本文已参与 ⌈新人创作礼⌋ 活动，一起开启掘金创作之路。
ansible2.9.9笔记
下载链接：
releases.ansible.com/ansible/
下载的包：ansible-2.9.9-1.el7.ans.noarch.rpm
[root@ansible ~]# rpm -ivh ansible-2.9.9-1.el7.ans.noarch.rpm
warning: ansible-2.9.9-1.el7.ans.noarch.rpm: Header V4 RSA/SHA1 Signature, key ID 442667a9: NOKEY
error: Failed dependencies:
python-jinja2 is needed by ansible-2.9.9-1.el7.ans.noarch
python-paramiko is needed by ansible-2.9.9-1.el7.ans.noarch
python2-cryptography is needed by ansible-2.9.9-1.el7.ans.noarch
sshpass is needed by ansible-2.9.9-1.el7.ans.noarch
yum install python-jinja2 python-paramiko python2-cryptography sshpass
(dl.fedoraproject.org/pub/epel/ep… 因sshpass在epel内，故需要导入外部yum源；也可www.rpmfind.net/linux/rpm2h… 下载)
[root@ansible ~]# rpm -ivh ansible-2.9.9-1.el7.ans.noarch.rpm
warning: ansible-2.9.9-1.el7.ans.noarch.rpm: Header V4 RSA/SHA1 Signature, key ID 442667a9: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:ansible-2.9.9-1.el7.ans ################################# [100%]
[root@ansible ~]#
验证安装：
[root@ansible ~]# ansible --version
ansible 2.9.9
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Sep 26 2019, 13:23:47) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)]
[root@ansible ~]#
因ansible2.3以后不支持Python2.4，导致ansible无法配置Redhat5
临时解决方法：
ansible可以使用script模块执行命令
举例：
[root@ansible ~]# **cat os.sh **
#!/bin/bash
cat /etc/redhat-release
rpm -qa openssh
[root@ansible ~]# ansible all -i hosts.txt -m script -a 'os.sh'
192.168.157.135 | CHANGED => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.157.135 closed.\r\n",
"stderr_lines": [
"Shared connection to 192.168.157.135 closed."
],
"stdout": "Red Hat Enterprise Linux Server release 5.1 (Tikanga)\r\nopenssh-4.3p2-24.el5\r\n",
"stdout_lines": [
"Red Hat Enterprise Linux Server release 5.1 (Tikanga)",
"openssh-4.3p2-24.el5"
]
}
[root@ansible ~]#
三种解决办法：
This post will show three different ways to solve these errors and ease the migration until your servers can be upgraded.
- Use Ansible 2.3
It is perfectly fine to use an older Ansible version. Some features and modules might be missing, but if you have to manage older Linux distributions and cannot install a newer Python version, using a slightly older Ansible version is a way to go. All old releases can be found at release.ansible.com/ansible.
As long as you are able to make the downgrade, and are only running the outdated Ansible version for a limited time, it is probably the easiest way to still automate your RHEL 5 machines.
- Upgrade to a newer Python version（实测：安装Python2.6后ping、shell模块可用，但yum报错，未能排查出原因）
If you cannot use Ansible 2.3 but need to use a newer Ansible version with Red Hat Enterprise Linux 5 - upgrade the Python version on the managed nodes! However, as shown in the example below, especially with Python an updated version is usually installed to an alternative path to not break system tools. And Ansible needs to know where this is.
For example, the EPEL project provides Python 2.6 packages for Red Hat Enterprise Linux in their archives and we will show how to install and use them as an example. Note though that Python 2.6 as well as the EPEL packages for Red Hat Enterprise Linux 5 both reached end of life already, so you are on your own when it comes to support.
To install the packages on a managed node, the appropriate key and EPEL release package need to be installed. Then the package python26 is available for installation.
$ wget
archives.fedoraproject.org/pub/archive…
$ wget
archives.fedoraproject.org/pub/archive…
$ sudo rpm --import RPM-GPG-KEY-EPEL-5
$ sudo yum install epel-release-5-4.noarch.rpm
$ sudo yum install python26
The package does not overwrite the Python binary, but installs the binary at an alternative path, /usr/bin/python2.6. So we need to tell Ansible to look at a different place for the Python library, which can be done with the flag ansible_python_interpreter for example directly in the inventory:
[old]
rhel5.qxyz.de ansible_python_interpreter=/usr/bin/python2.6
That way, the commands work again:
$ ansible rhel5.qxyz.de -m ping
rhel5.qxyz.de | SUCCESS => {
"changed": false,
"ping": "pong"
}
- Use the power of RAW
Last but not least, there is another way to deal with old Python 2.4-only systems - or systems with no Python it all. Due to the way Ansible is built, almost all modules (for Linux/Unix systems, anyway) require Python to run. However, there are two notable exceptions: the raw module, and the script module. They both only send basic commands via the SSH connection, without invoking the underlying module subsystem.
That way, at least basic actions can be performed and managed via Ansible on legacy systems. Additionally, you can use the template function on the local control machine to create scripts on the fly dynamically before you execute them on the spot:
- name: control remote legacy system
hosts: legacy
gather_facts: no
vars_files:
- script_vars.yml
tasks:
- name: create script on the fly to manage system
template:
src: manage_script.sh.j2
dest: "/manage_script.sh”
delegate_to: localhost
- name: execute management script on target system
script:
manage_script.sh
- name: execute raw command to upgrade system
raw:
yum upgrade -y
become: yes
One thing to note here: since Python is not working on the target system, we cannot collect facts and thus we must work with gather_facts: no.
As you see, that way we can include legacy systems in the automation, despite the fact that we are limited to few modules to work with.
Conclusion
For many customers, they want to support their business critical applications for as long as possible, this often includes running it on an older version of Red Hat Enterprise Linux. “If it ain’t broke, don’t fix it,” is a common mantra within IT departments. But automating these older, traditional systems which do not provide standard libraries can be challenging. here are multiple ways to deal with that - deciding which way is best depends on the overall situation and possibilities of the automation setup. Until organizations are faced with the pressing business need to modernize these older systems, Ansible is there to help.
其它笔记：
shell模块
ansible all -i /tmp/xp.txt -m shell -a "cat /etc/redhat-release" --become --become-method=sudo --become-user=root
ansible all -i /tmp/xp.txt -m shell -a "sed -i 's/^Ciphers/#Ciphers/g' /etc/ssh/sshd_config;echo 'Ciphers aes128-ctr,aes192-ctr,aes256-ctr'>>/etc/ssh/sshd_config" --sudo\
playbook格式(/tmp/xp.txt)
10.87.29.101ansible_ssh_user='xp'ansible_ssh_pass='your_password'ansible_sudo_pass='your_password'
\
copy模块-复制文件
ansible all -i /tmp/bb.txt -m copy -a "src=/data/yum/aqjg/CVE-2018-1000805Redhat6 dest=/tmp"
ping模块
ansible all -i /tmp/bb.txt -m ping
script模块
cat os.sh
#!/bin/bash
cat /etc/redhat-release
命令：
ansible all -i hosts.txt -m script -a 'os.sh'
yum模块
file模块
setup模块
获取主机信息
command 命令模块，默认模块（可省略）
