由于本人10.17已成功考过CSA，经过两周所学的ansible并结合题库整理出来的CE解析版
我也是11月月底就要考了，不过这套解析也是可以满足今年的redhat8题库
文中可能涉及一些命令的参数解释，如有不懂的伙伴可参考我的笔记Ansible
ps：一切模板似的题库考试，都需要经过大脑的理解 方可顺利上岸
正文开始：
文章目录
- 1、安装和配置Ansible
- 2、创建和运行Ansible临时命令
- 3、安装软件包
- 4、使用RHEL系统角色
- 5、使用Ansible Galaxy安装角色
- 6、创建和使用角色
- 7、从Ansible Galaxy使用角色
- 8、创建和使用逻辑卷
- 9、生成主机文件
- 10、修改文件内容
- 11、创建 Web 内容目录
- 12、生成硬件报告
- 13、创建密码库
- 14、创建用户账户
- 15、更新 Ansible 库的密钥
- 16、配置 cron 作业
1、安装和配置Ansible
创建主机清单
修改配置文件
//必须修改的配置文件[grep@control ansible]$ vi ansible.cfg[defaults]inventory = /home/student/ansible/inventoryremote_user = greg ——自己所使用的用户roles_path = /home/student/ansible/roles host_key_checking = false ——主机之前传输文件不需要密钥认证[privilege_escalation] 普通用户之间可以使用sudo模式become = truebecome_method = sudobecome_user = rootbecome_ask_pass = false[greg@control ansible]$ mkdir roles测试是否可以ping通
2、创建和运行Ansible临时命令
考试时可以开启两台终端，另一半负责查看模块帮助文档，在练习当中需记住模块的使用就好
[greg@control ansible]$ ansible-doc yum_repository
node1进行验证
[greg@node1 yum. repos.d]$ yum list all | wc -l
6336
3、安装软件包
测试：
4、使用RHEL系统角色
首先下载系统角色
调用角色配置
写入主配置文件
roles: 用来调用timesync中的角色模块
执行
测试
5、使用Ansible Galaxy安装角色
balancer: 使用的是负载均衡
phpinfo: php测试
将两对角色下载到本地
-r 指定使用那个play下载角色 -p 指定下载目录
6、创建和使用角色
手动创建角色
[greg@control ansible]$ cat htttp.yml ---- name: install hosts: webservers roles: - apache[greg@control ansible]$ curl 172.25.250.11Welcome to node3.lab.example.com on 172.25.250.11[greg@control ansible]$ curl 172.25.250.12Welcome to node4.lab.example.com on 172.25.250.127、从Ansible Galaxy使用角色
这题可能说的有点绕，但是仔细想想其实就是通过利用balancers角色里的haproxy部署好负载均衡
然后webservers组里包含着node3、node4主机，然而在第六题已经在webservers主机组部署好httpd服务和默认网页
第一步实验目的是实现在node5上负载均衡到webservers主机组
清单
PHP角色测试的内容
直接使用webservers组的IP访问
8、创建和使用逻辑卷
任务执行流程：
- 当block任务执行成功的时候，则执行always任务
- 当block任务执行失败的时候，则执行resvue任务，最后执行always任务（block任务执行失败，但是playbook不中止）
when语句是用来判断research卷组是否在data逻辑卷里面,如果存在则执行操作
测试：
[greg@control ansible] ansible all -a 'lvs'[root@node2 ~]# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTvda 252:0 0 10G 0 disk └─vda1 252:1 0 10G 0 part /vdb 252:16 0 5G 0 disk └─research-data 253:0 0 1.5G 0 lvm [greg@node3 ~]$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTvda 252:0 0 10G 0 disk └─vda1 252:1 0 10G 0 part /vdb 252:16 0 5G 0 disk └─vdb1 252:17 0 1G 0 part └─research-data 253:0 0 800M 0 lvm 9、生成主机文件
[greg@control ansible]$ wget http://materials/hosts.j2--2022-11-09 11:07:41-- http://materials/hosts.j2Resolving materials (materials)... 172.25.254.254Connecting to materials (materials)|172.25.254.254|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 147Saving to: ‘hosts.j2’hosts.j2 100%[===================>] 147 --.-KB/s in 0s 2022-11-09 11:07:41 (37.9 MB/s) - ‘hosts.j2’ saved [147/147][greg@control ansible]$ lsadhoc.sh hosts.j2 lv.yml roles timesync.ymlansible.cfg inventory packages.yml roles.yml[greg@control ansible]$ vim hosts.j2 [greg@control ansible]$ cat hosts.j2 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6{% for host in groups.all %} ——循环匹配所有主机中的内容{{ hostvars[host].ansible_enp1s0.ipv4.address }} ——匹配主机组中IP地址{{ hostvars[host].ansible_fqdn }} ——匹配完全合格域名{{ hostvars[host].ansible_hostname }} ——匹配主机名{% endfor %} ——结束for循环[greg@control ansible]$ cat hosts.yml ---- name: get all facts hosts: all- name: cp to myhosts hosts: dev tasks: - name: cp file template: src: hosts.j2 dest: /etc/myhosts//测试[greg@control ansible]$ ansible-playbook hosts.yml PLAY [get all facts] ***********************************************************TASK [Gathering Facts] *********************************************************ok: [node4]ok: [node2]ok: [node5]ok: [node3]ok: [node1]PLAY [cp to myhosts] ***********************************************************TASK [Gathering Facts] *********************************************************ok: [node1]TASK [cp file] *****************************************************************changed: [node1]PLAY RECAP *********************************************************************node1 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node2 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node3 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node4 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node5 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 //node1[greg@node1 ~]$ cat /etc/myhosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6172.25.250.9node1.lab.example.comnode1172.25.250.10node2.lab.example.comnode2172.25.250.13node5.lab.example.comnode5172.25.250.11node3.lab.example.comnode3172.25.250.12node4.lab.example.comnode410、修改文件内容
//原内容
[greg@node1 ~]$ cat /etc/issue\SKernel \r on an \mcontent ：直接以content给定的字符串或变量值作为文件内容保存到远程主机上，它会替代src选项
