This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
сервис_ansible [2023/01/04 12:59] val [Фрагмент роли с условиями и отладкой] |
сервис_ansible [2024/06/04 13:46] val [Настройка групп управляемых систем] |
||
---|---|---|---|
Line 5: | Line 5: | ||
* [[https://habrahabr.ru/company/express42/blog/254959/|Ansible — давайте попробуем]] | * [[https://habrahabr.ru/company/express42/blog/254959/|Ansible — давайте попробуем]] | ||
* [[https://habrahabr.ru/post/305400/|Пособие по Ansible]] | * [[https://habrahabr.ru/post/305400/|Пособие по Ansible]] | ||
+ | * [[https://habr.com/ru/post/508762/|Основы Ansible, без которых ваши плейбуки — комок слипшихся макарон]] | ||
* [[https://www.cisco.com/c/dam/m/ru_ru/training-events/2019/cisco-connect/pdf/introduction_automation_with_ansible_idrey.pdf|Введение в автоматизацию с помощью Ansible (Cisco)]] | * [[https://www.cisco.com/c/dam/m/ru_ru/training-events/2019/cisco-connect/pdf/introduction_automation_with_ansible_idrey.pdf|Введение в автоматизацию с помощью Ansible (Cisco)]] | ||
Line 37: | Line 38: | ||
<code> | <code> | ||
- | debian11# mkdir /etc/ansible/ | + | debian11_12# mkdir /etc/ansible/ |
node1# cat /etc/ansible/hosts | node1# cat /etc/ansible/hosts | ||
Line 67: | Line 68: | ||
ansible_ssh_user=vagrant | ansible_ssh_user=vagrant | ||
ansible_ssh_pass=strongpassword | ansible_ssh_pass=strongpassword | ||
+ | #ansible_sudo_pass=strongpassword | ||
ansible_become=yes | ansible_become=yes | ||
</code> | </code> | ||
Line 78: | Line 80: | ||
</code><code> | </code><code> | ||
[defaults] | [defaults] | ||
- | ... | + | #... |
host_key_checking = False | host_key_checking = False | ||
- | ... | + | #... |
</code> | </code> | ||
Line 105: | Line 107: | ||
node1# ansible corpX -m command -a 'uname -a' | node1# ansible corpX -m command -a 'uname -a' | ||
- | node1# ansible corpX -a 'uname -a' | ||
+ | kube1# ansible kubes -a 'sed -i"" -e "/swap/s/^/#/" /etc/fstab' | ||
+ | kube1# ansible kubes -a 'swapoff -a' | ||
+ | ИЛИ | ||
+ | (venv1) server# ansible all -a 'sed -i"" -e "/swap/s/^/#/" /etc/fstab' -i /root/kubespray/inventory/mycluster/hosts.yaml #--limit=kube4,kube5 | ||
+ | (venv1) server# ansible all -a 'swapoff -a' -i /root/kubespray/inventory/mycluster/hosts.yaml #--limit=kube4 | ||
node1# ansible corpX -f 2 -m apt -a 'pkg=apache2 state=present update_cache=true' | node1# ansible corpX -f 2 -m apt -a 'pkg=apache2 state=present update_cache=true' | ||
- | node1# ansible addnodes -vv -f 5 -m apt -a 'pkg=ceph,tgt-rbd state=present update_cache=true' | + | node1# ansible addnodes -vv -f 5 -m apt -a 'pkg=ceph,tgt-rbd state=present update_cache=true' #-e 'https_proxy=http://radio.specialist.ru:3128/' -e 'http_proxy=http://radio.specialist.ru:3128/' |
server# ansible nodes -f 3 -m apt -a 'pkg=openvpn state=present update_cache=true' | server# ansible nodes -f 3 -m apt -a 'pkg=openvpn state=present update_cache=true' | ||
- | server# ansible nodes -f 3 -m apt -a 'pkg=docker.io state=absent update_cache=true' | + | server# ansible nodes -f 3 -m apt -a 'pkg=docker.io state=present update_cache=true' |
Line 139: | Line 145: | ||
λ touch provision_docker.yml | λ touch provision_docker.yml | ||
+ | |||
+ | или | ||
+ | |||
+ | student@node1:~$ cat /vagrant/provision_docker.yml | ||
</code><code> | </code><code> | ||
- hosts: "{{ variable_host | default('all') }}" | - hosts: "{{ variable_host | default('all') }}" | ||
Line 213: | Line 223: | ||
</code><code> | </code><code> | ||
+ | node1# ansible-playbook addusers.yml --syntax-check | ||
+ | |||
+ | node1# apt install ansible-lint | ||
