技能目标：
· 了解什么是Ansible
· 学会如何使用Ansible部署Docker应用
· 学会如何使用Ansible部署Zabbix
5.1 案例分析
5.1.1案例概述
目前市场上有许多的运维自动化工具( 配置管理 )，例如：Ansible、SaltStack、Puppet、Fabric 等。其中，Ansible一种集成 IT 系统的配置管理、应用部署、执行特定任务的开源平台，是 AnsibleWorks 公司名下的项目，该公司由 Cobbler 及 Func 的作者于 2012 年创建成立。
Ansible 基于 Python 语言实现，由 Paramiko 和 PyYAML 两个关键模块构建，具备如下特点：
· 部署简单，只需在主控端部署 Ansible 环境，被控端无需做任何操作。
· 默认使用 SSH（Secure Shell）协议对设备进行管理。
· 主从集中化管理。
· 配置简单、功能强大、扩展性强。
· 支持 API 及自定义模块，可通过 Python 轻松扩展。
· 通过 Playbooks 来定制强大的配置、状态管理。
· 对云计算平台、大数据都有很好的支持。
· 提供一个功能强大、操作性强的 Web 管理界面和 REST API 接口 ---- AWX 平台。
本案例将展示如何使用Ansible部署一台Apache + MySQL服务器，以及如何使用Ansible部署Zabbix服务端及Zabbix客户端。
5.1.2案例前置知识点
1. Ansible主要组成部分功能说明
· PLAYBOOKS：任务剧本（任务集），编排定义Ansible任务集的配置文件，由Ansible顺序依次执行，通常是JSON格式的YML文件
· INVENTORY：Ansible管理主机的清单/etc/anaible/hosts
· MODULES：Ansible执行命令的功能模块，多数为内置的核心模块，也可自定义,ansible-doc –l 可查看模块
· PLUGINS：模块功能的补充，如连接类型插件、循环插件、变量插件、过滤插件等，该功能不常用
· API：供第三方程序调用的应用程序编程接口
· ANSIBLE：组合INVENTORY、 API、 MODULES、PLUGINS的绿框，可以理解为是ansible命令工具，其为核心执行工具
2. 注意事项
· 执行ansible的主机一般称为主控端，中控，master或堡垒机
· 主控端Python版本需要2.6或以上
· 被控端Python版本小于2.4需要安装python-simplejson
· 被控端如开启SELinux需要安装libselinux-python
· windows不能做为主控端
5.1.2案例环境
1. 本案例实验环境
本案例中环境如表5-1所示。
表5-1 创建并管理Ansible部署Docker网络案例环境
创建并管理本实验网络，具体的拓扑如图5.1所示。
图5.1 实验网络拓扑
2. 案例需求
· 安装Ansible及其依赖
· 编写Playbook
· 实施部署
· 结果验证
3. 案例实现思路
· 安
5.2 案例实施
5.2.1 主机配置
1. 环境初始化
· 推荐安装 CentOS 7.3 及以上版本 Linux 操作系统。
· 配置 root 用户免密码 ssh 登录到受控主机。
[root@bogon ~]# hostnamectl set-hostname master
[root@bogon ~]# bash
[root@master ~]# systemctl stop firewalld
[root@master ~]# systemctl disable firewalld
[root@master ~]# getenforce
Disabled
[root@master ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
08:c9:5b:df:13:51:04:3d:f8:24:43:1b:c8:e8:02:54 root@master
The key's randomart image is:
+--[ RSA 2048]----+
| ...E o o=*o |
| .. .. o +++ |
| .+.. o= . |
| .+.o . .. |
| ... S o |
| . |
| |
| |
| |
+-----------------+
[root@master ~]# ssh-copy-id [email protected]
[root@bogon ~]# hostnamectl set-hostname client
[root@bogon ~]# bash
[root@client ~]# systemctl stop firewalld
[root@client ~]# systemctl disable firewalld
[root@client ~]#
getenforceDisabled
2. 安装Ansible及其依赖
[root@master ~]# rpm -Uvh http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
[root@master ~]# yum install -y ansible
5.2.2 Ansible部署Docker
建立roles目录
首先创建一个ansible目录，之后所有操作均在此目录下进行。
[root@master ~]# mkdir ansible
[root@master ~]# cd ansible
[root@master ansible]# ansible-galaxy init --init-path roles common
- common was created successfully
[root@master ansible]# ansible-galaxy init --init-path roles webserver
- webserver was created successfully
[root@master ansible]# ansible-galaxy init --init-path roles dbserver
- dbserver was created successfully
创建production文件，内容为hosts和groups信息。
[root@master ansible]# vim production
[webservers]
192.168.9.168
[dbservers]
192.168.9.168
建common role任务，主要包含基础环境设置
[root@master ansible]# vim roles/common/tasks/main.yml
---
# tasks file for common
- name: add epel repository
yum_repository:
name: epel
description: EPEL YUM repo
baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/