[greg@control ansible]$ cat issue.yml ---- name: modify issue hosts: all tasks: - name: input to issue copy: content: | {% if 'dev' in group_names %} ——将dev组中的所有内容替换 Development {% elif 'test' in group_names %} Test {% elif 'prod' in group_names %} Production {% endif %} dest: /etc/issue[greg@control ansible]$ ansible-playbook issue.yml PLAY [modify issue] ************************************************************TASK [Gathering Facts] *********************************************************ok: [node5]ok: [node4]ok: [node3]ok: [node2]ok: [node1]TASK [input to issue] **********************************************************changed: [node4]changed: [node5]changed: [node3]changed: [node2]changed: [node1]PLAY RECAP *********************************************************************node1 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node2 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node3 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node4 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node5 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 //发生改变[greg@node1 ~]$ cat /etc/issueDevelopment11、创建 Web 内容目录
[greg@control ansible]$ cat webcontent.yml ---- name: web station hosts: dev tasks: - name: install rpm yum: name: - httpd - firewalld state: present - name: create group group: name: webdev state: present - name: create /webdev file: path: /webdev state: directory group: webdev mode: 2775 - name: cp copy: content: Development dest: /webdev/index.html - name: set selinux ——修改为http的网页值 sefcontext: target: /webdev(/.*)? setype: httpd_sys_content_t - name: shell shell: cmd: restorecon -Rv /webdev - name: create link ——创建软链接实现共享 file: src: /webdev dest: /var/www/html/webdev state: link - name: restart httpd service: name: httpd state: restarted enabled: yes - name: restart firewalld service: name: firewalld state: restarted enabled: yes - name: firewall for http _放行防火墙规则 firewalld: service: http state: enabled permanent: yes immediate: yes[greg@control ansible]$ ansible-playbook webcontent.yml PLAY [web station] *************************************************************TASK [Gathering Facts] *********************************************************ok: [node1]TASK [install rpm] *************************************************************ok: [node1]TASK [create group] ************************************************************ok: [node1]TASK [create /webdev] **********************************************************ok: [node1]TASK [cp] **********************************************************************ok: [node1]TASK [set selinux] *************************************************************ok: [node1]TASK [shell] *******************************************************************changed: [node1]TASK [create link] *************************************************************changed: [node1]TASK [restart httpd] ***********************************************************changed: [node1]TASK [restart firewalld] *******************************************************changed: [node1]TASK [firewall for http] *******************************************************changed: [node1]PLAY RECAP *********************************************************************node1 : ok=11 changed=5 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 [greg@control ansible]$ curl http://node1.lab.example.com/webdev/Development12、生成硬件报告
replace模块可以根据我们指定的正则表达式替换文件中的字符串，文件中所有被匹配的字符串都会被替换 参数：
-
path参数：2.3版本之前只能用dest、destfile、name指定操作文件，2.4版本中仍然可以用这些参数名，也可以用path
-
regexp参数：必须参数，指定一个python正则表达式，文件中与正则匹配的字符串将会被替换
-
replace参数：指定最终要替换成的字符串 backup参数：是否在修改文件之前对文件进行备份，最好设置为yes。
//依据题目来查找内置变量，输关键字即可[greg@control ansible]$ ansible node2 -m setup > a[greg@control ansible]$ vim a240 "ansible_hostname": "node1", //清单主机名称362 "ansible_memtotal_mb": 1829, //以 MB 表示的总内存大小15 "ansible_bios_version": "1.11.1-3.module+el8+2529+a9686a4d", //BIOS 版本磁盘设备 vda 的大小
vdb则按上面像似
替换内容
开始编写主模块
[greg@control ansible]$ cat hwreport.yml - name: get hwreport hosts: all tasks: - name: create report file get_url: url: http://materials/hwreport.empty dest: /root/hwreport.txt - name: get hostname replace: path: /root/hwreport.txt regexp: 'inventoryhostname' replace: "{{ inventory_hostname }}" ——匹配清单中主机名 - name: get mem replace: path: /root/hwreport.txt regexp: 'memory_in_MB' replace: "{{ ansible_memtotal_mb }}" - name: get bios replace: path: /root/hwreport.txt regexp: 'BIOS_version' replace: "{{ ansible_bios_version }}" - name: get vda replace: path: /root/hwreport.txt regexp: 'disk_vda_size' replace: "{{ ansible_devices.vda.size if ansible_devices.vda is defined else 'NONE' }}" - name: get vdb replace: path: /root/hwreport.txt regexp: 'disk_vdb_size' replace: "{{ ansible_devices.vdb.size if ansible_devices.vdb is defined else 'NONE' }}"测试
