ansible的基础使用（一）

[root@ansible ypc.soft]# ansible --version
ansible 2.6.8 #看到版本是2.6.8
config file = /etc/ansible/ansible.cfg #配置文件所在路径
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.6/site-packages/ansible
executable location = /usr/bin/ansible #依赖的python版本
python version = 2.6.6 (r266:84292, Aug 18 2016, 15:13:37) [GCC 4.4.7 20120313 (Red Hat 4.4.7-17)]

#inventory = /etc/ansible/hosts 主机列表清单配置文件位置
#library = /usr/share/my_modules/ 库文件存放位置
#remote_tmp = ~/.ansible/tmp 临时py命令存放远程主机的目录
ansible的工作原理是当用户执行命令，那么ansible会产生一个py的脚本，这个脚本里面记录的是用户的执行命令，然后通过ssh远程放到被控端家目录.ansible/tmp/下，执行完成之后.ansible/tmp就会自动删除。
#forks = 5 默认并发数，ansible在执行一个任务的时候不是一台机器一台机器去执行的，是同一时间执行5台机器，当然机器配置好的时候可以调整至更大的指，一般默认即可
#sudo_user = root 默认sudo用户。
#ask_sudo_pass = True 每次执行ansible命令是否询问ssh密码
#remote_port = 22 默认ssh远程端口是22
log_path = /var/log/ansible.log 日志文件，ansible默认是没有开启日志记录的，这个要取消注释
host_key_checking = False 检查服务的host_key，建议取消注释

例如我主控端是（192.168.219.135）
我需要在主控端增加主机的ip地址
host配置如下：
192.168.219.136
192.168.219.137
在文件末尾增加两台被控端机器的ip，但是这种方式我们每次执行都需要在命令行输入两台机器的ip地址，十分不方便。
这个时候我们就可以写成组的方式：
host配置如下
[web]
192.168.219.136
192.168.219.137
在ip前面加上一个组名用中括号定义即可

ansible-doc ping （查看指定模块的使用方法和参数）
> PING (/usr/lib/python2.6/site-packages/ansible/modules/system/ping.py)[root@ansible .ssh]# ansible-doc -l （列出所有模块）
a10_server Manage A10 Networks AX...
a10_server_axapi3 Manage A10 Networks AX...[root@ansible .ssh]# ansible-doc -s ping （查看指定模块的用法，简易模式显示）
- name: Try to connect to host, verify a usable python and return `pong' on suc
ping:

[root@ansible .ssh]# ansible "w*" -m ping
192.168.219.137 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.219.136 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible .ssh]#[root@ansible .ssh]# ansible 192.168.219.* -m ping
192.168.219.136 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.219.137 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible .ssh]#

[root@ansible .ssh]# ansible "web:&dbserver" -m ping
192.168.219.136 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.219.137 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible .ssh]#

ansible "web:!dbserver" -m ping

[root@ansible ansible]# ansible web -m ping -k
SSH password:
192.168.219.137 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.219.136 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible ansible]#web是我们之前配置的组名
-m后面更上模块名
-k是指定输入ssh用户名的密码，当然如果是基于key验证的ssh就不需要-k参数
可以看到结果列出了主机名，ping之后对端回应pong就代表执行成功了使用ssh-keygen命令产生公钥，使用ssh-copy-id 192.168.219.136和ssh-copy-id 192.168.219.137把公钥传输到被控端即可完成基于key验证。
[root@ansible ansible]# ansible web -m ping
192.168.219.137 | SUCCESS => {
"changed": false,
"ping": "pong"
}
192.168.219.136 | SUCCESS => {
"changed": false,
"ping": "pong"
}
[root@ansible ansible]#
-k参数就不需要加了，也不需要输入密码了

# uncomment this to disable SSH key host checking
host_key_checking = False
将host_key_checking = False这行取消注释

[root@ansible .ssh]# ansible web -m command -a 'ls /root' -u mysql
192.168.219.137 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,password).\r\n",
"unreachable": true
}
192.168.219.136 | UNREACHABLE! => {
"changed": false,
"msg": "Failed to connect to the host via ssh: Permission denied (publickey,password).\r\n",
"unreachable": true
}可以看到没有进行sudo授权的情况下，是会报错的，提示需要输入sudo用户密码[root@ansible .ssh]# ansible web -m command -a 'ls /root' -u mysql -k -b -K
SSH password:
SUDO password[defaults to SSH password]: #加上-K输入sudo密码
192.168.219.137 | FAILED | rc=2 >>
ls: cannot open directory /root: Permission deniednon-zero return code192.168.219.136 | FAILED | rc=2 >>
ls: cannot open directory /root: Permission deniednon-zero return code现在又会出现另外一个问题就是mysql用户没有在控制端sudo授权过
到控制端执行visudo
## Allows people in group wheel to run all commands
%wheel ALL=(ALL) ALL
把wheel这行注释取消掉
然后在命令行执行命令，将mysql用户加到组里面去
[root@web1 ~]# usermod -aG wheel mysql
同时SUDO password[defaults to SSH password]:这个sudo的密码我不想输入，也可以在visudo里面取消注释：
## Same thing without a password
%wheel ALL=(ALL) NOPASSWD: ALL
[root@ansible .ssh]# ansible web -m command -a 'ls /root' -u mysql -k -b
SSH password:
192.168.219.137 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
Music
Pictures
Public
Templates
Videos192.168.219.136 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
Music
Pictures
Public
Templates
Videos
#可以看到非root用户登录需要那些操作