gpgcheck: no
tags: epel
- name: add docker-ce repository
yum_repository:
name: docker-ce
description: docker-ce YUM repo
baseurl: https://download.docker.com/linux/centos/7/$basearch/stable/
gpgcheck: no
tags: docker
- name: make sure ntp is installed
yum: pkg=ntp state=installed
tags: ntp
- name: make sure docker-ce is installed
yum: pkg=docker-ce state=installed
tags: docker
- name: make sure python-pip is installed
yum: pkg=python-pip state=installed
tags: pip
- name: make sure ntp is configured
template: class="lazy" src="//p2.ttnews.xyz/loading.gif" data-original=ntp.conf.j2 dest=/etc/ntp.conf
notify:
- restart ntpd
tags: ntp
- name: make sure ntpd is running and enabled
service: name=ntpd state=started enabled=yes
tags: ntp
- name: make sure firewalld is stopped and disabled
service: name=firewalld state=stopped enabled=no
tags: firewalld
- name: make sure docker-py is installed
pip:
name: docker-py
- name: make sure docker is installed
yum: pkg=docker-ce state=installed
tags: docker
- name: make sure docker is running and enabled
service: name=docker state=started enabled=yes
tags: docker
[root@master ansible]# vim roles/common/handlers/main.yml
---
# handlers file for common
- name: restart ntpd
service: name=ntpd state=restarted
[root@master ansible]#
mkdir group_vars[root@master ansible]# vim group_vars/all
ntpserver: cn.ntp.org.cn
[root@master ansible]# vim roles/common/templates/ntp.conf.j2
driftfile /var/lib/ntp/drift
pidfile /var/run/ntpd.pid
logfile /var/log/ntp.log
# Access Control Support
restrict default ignore
restrict -6 default ignore
restrict 127.0.0.1
server {{ ntpserver }}
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
创建webserver role任务，主要包含httpd容器的启动
[root@master ansible]# vim roles/webserver/tasks/main.yml
---
# tasks file for webserver
- name: create httpd container
docker_container:
name: apache
image: httpd
state: started
restart: yes
ports:
- "80:80"
tags: httpd
创建dbserverrole任务，主要包含mysql容器的启动
[root@master ansible]# vim roles/dbserver/tasks/main.yml
[root@master ansible]# /root/ansible/roles/dbserver/tasks/main.yml
---
# tasks file for dbserver
- name: create mysql container
docker_container:
name: mysql
image: mysql
state: started
restart: yes
ports:
- "3306:3306"
env:
MYSQL_ROOT_PASSWORD: mysql@135
tags: mysql
创建webservers.yml
[root@master ansible]# vim webservers.yml
---
- hosts: webservers
roles:
- common
- webserver
创建dbservers.yml
[root@master ansible]# vim dbservers.yml
---
- hosts: dbservers
roles:
- common
- dbserver
创建site.yml
[root@master ansible]# vim site.yml
---
- import_playbook: webservers.yml
- import_playbook: dbservers.yml
运行部署命令
[root@master ansible]# ansible-playbook site.yml -i production
。。。。。。 //省略部分内容
TASK [dbserver : create mysql container] ****************************************************
changed: [192.168.9.168]
PLAY RECAP **********************************************************************************
192.168.9.168 : ok=27 changed=10 unreachable=0 failed=0
验证结果
登录受控主机，执行"docker ps"命令，查看docker容器是否运行。
[root@client ~]# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