[greg@control ansible]$ ansible-playbook hwreport.ymlPLAY [get hwreport] ************************************************************TASK [Gathering Facts] *********************************************************ok: [node5]ok: [node4]ok: [node2]ok: [node3]ok: [node1]TASK [create report file] ******************************************************changed: [node5]changed: [node3]changed: [node2]changed: [node4]changed: [node1]TASK [get hostname] ************************************************************changed: [node2]changed: [node3]changed: [node4]changed: [node5]changed: [node1]TASK [get mem] ***************************************************************** [WARNING]: The value 821 (type int) in a string field was converted to '821'(type string). If this does not look like what you expect, quote the entirevalue to ensure it does not change.changed: [node5]changed: [node2]changed: [node4]changed: [node3] [WARNING]: The value 1829 (type int) in a string field was converted to '1829'(type string). If this does not look like what you expect, quote the entirevalue to ensure it does not change.changed: [node1]TASK [get bios] ****************************************************************changed: [node5]changed: [node4]changed: [node2]changed: [node3]changed: [node1]TASK [get vda] *****************************************************************changed: [node5]changed: [node2]changed: [node4]changed: [node3]changed: [node1]TASK [get vdb] *****************************************************************changed: [node3]changed: [node5]changed: [node2]changed: [node4]changed: [node1]PLAY RECAP *********************************************************************node1 : ok=7 changed=6 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node2 : ok=7 changed=6 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node3 : ok=7 changed=6 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node4 : ok=7 changed=6 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node5 : ok=7 changed=6 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 测试：[root@node2 ~]# lsanaconda-ks.cfg hwreport.txt original-ks.cfg[root@node2 ~]# cat hwreport.txt # Hardware reportHOST=node2MEMORY=821BIOS=1.11.1-3.module+el8+2529+a9686a4dDISK_SIZE_VDA=10.00 GBDISK_SIZE_VDB=5.00 GB[13、创建密码库
[greg@control ansible]$ vim locker.yml---pw_developer: lmadev ——定义两个变量值为的密码为多少pw_manager: lmamgr[greg@control ansible]$ echo whenyouwishuponastar > /home/greg/ansible/secret.txt[greg@control ansible]$ chmod 600 secret.txt [greg@control ansible]$ ansible-vault encrypt locker.yml --vault-id=/home/greg/ansible/secret.txtEncryption successful[greg@control ansible]$ cat locker.yml ——为下一题的用户密码做准备$ANSIBLE_VAULT;1.1;AES256343632643961303166343561326334303632636266633033663438316332363836666635326538643237366536646632623438666538393334343930363833330a376636616536333639336135623633366464653238313931376366393238383032383966316166323033383135643531346237316133393738633834323336610a37643964636235633530646362393564373434666336616538356337336130646438353932376537383639323265613062613761343366343534363532646430613961623439616366633033623163326433653134643864666430343263646314、创建用户账户
下载用户列表
[greg@control ansible]$ wget http://materials/user_list.yml[greg@control ansible]$ cat user_list.yml users: - name: bob job: developer ——定义工作组中存在的用户 - name: sally job: manager - name: fred ——实事匹配的用户 job: developer使用with_items迭代功能进行实现匹配文件中的多个键值
sha512是哈希大家庭里中的一个，哈希都有不可逆的特性。我们可以把它理解为无法解密的加密。
编写任务
[greg@control ansible]$ cat users.yml ---- name: create developer user hosts: dev,test vars_files: ——定义的变量文件获取 - /home/greg/ansible/locker.yml - /home/greg/ansible/user_list.yml tasks: ——创建devops组 - name: create group devops group: name: devops state: present - name: create user in developer ——调用工作组的用户 user: name: "{{ item.name }}" ——匹配developer工作组中的多个用户进行创建 groups: devops ——所属组 password: "{{ pw_developer | password_hash('sha512') }}" ——pw_developer调用locker.yml中加密的密码并常用采用 SHA512 哈希格式 state: present loop: "{{ users }}" ——匹配循环将结果给后面 when: item.job == "developer" ——判断该工作目录在developer- name: create developer user hosts: prod vars_files: - /home/greg/ansible/locker.yml - /home/greg/ansible/user_list.yml tasks: - name: create group opsmgr group: name: opsmgr state: present - name: create user in manager ——指定工作组 user: name: "{{ item.name }}" groups: opsmgr