[root@ansible ~]# ansible-doc -s shell
- name: Execute commands in nodes.
shell:
chdir: # cd into this directory before running the command
creates: # a filename, when it already exists, this step will *not* be run.
executable: # change the shell used to execute the command. Should be an absolute path to the executable.
free_form: # (required) The shell module takes a free form command to run, as a string. There's not an actual option named "free
form". See the examples!
removes: # a filename, when it does not exist, this step will *not* be run.
stdin: # Set the stdin of the command directly to the specified value.
warn: # if command warnings are on in ansible.cfg, do not warn about this particular line if set to no/false.
[root@ansible ~]#

[root@ansible ~]# ansible-doc -s script
- name: Runs a local script on a remote node after transferring it
script:
chdir: # cd into this directory on the remote node before running the script
creates: # a filename, when it already exists, this step will *not* be run.
decrypt: # This option controls the autodecryption of source files using vault.
executable: # Name or path of a executable to invoke the script with
free_form: # (required) Path to the local script file followed by optional arguments. There is no parameter actually named 'free form';
see the examples!
removes: # a filename, when it does not exist, this step will *not* be run.
[root@ansible ~]#

[root@ansible ansible.test]# pwd
/home/ansible.test
[root@ansible ansible.test]# cat test.sh
#!/bin/bash
hostname
[root@ansible ansible.test]# ansible all -m script -a '/home/ansible.test/test.sh'
192.168.219.137 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.219.137 closed.\r\n",
"stderr_lines": [
"Shared connection to 192.168.219.137 closed."
],
"stdout": "web2\r\n",
"stdout_lines": [
"web2"
]
}
192.168.219.136 | SUCCESS => {
"changed": true,
"rc": 0,
"stderr": "Shared connection to 192.168.219.136 closed.\r\n",
"stderr_lines": [
"Shared connection to 192.168.219.136 closed."
],
"stdout": "web1\r\n",
"stdout_lines": [
"web1"
]
}
[root@ansible ansible.test]#

[root@ansible ansible.test]# ansible-doc -s copy
- name: Copies files to remote locations
copy:
attributes: # Attributes the file or directory should have. To get supported flags look at the man page for `chattr' on the target
system. This string should contain the attributes in the same order as the one displayed by
`lsattr'.
backup: # Create a backup file including the timestamp information so you can get the original file back if you somehow clobbered it
incorrectly.
checksum: # SHA1 checksum of the file being transferred. Used to validate that the copy of the file was successful. If this is not
provided, ansible will use the local calculated checksum of the src file.
content: # When used instead of `src', sets the contents of a file directly to the specified value. For anything advanced or with
formatting also look at the template module.
decrypt: # This option controls the autodecryption of source files using vault.
dest: # (required) Remote absolute path where the file should be copied to. If `src' is a directory, this must be a directory too.
If `dest' is a nonexistent path and if either `dest' ends with "/" or `src' is a directory,
`dest' is created. If `src' and `dest' are files, the parent directory of `dest' isn't
created: the task fails if it doesn't already exist.
directory_mode: # When doing a recursive copy set the mode for the directories. If this is not set we will use the system defaults. The mode
is only set on directories which are newly created, and will not affect those that already
existed.
follow: # This flag indicates that filesystem links in the destination, if they exist, should be followed.
force: # the default is `yes', which will replace the remote file when contents are different than the source. If `no', the file
will only be transferred if the destination does not exist.
group: # Name of the group that should own the file/directory, as would be fed to `chown'.
local_follow: # This flag indicates that filesystem links in the source tree, if they exist, should be followed.
mode: # Mode the file or directory should be. For those used to `/usr/bin/chmod' remember that modes are actually octal numbers.
You must either specify the leading zero so that Ansible's YAML parser knows it is an octal
number (like `0644' or `01777') or quote it (like `''' or `'0644'' so Ansible receives a
string and can do its own conversion from string into number. Giving Ansible a number
without following one of these rules will end up with a decimal number which will have
unexpected results. As of version 1.8, the mode may be specified as a symbolic mode (for
example, `u+rwx' or `u=rw,g=r,o=r'). As of version 2.3, the mode may also be the special
string `preserve'. `preserve' means that the file will be given the same permissions as
the source file.
owner: # Name of the user that should own the file/directory, as would be fed to `chown'.
remote_src: # If `no', it will search for `src' at originating/master machine. If `yes' it will go to the remote/target machine for the
`src'. Default is `no'. Currently `remote_src' does not support recursive copying.
`remote_src' only works with `mode=preserve' as of version 2.6.
selevel: # Level part of the SELinux file context. This is the MLS/MCS attribute, sometimes known as the `range'. `_default' feature
works as for `seuser'.
serole: # Role part of SELinux file context, `_default' feature works as for `seuser'.
setype: # Type part of SELinux file context, `_default' feature works as for `seuser'.
seuser: # User part of SELinux file context. Will default to system policy, if applicable. If set to `_default', it will use the
`user' portion of the policy if available.
src: # Local path to a file to copy to the remote server; can be absolute or relative. If path is a directory, it is copied
recursively. In this case, if path ends with "/", only inside contents of that directory
are copied to destination. Otherwise, if it does not end with "/", the directory itself
with all contents is copied. This behavior is similar to Rsync.
unsafe_writes: # Normally this module uses atomic operations to prevent data corruption or inconsistent reads from the target files,
sometimes systems are configured or just broken in ways that prevent this. One example are
docker mounted files, they cannot be updated atomically and can only be done in an unsafe
manner. This boolean option allows ansible to fall back to unsafe methods of updating files
for those cases in which you do not have any other choice. Be aware that this is subject to
race conditions and can lead to data corruption.
validate: # The validation command to run before copying into place. The path to the file to validate is passed in via '%s' which must
be present as in the example below. The command is passed securely so shell features like
expansion and pipes won't work.
(END)