+ | node1# ansible-lint addusers.yml | ||
+ | |||
node1# ansible-playbook addusers.yml | node1# ansible-playbook addusers.yml | ||
</code> | </code> | ||
Line 225: | Line 240: | ||
- hosts: sws | - hosts: sws | ||
connection: local | connection: local | ||
+ | gather_facts: no | ||
tasks: | tasks: | ||
- name: configure top level configuration | - name: configure top level configuration | ||
Line 231: | Line 247: | ||
- snmp-server community write RW | - snmp-server community write RW | ||
| | ||
- | - ip host server 192.168.X.10 | + | # - ip host server 192.168.X.10 |
- | + | # - snmp-server host server writetrap | |
- | - snmp-server host server writetrap | + | |
# - snmp-server enable traps config | # - snmp-server enable traps config | ||
Line 352: | Line 367: | ||
</code> | </code> | ||
===== Использование handlers ===== | ===== Использование handlers ===== | ||
+ | |||
+ | ==== Пример 1 ==== | ||
* [[Сервис HTTP#Использование домашних каталогов]] | * [[Сервис HTTP#Использование домашних каталогов]] | ||
Line 375: | Line 392: | ||
</code> | </code> | ||
+ | ==== Пример 2 ==== | ||
+ | |||
+ | <code> | ||
+ | server# cat za.conf | ||
+ | </code><code> | ||
+ | ListenIP=0.0.0.0 | ||
+ | StartAgents=0 | ||
+ | ServerActive=server | ||
+ | UserParameter=listinstalledsoft,ls /usr/share/applications | awk -F '.desktop' ' { print $1}' - | ||
+ | </code><code> | ||
+ | node1# cat za.yml | ||
+ | </code><code> | ||
+ | - hosts: lin_ws | ||
+ | tasks: | ||
+ | - name: Install zabbix agent | ||
+ | apt: pkg=zabbix-agent state=present update_cache=true | ||
+ | |||
+ | - name: Create conf file | ||
+ | copy: src=za.conf dest=/etc/zabbix/zabbix_agentd.conf.d/za.conf | ||
+ | notify: | ||
+ | - restart za | ||
+ | |||
+ | handlers: | ||
+ | - name: restart za | ||
+ | service: name=zabbix-agent state=restarted | ||
+ | </code><code> | ||
+ | server# ansible-playbook za.yml | ||
+ | </code> | ||
===== Использование ролей ===== | ===== Использование ролей ===== | ||
Line 384: | Line 429: | ||
<code> | <code> | ||
+ | # ###cd /root/conf/ | ||
+ | # ###git pull origin master | ||
+ | # ###cd /root/conf/ansible/roles/ | ||
+ | |||
# cat nodes.yml | # cat nodes.yml | ||
</code><code> | </code><code> | ||
- name: Network config for nodes | - name: Network config for nodes | ||
hosts: addnodes | hosts: addnodes | ||
+ | # hosts: kubes | ||
+ | # hosts: all | ||
roles: | roles: | ||
- node | - node | ||
Line 396: | Line 447: | ||
</code><code> | </code><code> | ||
name_prefix: node | name_prefix: node | ||
+ | #name_prefix: kube | ||
X: "{{ ansible_eth0.ipv4.address.split('.')[2] }}" | X: "{{ ansible_eth0.ipv4.address.split('.')[2] }}" | ||
- | N: "{{ ansible_eth0.ipv4.address.split('.')[3] }}" | + | N: "{{ ansible_eth0.ipv4.address.split('.')[3][-1] }}" |
</code><code> | </code><code> | ||
# cat node/tasks/main.yml | # cat node/tasks/main.yml | ||
Line 443: | Line 495: | ||
nameserver 192.168.{{ X }}.1 | nameserver 192.168.{{ X }}.1 | ||
nameserver 192.168.{{ X }}.2 | nameserver 192.168.{{ X }}.2 | ||
+ | #nameserver 192.168.{{ X }}.10 | ||
</code><code> | </code><code> | ||
# cat node/templates/interfaces.j2 | # cat node/templates/interfaces.j2 | ||
Line 454: | Line 507: | ||
netmask 255.255.255.0 | netmask 255.255.255.0 | ||
gateway 192.168.{{ X }}.254 | gateway 192.168.{{ X }}.254 | ||
+ | # gateway 192.168.{{ X }}.1 | ||
</code><code> | </code><code> | ||
# ansible-playbook -f 5 nodes.yml | # ansible-playbook -f 5 nodes.yml | ||
Line 459: | Line 513: | ||
ИЛИ | ИЛИ | ||
