RedHat自动化Ansible的部署

环境说明

hostname	OS	IP	Role
workstation.lab.example.com	Rocky Linux 9.6 minimal	172.25.254.9	workstation (Ansible控制节点)
servera.lab.example.com	Rocky Linux 9.6 minimal	172.25.254.10	servera (Ansible受管节点)
serverb.lab.example.com	Rocky Linux 9.6 minimal	172.25.254.11	serverb (Ansible受管节点)

镜像地址:

https://download.rockylinux.org/pub/rocky/9/isos/x86_64/Rocky-9.6-x86_64-minimal.iso

准备工作

进入系统后更改三台虚拟机IP

#1 安装命令补全工具与vim
dnf install -y bash-completion vim
source /etc/profile.d/bash_completion.sh	#重载bash配置#2 更改IP信息
nmcli connection modify ens160 ipv4.method manual ipv4.addresses 172.25.254.9/24 ipv4.gateway 172.25.254.2 ipv4.dns 8.8.8.8
nmcli connection reload
nmcli connection up ens160

开始部署

1.workstation.example.com 配置

#1 关闭防火墙、禁用SELinux。
[root@workstation ~]# systemctl disable --now firewalld
[root@workstation ~]# sed -i '/^SELINUX=/ c SELINUX=disabled' /etc/selinux/config
[root@workstation ~]# setenforce 0#2 创建devops用户，配置sudo权限
[root@workstation ~]# useradd devops
[root@workstation ~]# echo redhat | passwd --stdin devops
[root@workstation ~]# visudo
# 添加
devops  ALL=(ALL)       NOPASSWD: ALL#3 配置hosts解析
# 添加
[root@workstation ~]# vim /etc/hosts
172.25.254.9 workstation.lab.example.com workstation
172.25.254.10 servera.lab.example.com servera
172.25.254.11 serverb.lab.example.com serverb

2. servera~serverb 设置

#1 创建 devops用户，配置 sudo 权限
useradd devops
echo redhat | passwd --stdin devops# visudo
# 添加
devops  ALL=(ALL)       NOPASSWD: ALL#2 配置hosts解析
# 添加
vi /etc/hosts
172.25.254.9 workstation.lab.example.com workstation
172.25.254.10 servera.lab.example.com servera
172.25.254.11 serverb.lab.example.com serverb

3. workstation 上配置 devops 用户 到 servera~serverb 免密钥互信

[root@workstation ~]# su - devops
[devops@workstation ~]$ ssh-keygen -f ~/.ssh/id_rsa -N '' -q#分发公钥至 servera~serverd，根据提示输入 yes 和 devops 用户密码 redaht
[devops@workstation ~]$ ssh-copy-id devops@servera
[devops@workstation ~]$ ssh-copy-id devops@serverb#测试免密钥互信
[devops@workstation ~]$ for name in server{a..b};do ssh $name hostname;done
servera.lab.example.com
serverb.lab.example.com

4.workstation 上安装ansible与ansible-navigator

[root@workstation ~]# ssh -l devops workstation# 安装所需软件包
#安装 Ansible：
[devops@workstation ~]$ sudo dnf install ansible-core -y# 安装 Ansible Navigator# 1、安装 Python 3 和 pip3：Ansible Navigator 需要 Python 3 环境sudo dnf install python3 python3-pip -y# 2、安装容器运行时：Ansible Navigator 需要 podman 或 docker 作为容器运行时sudo dnf install podman -y# 3、使用 pip 安装最新版本Ansible Navigatorsudo pip3 install ansible-navigator#下载过慢可以使用国内镜像#sudo pip install 包名 -i https://mirrors.aliyun.com/pypi/simple --trusted-host mirrors.aliyun.com# 验证安装：
检查版本：ansible-navigator --version
检测镜像：[devops@workstation ansible]$ ansible-navigator images
# 由于是从互联网下载镜像速度较慢，可以把事先下载好的镜像导入
[devops@workstation ~]$ sudo podman load -i ../creator-ee_v0.22.0.tar# 配置navigator运行环境
[devops@workstation ~]$ mkdir ansible
[devops@workstation ~]$ cd ansible
[devops@workstation ansible]$ vim ansible-navigator.yml
---ansible-navigator:ansible:config:path: ./ansible.cfgcolor:osc4: falseexecution-environment:image: ghcr.io/ansible/creator-ee:v0.22.0pull:policy: missing	#指定了拉取策略，这里的 missing 表示如果本地没有该镜像，则拉取该镜像。playbook-artifact:	# 添加内容，关闭工作日志，在playbook目录下会自动生成.json文件enable: false# 创建角色和集合目录
[devops@workstation ansible]$ mkdir /home/devops/ansible/roles
[devops@workstation ansible]$ mkdir /home/devops/ansible/mycollections# 创建配置文件
[devops@workstation ansible]$ vim /home/devops/ansible/ansible.cfg
[defaults]						
remote_user=devops
inventory=/home/devops/ansible/inventory
collections_path=/home/devops/ansible/mycollections
roles_path=/home/devops/ansible/roles
host_key_checking=False# ansible提权信息
[privilege_escalation]			
become=yes
become_ask_pass=False
become_method=sudo
become_user=root# 创建清单文件
[devops@workstation ansible]$ vim /home/devops/ansible/inventory
[dev]
servera[test]
serverb

测试

万事俱备，只欠测试

#切换到工作目录
[devops@workstation ~]$ cd ansible/[devops@workstation ansible]$ ansible-inventory --graph
[devops@workstation ansible]$ ansible-navigator inventory -m stdout --graph

#验证环境是否可用，检测控制节点与被控节点的连通性
[devops@workstation ansible]$ ansible all -m ping