- name: service/systemd module examples
  hosts: all
  tasks:
    # 启动并启用服务（systemd）
    - name: start and enable nginx
      systemd:
        name: nginx
        state: started
        enabled: yes
        daemon_reload: yes

    # 停止服务
    - name: stop httpd service
      systemd:
        name: httpd
        state: stopped

    # 重启服务
    - name: restart firewalld
      systemd:
        name: firewalld
        state: restarted

    # 使用 service 模块（旧版系统）
    - name: start apache service
      service:
        name: httpd
        state: started
        enabled: yes
 

// bash
# 启动并启用服务
ansible all -m systemd -a "name=nginx state=started enabled=yes"

# 停止服务
ansible all -m systemd -a "name=httpd state=stopped"

# 重启服务
ansible all -m systemd -a "name=nginx state=restarted"
 

// yaml
---
- name: cron module examples
  hosts: all
  tasks:
    # 每天凌晨 2 点执行备份脚本
    - name: backup database daily at 2am
      cron:
        name: "Backup database"
        minute: "0"
        hour: "2"
        job: "/opt/scripts/backup.sh"
        state: present
        user: root

    # 每周一早上 6 点清理日志
    - name: clean logs every Monday
      cron:
        name: "Clean old logs"
        weekday: "1"
        hour: "6"
        minute: "0"
        job: "find /var/log -name '*.log' -mtime +7 -delete"
        state: present

    # 系统重启后执行任务
    - name: run script on reboot
      cron:
        name: "Run after reboot"
        special_time: reboot
        job: "/opt/scripts/startup.sh"

    # 删除定时任务
    - name: remove backup cron
      cron:
        name: "Backup database"
        state: absent

    # 禁用任务（注释掉）
    - name: disable backup cron temporarily
      cron:
        name: "Backup database"
        disabled: yes
 

// bash
# 创建定时任务
ansible all -m cron -a "name='backup' minute=0 hour=2 job='/opt/backup.sh' state=present"

# 删除定时任务
ansible all -m cron -a "name='backup' state=absent"

# 查看定时任务
ansible all -m cron -a "name='backup'"
 

// jinja2
# Nginx configuration template
server {
    listen {{ nginx_port }};
    server_name {{ server_name }};

    location / {
        root {{ document_root }};
        index index.html;
    }

    access_log {{ log_path }}/access.log;
    error_log {{ log_path }}/error.log;
}
 

// yaml
---
- name: deploy nginx configuration using template
  hosts: webservers
  vars:
    nginx_port: 80
    server_name: example.com
    document_root: /var/www/html
    log_path: /var/log/nginx

  tasks:
    - name: deploy nginx.conf
      template:
        src: templates/nginx.conf.j2
        dest: /etc/nginx/conf.d/example.conf
        owner: root
        group: root
        mode: 0644
        validate: nginx -t
        backup: yes
 

// bash
# 直接使用变量生成配置
ansible webservers -m template -a "src=templates/nginx.conf.j2 dest=/etc/nginx/conf.d/example.conf validate='nginx -t'"
 

// bash
#!/bin/bash
# Check system resources and log to file

LOG_FILE="/var/log/system_check.log"
echo "=== System Check $(date) ===" >> $LOG_FILE
echo "Memory:" >> $LOG_FILE
free -h >> $LOG_FILE
echo "" >> $LOG_FILE
echo "Disk:" >> $LOG_FILE
df -h >> $LOG_FILE
 

// yaml
---
- name: execute local script on remote hosts
  hosts: all
  tasks:
    - name: run system check script
      script:
        cmd: scripts/check_system.sh
        creates: /var/log/system_check.log
      register: script_output

    - name: display script output
      debug:
        var: script_output.stdout_lines
 

// bash
# 执行本地脚本
ansible all -m script -a "scripts/check_system.sh"
 

// yaml
---
- name: group module examples
  hosts: all
  tasks:
    # 创建系统组
    - name: create system group
      group:
        name: appserver
        gid: 1000
        system: yes
        state: present

    # 创建普通组
    - name: create application group
      group:
        name: webapp
        state: present

    # 删除组
    - name: remove group
      group:
        name: webapp
        state: absent
 

// bash
# 创建组
ansible all -m group -a "name=appserver gid=1000 state=present"

# 删除组
ansible all -m group -a "name=webapp state=absent"
 

// yaml
---
- name: manage SSH authorized keys
  hosts: all
  tasks:
    # 添加单个公钥
    - name: add admin SSH key
      authorized_key:
        user: wuge
        key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD... admin@workstation"
        state: present

    # 添加多个公钥（使用文件）
    - name: add multiple keys for deploy user
      authorized_key:
        user: deploy
        key: "{{ lookup('file', 'keys/jenkins.pub') }}"
        key_opts: 'no-agent-forwarding,no-pty'
        state: present

    # 删除公钥
    - name: remove old key
      authorized_key:
        user: wuge
        key: "ssh-rsa AAAAB3NzaC1... old-key@oldmachine"
        state: absent

    # 替换所有密钥（清空后添加）
    - name: set exclusive keys for admin
      authorized_key:
        user: admin
        key: "{{ item }}"
        exclusive: yes
      with_file:
        - keys/admin_key1.pub
        - keys/admin_key2.pub
 

// bash
# 添加公钥
ansible all -m authorized_key -a "user=wuge key='ssh-rsa AAAAB3NzaC1...'"