39ef95a4e3f4 mysql "docker-entrypoint.s…" 2 minutes ago Up 2 minutes 0.0.0.0:3306->3306/tcp, 33060/tcp mysql
b22c957feb4c httpd "httpd-foreground" 6 minutes ago Up 6 minutes 0.0.0.0:80->80/tcp apache
5.2.3 Ansible部署Zabbix
建立roles目录
首先创建一个ansible目录，之后所有操作均在此目录下进行。
[root@master ansible]# mkdir zabbix
[root@master ansible]# cd zabbix/
[root@master zabbix]# ansible-galaxy init --init-path roles common
- common was created successfully
[root@master zabbix]# ansible-galaxy init --init-path roles zbxserver
- zbxserver was created successfully
[root@master zabbix]# ansible-galaxy init --init-path roles zbxagent
- zbxagent was created successfully
创建production文件，内容为hosts和groups信息
[root@master zabbix]# vim production-zabbix
[zbxservers]
192.168.9.168
[zbxagents]
192.168.9.168
创建common role任务，主要包含基础环境设置
[root@master zabbix]#
vim roles/common/tasks/main.yml---
# tasks file for common
- name: add epel repository
yum_repository:
name: epel
description: EPEL YUM repo
baseurl: https://download.fedoraproject.org/pub/epel/$releasever/$basearch/
gpgcheck: no
tags: epel
- name: add zabbix repository
yum_repository:
name: zabbix
description: Zabbix YUM repo
baseurl: http://repo.zabbix.com/zabbix/3.2/rhel/7/$basearch/
gpgcheck: no
tags: zabbix
- name: add non-support zabbix repository
yum_repository:
name: zabbix-non-supported
description: Zabbix-non-supported YUM repo
baseurl: http://repo.zabbix.com/non-supported/rhel/7/$basearch/
gpgcheck: no
tags: zabbix
- name: make sure ntp is installed
yum: pkg=ntp state=installed
tags: ntp
- name: make sure python-pip is installed
yum: pkg=python-pip state=installed
tags: pip
- name: make sure ntp is configured
template: class="lazy" src="//p2.ttnews.xyz/loading.gif" data-original=ntp.conf.j2 dest=/etc/ntp.conf
notify:
- restart ntpd
tags: ntp
- name: make sure ntpd is running and enabled
service: name=ntpd state=started enabled=yes
tags: ntp
- name: make sure firewalld is stopped and disabled
service: name=firewalld state=stopped enabled=no
tags: firewalld
[root@master zabbix]# vim roles/common/handlers/main.yml
---
# handlers file for common
- name: restart ntpd
service: name=ntpd state=restarted
[root@master zabbix]# mkdir group_vars
[root@master zabbix]# vim group_vars/all
ntpserver: cn.ntp.org.cn
[root@master zabbix]# vim roles/common/templates/ntp.conf.j2
driftfile /var/lib/ntp/drift
pidfile /var/run/ntpd.pid
logfile /var/log/ntp.log
# Access Control Support
restrict default ignore
restrict -6 default ignore
restrict 127.0.0.1
server {{ ntpserver }}
includefile /etc/ntp/crypto/pw
keys /etc/ntp/keys
创建zbxserver role任务，主要包含httpd、php、mariadb-server、zabbix-server和zabbix-web的安装、配置及启动操作
[root@master zabbix]# vim roles/zbxserver/tasks/main.yml
---
# tasks file for zbxserver
- name: make sure httpd/php/mariadb-server/zabbix-server/zabbix-web are installed
yum: pkg={{ item }} state=installed
with_items:
- httpd
- php
- mariadb-server
- zabbix-server-mysql
- zabbix-web-mysql
- name: make sure php is configured
template: class="lazy" data-original=php.ini.j2 dest=/etc/php.ini
