1
2
3
4
5
6
7
8

# RHEL/CentOS（需启用EPEL）
sudo yum install ansible

# Ubuntu/Debian
sudo apt install ansible

# 或通过pip
pip install ansible

1
2

[ssh_connection]
pipelining = true   # 大幅提升SSH执行速度

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 未分组主机
client-four.example.com

[webservers]
client-one.example.com
client-two.example.com

[dbservers]
client-one.example.com
client-three.example.com

# 主机变量
new-client.example.com ansible_user=ansible

# FreeBSD客户端（指定Python路径）
freebsd.example.com ansible_python_interpreter=/usr/local/bin/python

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

- name: 安装Nginx
  package:
    name: nginx
    state: present

- name: 启动Nginx
  service:
    name: nginx
    state: started
    enabled: yes

1

ansible hostname -m setup   # 查看所有事实

1
2
3
4
5
6
7

- name: 创建多个用户
  user:
    name: "{{ item.username }}"
    groups: "{{ item.groups }}"
  with_items:
    - {username: alice, groups: wheel}
    - {username: bob, groups: sudo}

1
2
3
4
5

- name: 仅在FreeBSD上设置主机名
  lineinfile:
    path: /etc/rc.conf
    line: "hostname={{ hostname }}"
  when: ansible_os_family == "FreeBSD"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

- name: 配置Web服务器
  hosts: webservers           # 目标组
  become: yes                 # 提权（sudo）
  vars:
    nginx_port: 80
  tasks:
    - name: 安装Nginx
      package: name=nginx state=present
    - name: 复制配置
      template: src=nginx.conf.j2 dest=/etc/nginx/nginx.conf
      notify: restart nginx   # 变更时触发handler
  handlers:
    - name: restart nginx
      service: name=nginx state=restarted

1
2
3

ansible-playbook -i inventory playbook.yml --ask-become-pass
ansible-playbook playbook.yml -l hostname        # 限制执行主机
ansible-playbook playbook.yml -t tag_name        # 仅执行特定标签

1
2
3
4
5
6

- name: 部署Web应用
  hosts: webservers
  roles:
    - common
    - {role: nginx, nginx_port: 8080}   # 带参数的角色实例
    - postgresql

1

ansible-galaxy install ANXS.postgresql

1
2
3
4

ansible-vault create secrets.yml          # 创建加密文件
ansible-vault edit secrets.yml            # 编辑
ansible-vault decrypt secrets.yml         # 解密
ansible-playbook playbook.yml --ask-vault-pass

1
2
3

# 通用引导脚本（推荐）
curl -L https://bootstrap.saltstack.com -o /tmp/saltboot
sudo sh /tmp/saltboot -P -M   # -P安装Python，-M安装master

1
2
3

sudo salt-key -l unaccepted   # 查看待批准minion
sudo salt-key -yA             # 批准所有待批准密钥
sudo salt '*' test.ping       # 测试连通性

1
2
3
4

file_roots:
  base: /srv/salt
pillar_roots:
  base: /srv/pillar

1
2
3
4
5
6
7

base:
  '*':                    # 所有minion
    - bootstrap
  'G@os:Ubuntu':          # grain匹配
    - ubuntu
  'webserver':            # grain值
    - nginx

1
2
3
4
5

base:
  '*':
    - baseline
  'G@os:FreeBSD':
    - freebsd

1
2

salt '*' grains.items      # 查看所有grain
salt '*' pillar.items      # 查看所有pillar值

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

# 状态ID必须全局唯一（作为散列键）
install-sudo-package:
  pkg.installed:
    - name: sudo
    - refresh: true

create-sudo-group:
  group.present:
    - name: sudo
    - require:              # 依赖声明
      - install-sudo-package

/etc/sudoers:
  file.managed:
    - source: salt://files/sudoers
    - user: root
    - group: wheel
    - mode: '0600'

1
2
3

sudo:
  pkg.installed: []
  group.present: []

1
2
3
4
5
6
7

{% for admin in pillar.admins %}
{{ admin.username }}:
  user.present:
    - gid: {{ admin.username }}
    - groups: [wheel, sudo]
    - fullname: {{ admin.fullname }}
{% endfor %}

1
2
3

salt '*' state.apply               # 应用highstate（所有绑定状态）
salt 'hostname' state.apply webserver   # 仅运行单个state文件
salt -C 'G@os:RedHat' state.apply   # 复合匹配

1
2

salt 'minion' config.get environment   # 查看minion环境
salt 'minion' state.show_top           # 查看minion将运行哪些状态