# 删除公钥
ansible all -m authorized_key -a "user=wuge key='ssh-rsa AAAAB3NzaC1...' state=absent"
 

// yaml
---
- name: mount module examples
  hosts: all
  tasks:
    # 挂载 NFS 共享
    - name: mount NFS share
      mount:
        path: /mnt/nfs
        src: nfsserver:/share
        fstype: nfs
        opts: defaults,rw
        state: mounted

    # 挂载临时文件系统
    - name: mount tmpfs
      mount:
        path: /mnt/ramdisk
        src: tmpfs
        fstype: tmpfs
        opts: size=1G
        state: mounted

    # 卸载并移除 fstab 条目
    - name: unmount and remove
      mount:
        path: /mnt/nfs
        state: absent
 

// bash
# 挂载 NFS
ansible all -m mount -a "path=/mnt/nfs src=nfsserver:/share fstype=nfs state=mounted"

# 卸载
ansible all -m mount -a "path=/mnt/nfs state=unmounted"
 

// yaml
---
- name: configure firewalld
  hosts: all
  tasks:
    # 开放 HTTP 和 HTTPS 服务
    - name: allow http and https
      firewalld:
        service: "{{ item }}"
        permanent: yes
        immediate: yes
        state: enabled
      loop:
        - http
        - https

    # 开放自定义端口
    - name: open custom port
      firewalld:
        port: 8080/tcp
        permanent: yes
        immediate: yes
        state: enabled

    # 关闭防火墙
    - name: disable firewalld
      firewalld:
        state: stopped
        permanent: no
        immediate: yes

    # 添加富规则（限制 IP 访问）
    - name: allow limited access to mysql
      firewalld:
        rich_rule: 'rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept'
        permanent: yes
        immediate: yes
        state: enabled
 

// bash
# 开放端口
ansible all -m firewalld -a "port=80/tcp permanent=yes immediate=yes state=enabled"

# 开放服务
ansible all -m firewalld -a "service=http permanent=yes immediate=yes state=enabled"
 

// yaml
---
- name: Deploy LAMP Stack
  hosts: webservers
  become: yes

  vars:
    db_root_password: "MySecurePass123"
    document_root: /var/www/html

  tasks:
    # 安装软件包
    - name: install LAMP packages
      yum:
        name:
          - httpd
          - mariadb-server
          - mariadb
          - php
          - php-mysql
        state: present

    # 创建应用用户和组
    - name: create app group
      group:
        name: app
        state: present

    - name: create app user
      user:
        name: appuser
        group: app
        shell: /bin/bash
        create_home: yes

    # 部署配置文件
    - name: deploy httpd config
      template:
        src: templates/httpd.conf.j2
        dest: /etc/httpd/conf/httpd.conf
        owner: root
        group: root
        mode: 0644
        validate: /usr/sbin/httpd -t
      notify: restart httpd

    # 启动服务
    - name: start and enable services
      systemd:
        name: "{{ item }}"
        state: started
        enabled: yes
      loop:
        - httpd
        - mariadb

    # 配置防火墙
    - name: open firewall ports
      firewalld:
        service: "{{ item }}"
        permanent: yes
        immediate: yes
        state: enabled
      loop:
        - http
        - https

    # 创建数据库
    - name: create database
      mysql_db:
        name: myapp
        state: present

    - name: set mysql root password
      mysql_user:
        name: root
        host: localhost
        password: "{{ db_root_password }}"
        priv: '*.*:ALL,GRANT'
        state: present

    # 创建测试页面
    - name: deploy index page
      copy:
        content: |
          <html>
          <head><title>LAMP Deployed</title></head>
          <body>
          <h1>LAMP Stack Successfully Deployed!</h1>
          <p>Server: {{ ansible_hostname }}</p>
          <p>PHP Version: <?php echo phpversion(); ?></p>
          </body>
          </html>
        dest: "{{ document_root }}/index.php"
        owner: apache
        group: apache
        mode: 0644

  handlers:
    - name: restart httpd
      systemd:
        name: httpd
        state: restarted
 

📌 本文首发于CSDN，转载需注明出处。
💬 如有疑问或补充，欢迎评论区交流！
👍 觉得有用请点赞、收藏、关注，支持作者创作更多优质内容～