- name: make sure zabbix-server is configured
template: class="lazy" data-original=zabbix_server.conf.j2 dest=/etc/zabbix/zabbix_server.conf
- name: make sure httpd & mariadb & zabbix-server are running and enabled
service: name={{ item }} state=started enabled=yes
with_items:
- httpd
- mariadb
- zabbix-server
在主控端手动安装php，然后拷贝现有/etc/php.ini文件至roles/zbxserver/templates/php.ini.j2，并修改以下配置项
[root@master zabbix]# yum install -y php
[root@master zabbix]# cp /etc/php.ini roles/zbxserver/templates/php.ini.j2
[root@master zabbix]# vim roles/zbxserver/templates/php.ini.j2
post_max_size = 16M
max_execution_time = 300
max_input_time = 300
memory_limit = 128M
upload_max_filesize = 2M
date.timezone = Asia/Shanghai
在主控端手动安装zabbix-server，然后拷贝现有/etc/zabbix/zabbix_server.conf文件至roles/zbxserver/templates/zabbix_server.conf.j2，并修改以下配置项
[root@master zabbix]# rpm -Uvh http://repo.zabbix.com/zabbix/3.2/rhel/7/x86_64/zabbix-release-3.2-1.el7.noarch.rpm
[root@master zabbix]# yum install -y zabbix-server
[root@master zabbix]# cp /etc/zabbix/zabbix_server.conf roles/zbxserver/templates/zabbix_server.conf.j2
[root@master zabbix]# vim roles/zbxserver/templates/zabbix_server.conf.j2
DBHost=localhost
DBName=zabbix
DBUser=zabbix
DBPassword=123.com
创建zbxagent role任务，主要包含zabbix-agent的安装、配置及启动操作
[root@master zabbix]# vim roles/zbxagent/tasks/main.yml
---
# tasks file for zbxagent
- name: make sure zabbix-agent is installed
yum: pkg=zabbix-agent state=installed
- name: make sure zabbix-agent is configured
template: class="lazy" data-original=zabbix_agent.conf.j2 dest=/etc/za bbix/zabbix_agent.conf
- name: make sure zabbix-agent is running and enabled
service: name=zabbix-agent state=started enabled=yes
在主控端手动安装zabbix-agent，然后拷贝现有/etc/zabbix/zabbix_agentd.conf文件至roles/zbxagent/templates/zabbix_agentd.conf.j2，并修改以下配置项
[root@master zabbix]# yum install -y zabbix-agent
[root@master zabbix]# cp /etc/zabbix/zabbix_agentd.conf roles/zbxagent/templates/zabbix_agentd.conf.j2
[root@master zabbix]#
vim roles/zbxagent/templates/zabbix_agent.conf.j2Server=192.168.9.168
ServerActive=192.168.9.168
Hostname=Zabbix server #Agent本地的名称，此名称需要与将来在server端的WEB页面上的主机名称一致，名称自定义
创建zbxservers.yml
[root@master zabbix]# vim zbxservers.yml
---
- hosts: zbxservers
roles:
- common
- zbxserver
创建zbxagents.yml
[root@master zabbix]# vim zbxagents.yml
---
- hosts: zbxagents
roles:
- common
- zbxagent
创建site.yml
[root@master zabbix]# vim site.yml
---
- import_playbook: zbxservers.yml
- import_playbook: zbxagents.yml
运行部署命令
[root@master zabbix]# ansible-playbook site.yml -i production-zabbix
登录受控主机完成数据库设置
[root@client ~]# mysql
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 4714
Server version: 5.5.60-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> CREATE DATABASE zabbix character set utf8 collate utf8_bin;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON zabbix.* TO 'zabbix'@'localhost' IDENTIFIED BY '123.com';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> quit
Bye
结果验证
浏览器访问http://192.168.9.168/zabbix进入Zabbix 安装界面，如图5.2所示，按步骤完成Zabbix安装操作即可。
图5.2
閱讀更多 Linux高級運維 的文章
