使用ansible远程管理集群

时间 2019-12-11

原文原文链接

使用ansible远程执行命令

1.ansible简介

ansible的官方定义：“Ansible is Simple IT Automation”——简单的自动化IT工具。这个工具的目标：linux

自动化部署APP
自动化管理配置项
自动化的持续交付
自动化的（AWS）云服务管理。

其本质上就是在远程在多台服务器执行一系列命令和文件同步，和之前的介绍的使用并行ssh提升工做效率功能相似，他们都是使用ssh协议进行远程操做，但ansible比pssh功能更强大，好比支持主机列表分组、支持playbook模板文件等。本文仅仅介绍ansible的Ad-Hoc用法，即默认的command模块，直接在shell执行命令。git

2.安装

ubuntu14.04直接使用apt-get安装：github

sudo apt-get install -y ansible

也可使用pip命令安装：shell

sudo pip install ansible

为了支持输入远程主机用户密码，还须要安装sshpass工具：ubuntu

sudo apt-get install -y sshpass

安装完成后建立~/.hosts文件，内容以下:bash

[local]
ceph-0
[mon]
ceph-1
[osd]
ceph-2
ceph-3

以上配置文件定义了三个主机组，分别为local、mon、osd，ceph-x是主机名。ansible执行须要指定主机列表文件，默认为/etc/hosts,用户也能够经过-i hosts_file指定，咱们修改默认文件为咱们刚刚建立的新文件，建立~/.ansible.cfg,增长如下内容:服务器

[defaults]
hostfile=~/.hosts

3.使用ansible

ansible的简单语法为：session

ansible <host-pattern> [-f forks] [-m module_name] [-a args]

其中host-pattern指定主机组，好比上面的osd、local等，-f指定并行数，默认为5，-m指定模块名，好比ping表示探测远程主机是否可访问，command表示执行shell命令，copy表示传输文件等，默认为command，-a是指定选项参数，不一样的模块具备不一样的参数，好比ping不须要选项，command须要指定执行的命令，copy须要指定src和dest等。另外还有以上提到的-i指定主机列表文件、-u指定远程执行用户名等。
在全部的osd节点执行uptime操做,远程主机必须有同样的用户名和密码，若是不指定用户名，则默认使用当前登陆主机的用户名，不然若是和登陆主机用户名不同，必须经过-u username指定远程主机：dom

ansible osd -a 'uptime'

输出：ssh

ceph-3 | FAILED => SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue
ceph-2 | FAILED => SSH encountered an unknown error during the connection. We recommend you re-run the command using -vvvv, which will enable SSH debugging output to help diagnose the issue

命令执行失败，咱们使用-vvvv选项查看详细信息：

ansible -vvvv osd -a 'uptime'

输出：

ebug1: Trying private key: /home/fgp/.ssh/id_rsa
debug3: no such identity: /home/fgp/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /home/fgp/.ssh/id_dsa
debug3: no such identity: /home/fgp/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /home/fgp/.ssh/id_ecdsa
debug3: no such identity: /home/fgp/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/fgp/.ssh/id_ed25519
debug3: no such identity: /home/fgp/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey,password).

说明咱们既没有密钥文件也没有输入用户密码，所以没法经过ssh认证，须要输入密码，使用-k选项：

➜  ~ ansible  osd -a 'uptime' -k
SSH password:
ceph-2 | success | rc=0 >>
 11:01:17 up 1 day, 6 min,  5 users,  load average: 0.02, 0.02, 0.05

ceph-3 | success | rc=0 >>
 11:01:17 up 1 day, 6 min,  5 users,  load average: 0.03, 0.03, 0.05

执行成功了，输入一次密码后，ansible会保存认证session，在session有效期内，不须要重复输入密码，即在执行了以上命令后，不须要再传递-k参数：

➜  ~ ansible  osd -a 'uptime'
ceph-2 | success | rc=0 >>
 11:02:14 up 1 day, 7 min,  5 users,  load average: 0.01, 0.02, 0.05

ceph-3 | success | rc=0 >>
 11:02:14 up 1 day, 7 min,  5 users,  load average: 0.01, 0.02, 0.05

有效期只有几分钟时间，为了不每次输入密码，建议仍是经过设置密钥来实现免密码登陆，若本地尚未生成密钥文件，则先使用ssh-keygen命令生成密钥文件：

➜  ~ ssh-keygen                                                                                                                                                              [1/1877]
Generating public/private rsa key pair.
Enter file in which to save the key (/home/fgp/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/fgp/.ssh/id_rsa.
Your public key has been saved in /home/fgp/.ssh/id_rsa.pub.
The key fingerprint is:
49:8b:d0:a0:29:69:c8:32:50:3d:fc:8a:0a:4e:c8:1d fgp@ceph-0
The key's randomart image is:
+--[ RSA 2048]----+
|...o.            |
|+. o+o           |
|*oo .o. .        |
|oo E ..o o       |
|o ..... S        |
|oo...            |
|+.               |
|..               |
|                 |
+-----------------+

咱们把~/.ssh/id_rsa.pub文件拷贝到全部的主机，拷贝文件须要指定-m模块名为copy，指定全部的主机的host-pattern为all:

ansible all -m copy -a 'src=~/.ssh/id_rsa.pub dest=~' -k
ansible all -a 'ls' -k # 查看是否传输成功