- | # ansible-playbook -f 5 conf/ansible/roles/nodes.yml | + | # ansible-playbook -f 5 /root/conf/ansible/roles/nodes.yml |
+ | |||
+ | ИЛИ | ||
+ | |||
+ | (venv1) server# ansible-playbook -f 5 /root/conf/ansible/roles/nodes.yml -i /root/kubespray/inventory/mycluster/hosts.yaml #--limit=kube4 | ||
</code> | </code> | ||
==== Роль OpenVPN сервера ==== | ==== Роль OpenVPN сервера ==== | ||
<code> | <code> | ||
- | server:~# wget https://val.bmstu.ru/unix/conf.git/conf/ansible/roles/openvpn1.tgz && tar -xvzf openvpn1.tgz | ||
- | |||
- | ИЛИ | ||
- | |||
server:~# mkdir openvpn1 && cd openvpn1 | server:~# mkdir openvpn1 && cd openvpn1 | ||
Line 494: | Line 548: | ||
#push "dhcp-option DNS 192.168.{{X}}.10" | #push "dhcp-option DNS 192.168.{{X}}.10" | ||
#push "block-outside-dns" | #push "block-outside-dns" | ||
+ | #push "dhcp-option DOMAIN corp{{X}}.un" | ||
dh /etc/openvpn/dh2048.pem | dh /etc/openvpn/dh2048.pem | ||
Line 542: | Line 597: | ||
name: openvpn@openvpn1 | name: openvpn@openvpn1 | ||
enabled: yes | enabled: yes | ||
- | state: started | + | # state: started |
</code><code> | </code><code> | ||
server:~/openvpn1# cat openvpn1/handlers/main.yml | server:~/openvpn1# cat openvpn1/handlers/main.yml | ||
Line 582: | Line 637: | ||
when: node_nets[ansible_hostname] is defined | when: node_nets[ansible_hostname] is defined | ||
</code><code> | </code><code> | ||
+ | server:~# wget https://val.bmstu.ru/unix/conf.git/conf/ansible/roles/openvpn1.tgz && tar -xvzf openvpn1.tgz && cd openvpn1 | ||
+ | |||
server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml -e "variable_host=test_nodes" | server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml -e "variable_host=test_nodes" | ||
- | server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml | + | server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml # можно через GitLab CI/CD |
server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml -e "variable_host=all" | server:~/openvpn1# ansible-playbook openvpn1.yaml -i inventory.yaml -e "variable_host=all" | ||
Line 617: | Line 674: | ||
debug: | debug: | ||
msg: octet4 is {{ octet4 }}, X is {{ X }}, hostname is {{hostname}} | msg: octet4 is {{ octet4 }}, X is {{ X }}, hostname is {{hostname}} | ||
+ | | ||
+ | #- meta: end_play | ||
+ | |||
... | ... | ||
</code> | </code> | ||
==== ansible-pull ==== | ==== ansible-pull ==== | ||
+ | |||
+ | * [[https://medium.com/splunkuserdeveloperadministrator/using-ansible-pull-in-ansible-projects-ac04466643e8|Using Ansible Pull In Ansible Projects]] | ||
+ | * [[Инсталяция системы в конфигурации Desktop]] | ||
+ | * [[Переменные окружения]] | ||
+ | |||
+ | === Вариант 1 === | ||
+ | |||
+ | * [[https://habr.com/ru/articles/732736/|GPO для Linux из подручных материалов]] (help.desktop) | ||
<code> | <code> | ||
- | $ cat ansible-pull-example\local.yml | + | client1:~/ansible-pull-gpo# cat thunderbird/tasks/main.yml |
+ | </code><code> | ||
+ | - name: Install Thunderbird | ||
+ | apt: pkg=thunderbird state=present update_cache=true | ||
+ | </code><code> | ||
+ | client1:~/ansible-pull-gpo# cat proxy/files/etc/environment | ||
+ | </code><code> | ||
+ | #http_proxy=http://gate.corpX.un:3128 | ||
+ | https_proxy=http://gate.corpX.un:3128 | ||
+ | no_proxy=localhost,127.0.0.1,isp.un,corpX.un | ||
+ | </code><code> | ||
+ | client1:~/ansible-pull-gpo# cat proxy/tasks/main.yml | ||
+ | </code><code> | ||
+ | - name: Copy file environment | ||
+ | copy: | ||
+ | src: etc/environment | ||
+ | dest: /etc/environment | ||
+ | </code><code> | ||
+ | client1:~/ansible-pull-gpo# cat local.yml | ||