password: "{{ pw_manager | password_hash('sha512') }}" state: present loop: "{{ users }}" when: item.job == "manager"[greg@control ansible]$ ansible-playbook users.yml --vault-id secret.txtPLAY [create developer user] ***************************************************TASK [Gathering Facts] *********************************************************ok: [node2]ok: [node1]TASK [create group devops] *****************************************************ok: [node2]ok: [node1]TASK [create user in developer] ************************************************changed: [node2] => (item={'name': 'bob', 'job': 'developer'})skipping: [node2] => (item={'name': 'sally', 'job': 'manager'}) changed: [node1] => (item={'name': 'bob', 'job': 'developer'})skipping: [node1] => (item={'name': 'sally', 'job': 'manager'}) changed: [node2] => (item={'name': 'fred', 'job': 'developer'})changed: [node1] => (item={'name': 'fred', 'job': 'developer'})PLAY [create developer user] ***************************************************TASK [Gathering Facts] *********************************************************ok: [node4]ok: [node3]TASK [create group opsmgr] *****************************************************ok: [node4]ok: [node3]TASK [create user in manager] **************************************************skipping: [node3] => (item={'name': 'bob', 'job': 'developer'}) skipping: [node4] => (item={'name': 'bob', 'job': 'developer'}) changed: [node3] => (item={'name': 'sally', 'job': 'manager'})skipping: [node3] => (item={'name': 'fred', 'job': 'developer'}) changed: [node4] => (item={'name': 'sally', 'job': 'manager'})skipping: [node4] => (item={'name': 'fred', 'job': 'developer'}) PLAY RECAP *********************************************************************node1 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node2 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node3 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node4 : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 测试：//可见test组已经完成创建了[root@node2 ~]# id bob uid=1002(bob) gid=1003(bob) groups=1003(bob),1002(devops)[root@node2 ~]# id fred uid=1003(fred) gid=1004(fred) groups=1004(fred),1002(devops)15、更新 Ansible 库的密钥
[greg@control ansible]$ - [ ] wget http://materials/salaries.yml--2022-11-09 16:14:42-- http://materials/salaries.ymlResolving materials (materials)... 172.25.254.254Connecting to materials (materials)|172.25.254.254|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 355Saving to: ‘salaries.yml’salaries.yml 100%[===================>] 355 --.-KB/s in 0s 2022-11-09 16:14:42 (66.0 MB/s) - ‘salaries.yml’ saved [355/355][greg@control ansible]$ ansible-vault rekey salaries.ymlVault password: New Vault password: Confirm New Vault password: Rekey successful[greg@control ansible]$ cat salaries.yml $ANSIBLE_VAULT;1.1;AES256383133616239303738393636386561303138626362356263353431313832303736376232333962333632303738386561346563313162353737343137653730340a663334366434373033653262376333303936323830306662376230396436333638336433313738613465616439623039643534356631623638366139633830390a356331316633623932396636373932613365376539656139633133376637653816、配置 cron 作业
创建⼀个名为 /home/greg/ansible/cron.yml 的 playbook ，配置 cron 作业，该作业每隔 2 分钟运⾏并执⾏以下命令：
logger “EX294 in progress”，以⽤户 natasha 身份运⾏
[greg@control ansible]$ cat cron.yml ---- name: create cron hosts: all tasks: - name: create user user: name: natasha state: present - name: create cron for all cron: name: crontab minute: '*/2' job: logger "EX294 in progress" user: natasha[greg@control ansible]$ ansible-playbook cron.yml PLAY [create cron] *************************************************************TASK [Gathering Facts] *********************************************************ok: [node4]ok: [node3]ok: [node5]ok: [node2]ok: [node1]TASK [create user] *************************************************************changed: [node2]changed: [node3]changed: [node4]changed: [node1]changed: [node5]TASK [create cron for all] *****************************************************changed: [node5]changed: [node4]changed: [node2]changed: [node3]changed: [node1]PLAY RECAP *********************************************************************node1 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node2 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node3 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node4 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 node5 : ok=3 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 [root@node2 ~]# crontab -u natasha -l#Ansible: crontab*/2 * * * * logger "EX294 in progress"