接下来把公钥追加到~/.ssh/authorized_keys中,咱们须要执行cat ~/id_rsa.pub >> ~/.ssh/命令，但默认的command模块是不支持重定向和管道的，为了使用重定向和管道，咱们使用shell模块：

ansible all -m shell -a 'mkdir -p .ssh' # assure ~/.ssh exist!
ansible all -m shell -a 'cat ~/id_rsa.pub >>  ~/.ssh/authorized_keys' -k

验证下是否工做，注意下面的命令没有指定-k选项：

ansible all -m shell -a 'cat .ssh/authorized_keys'

输出：

➜  ~ ansible all -m shell -a 'cat .ssh/authorized_keys'                                                                                                                      [1/1839]
ceph-0 | success | rc=0 >>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxjl++nrmghoRVQnnJALR8Ia6eD87hdewZ9XZP9Ay3ZU1eU9F5MF0A7I7UY08kY7az7+14YJeP0T+zhEl8trc6NDV47LJnMG8ONVePokCeCvFgukUa8QpAhMWXSRSyUFA3Q4LpVmRu2nat$lSrwhu0W7uazq9OA5YxSCZRV/lb6bTsrrywBT4s9Crr5DWKUeZ1uKeUVghz0KmxH/ICWyFGE3v3OsqTMvtWM/R5m6FIgb86bd3CsM4UAP4v5I4FEx4+iqsbtvww3qOkY3Qj91AGOuYq8yNhFmQVN7VZZ9OR/8Vc0iI1wOG+vylbEJjr0/pjX$pPzPrOtW0Q6PjTKZXL fgp@ceph-0

ceph-3 | success | rc=0 >>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxjl++nrmghoRVQnnJALR8Ia6eD87hdewZ9XZP9Ay3ZU1eU9F5MF0A7I7UY08kY7az7+14YJeP0T+zhEl8trc6NDV47LJnMG8ONVePokCeCvFgukUa8QpAhMWXSRSyUFA3Q4LpVmRu2nat$lSrwhu0W7uazq9OA5YxSCZRV/lb6bTsrrywBT4s9Crr5DWKUeZ1uKeUVghz0KmxH/ICWyFGE3v3OsqTMvtWM/R5m6FIgb86bd3CsM4UAP4v5I4FEx4+iqsbtvww3qOkY3Qj91AGOuYq8yNhFmQVN7VZZ9OR/8Vc0iI1wOG+vylbEJjr0/pjX$pPzPrOtW0Q6PjTKZXL fgp@ceph-0

ceph-2 | success | rc=0 >>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxjl++nrmghoRVQnnJALR8Ia6eD87hdewZ9XZP9Ay3ZU1eU9F5MF0A7I7UY08kY7az7+14YJeP0T+zhEl8trc6NDV47LJnMG8ONVePokCeCvFgukUa8QpAhMWXSRSyUFA3Q4LpVmRu2nat$lSrwhu0W7uazq9OA5YxSCZRV/lb6bTsrrywBT4s9Crr5DWKUeZ1uKeUVghz0KmxH/ICWyFGE3v3OsqTMvtWM/R5m6FIgb86bd3CsM4UAP4v5I4FEx4+iqsbtvww3qOkY3Qj91AGOuYq8yNhFmQVN7VZZ9OR/8Vc0iI1wOG+vylbEJjr0/pjX$pPzPrOtW0Q6PjTKZXL fgp@ceph-0

ceph-1 | success | rc=0 >>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxjl++nrmghoRVQnnJALR8Ia6eD87hdewZ9XZP9Ay3ZU1eU9F5MF0A7I7UY08kY7az7+14YJeP0T+zhEl8trc6NDV47LJnMG8ONVePokCeCvFgukUa8QpAhMWXSRSyUFA3Q4LpVmRu2nat$lSrwhu0W7uazq9OA5YxSCZRV/lb6bTsrrywBT4s9Crr5DWKUeZ1uKeUVghz0KmxH/ICWyFGE3v3OsqTMvtWM/R5m6FIgb86bd3CsM4UAP4v5I4FEx4+iqsbtvww3qOkY3Qj91AGOuYq8yNhFmQVN7VZZ9OR/8Vc0iI1wOG+vylbEJjr0/pjX$pPzPrOtW0Q6PjTKZXL fgp@ceph-0

可见咱们免密码执行远程命令，而且验证了公钥已经追加到~/.ssh/authorized_keys中。
下面咱们执行一下更新操做，命令为apt-get update -y:

ansible all -m shell -a 'apt-get update -y'

输出结果：

ceph-1 | FAILED | rc=100 >>
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
E: Unable to lock directory /var/lib/apt/lists/
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?

ceph-2 | FAILED | rc=100 >>
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
E: Unable to lock directory /var/lib/apt/lists/
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?

ceph-3 | FAILED | rc=100 >>
E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
E: Unable to lock directory /var/lib/apt/lists/
E: Could not open lock file /var/lib/dpkg/lock - open (13: Permission denied)
E: Unable to lock the administration directory (/var/lib/dpkg/), are you root?

执行失败了，显然是因为没有root权限，须要使用sudo执行命令，须要`--sudo``选项：

ansible all --sudo -m shell -a 'apt-get update -y'

若是没有密钥，须要输入sudo密码，须要指定-K选项（大写的K）。

4.总结

ansible的功能很是强大，以上只介绍了如何在命令行远程执行命令，ansible还有更强大的playbook功能，playbook经过yaml文件定义，相似puppet的模板文件，具体能够参考官方文档。