</code><code> | </code><code> | ||
- hosts: localhost | - hosts: localhost | ||
- | tasks: | + | roles: |
- | - name: ... | + | - role: proxy |
- | ... | + | - role: thunderbird |
</code><code> | </code><code> | ||
+ | client1:~/ansible-pull-gpo# ansible-playbook local.yml | ||
+ | </code> | ||
- | client2:~# crontab -l | + | * [[Инструмент GitLab]] (Создать публичный проект без readme и скопировать подсказки) |
- | 0 */2 * * * sleep ${RANDOM:0:2}m ; /usr/bin/ansible-pull -U http://server.corpX.un/student/ansible-pull-example.git | + | |
+ | <code> | ||
+ | client3:~# ###ansible-pull -U http://gate.corpX.un/user1/ansible-pull-gpo.git | ||
+ | </code><code> | ||
+ | client1:~/ansible-pull-gpo# cat start.sh | ||
+ | </code><code> | ||
+ | #!/bin/bash | ||
+ | |||
+ | apt update | ||
+ | apt install -y git ansible | ||
+ | |||
+ | echo -e "0 */2 * * * \ | ||
+ | /usr/bin/ansible-pull -s 120 -U http://gate.corpX.un/user1/ansible-pull-gpo.git -C $BR 2>&1 | /usr/bin/logger -t ansible-pull\n\ | ||
+ | @reboot sleep 1m; /usr/bin/ansible-pull -U http://gate.corpX.un/user1/ansible-pull-gpo.git -C $BR 2>&1 | /usr/bin/logger -t ansible-pull" | crontab - | ||
+ | |||
+ | init 6 | ||
</code> | </code> | ||
+ | |||
+ | * Инструмент GitLab [[Инструмент GitLab#Подключение через API]] | ||
+ | |||
+ | === Вариант 2 === | ||
+ | |||
+ | * [[Средства программирования shell#Использование диалоговых окон]] | ||
+ | |||
+ | <code> | ||
+ | $ cat ansible-pull-gpo\local.yml | ||
+ | </code><code> | ||
+ | - hosts: localhost | ||
+ | tasks: | ||
+ | |||
+ | - name: Set timezone to Europe/Moscow | ||
+ | timezone: | ||
+ | name: Europe/Moscow | ||
+ | |||
+ | - name: Russian Interface | ||
+ | shell: | | ||
+ | echo 'ru_RU.UTF-8 UTF-8' > /etc/locale.gen | ||
+ | locale-gen | ||
+ | echo LANG=ru_RU.UTF-8 > /etc/default/locale | ||
+ | when: CONF_RUS_INT is defined | ||
+ | |||
+ | - name: Install Firefox in Debian | ||
+ | apt: pkg=firefox-esr state=present update_cache=true | ||
+ | # debug: msg="Install Firefox in Debian" | ||
+ | when: ansible_distribution == 'Debian' | ||
+ | |||
+ | - name: Install Firefox in Ubuntu | ||
+ | apt: pkg=firefox state=present update_cache=true | ||
+ | # debug: msg="Install Firefox in Ubuntu" | ||
+ | when: ansible_distribution == 'Ubuntu' | ||
+ | |||
+ | - name: Install Thunderbird | ||
+ | apt: pkg=thunderbird state=present update_cache=true | ||
+ | when: PROG_THBIRD is defined | ||
+ | |||
+ | roles: | ||
+ | - role: zabbix_agent | ||
+ | when: ROLE_ZAB_AG is defined | ||
+ | |||
+ | - role: openvpn1_client | ||
+ | when: ROLE_OVPN1_CL is defined | ||
+ | </code><code> | ||
+ | client1:~# cat /usr/local/etc/gpo_options.yml | ||
+ | </code><code> | ||
+ | CONF_RUS_INT: | ||
+ | PROG_THBIRD: | ||
+ | ROLE_ZAB_AG: | ||
+ | </code><code> | ||
+ | client1:~# /usr/bin/ansible-pull -U http://server.corp13.un/student/ansible-pull-gpo.git -C test -e @/usr/local/etc/gpo_options.yml | ||
+ | </code> | ||
+ | |||
+ | * [[Планирование выполнения заданий в Linux#Сервис cron]] | ||
====== Дополнительные материалы ====== | ====== Дополнительные материалы ====== | ||
+ | |||
+ | ===== Вместо ansible ===== | ||
<code> | <code> | ||
- | выполнение команд на цисках через ансибл | + | for i in 1 2 3; do ssh node$i "apt update && apt install apache2; done |
+ | </code> | ||
+ | ===== выполнение команд на цисках через ансибл ===== | ||
+ | <code> | ||
1. добавить в /etc/ansible/group_vars/all.yml строки | 1. добавить в /etc/ansible/group_vars/all.yml строки | ||
ansible_connection: network_cli | ansible_connection: network_cli |