1 backup：在覆盖之前将原文件备份，备份文件包含时间信息。有两个选项：yes|no
2 content：用于替代"src",可以直接设定指定文件的值
3 dest：必选项。要将源文件复制到的远程主机的绝对路径，如果源文件是一个目录，那么该路径也必须是个目录
4 directory_mode：递归的设定目录的权限，默认为系统默认权限
5 force：如果目标主机包含该文件，但内容不同，如果设置为yes，则强制覆盖，如果为no，则只有当目标主机的目标位置不存在该文件时，才复制。默认为yes
6 others：所有的file模块里的选项都可以在这里使用
7 src：要复制到远程主机的文件在本地的地址，可以是绝对路径，也可以是相对路径。如果路径是一个目录，它将递归复制。在这种情况下，如果路径使用"/"来结尾，则只复制目录里的内容，如果没有使用"/"来结尾，则包含目录在内的整个内容全部复制，类似于rsync。
8 validate ：The validation command to run before copying into place. The path to the file to validate is passed in via '%s' which must be present as in the visudo example below.

[root@ansible ansible.test]# ansible all -m copy -a 'src=/home/ansible.test/copy_test.conf dest=/home/copy_test.conf'
192.168.219.136 | SUCCESS => {
"changed": true,
"checksum": "5ffd53c0987ac64d0a82a8c97978afe8f02d7b5a",
"dest": "/home/copy_test.conf",
"gid": 0,
"group": "root",
"md5sum": "40488fea7fe48f99ea02e86166a0bc9d",
"mode": "",
"owner": "root",
"size": 28,
"src": "/root/.ansible/tmp/ansible-tmp-1550554363.16-165811746367830/source",
"state": "file",
"uid": 0
}
192.168.219.137 | SUCCESS => {
"changed": true,
"checksum": "5ffd53c0987ac64d0a82a8c97978afe8f02d7b5a",
"dest": "/home/copy_test.conf",
"gid": 0,
"group": "root",
"md5sum": "40488fea7fe48f99ea02e86166a0bc9d",
"mode": "",
"owner": "root",
"size": 28,
"src": "/root/.ansible/tmp/ansible-tmp-1550554363.16-162669317189243/source",
"state": "file",
"uid": 0
}
[root@ansible ansible.test]# ansible all -a 'ls /home'
192.168.219.136 | SUCCESS | rc=0 >>
centos12
copy_test.conf
mysql
ypc.soft192.168.219.137 | SUCCESS | rc=0 >>
centos13
copy_test.conf
mysql[root@ansible ansible.test]#

[root@ansible ansible.test]# ansible-doc -s fetch
- name: Fetches a file from remote nodes
fetch:
dest: # (required) A directory to save the file into. For example, if the `dest' directory is `/backup' a `src' file named
`/etc/profile' on host `host.example.com', would be saved into
`/backup/host.example.com/etc/profile'
fail_on_missing: # When set to 'yes', the task will fail if the remote file cannot be read for any reason. Prior to Ansible-2.5, setting
this would only fail if the source file was missing. The default was changed to "yes" in
Ansible-2.5.
flat: # Allows you to override the default behavior of appending hostname/path/to/file to the destination. If dest ends with '/',
it will use the basename of the source file, similar to the copy module. Obviously this is
only handy if the filenames are unique.
src: # (required) The file on the remote system to fetch. This `must' be a file, not a directory. Recursive fetching may be
supported in a later release.
validate_checksum: # Verify that the source and destination checksums match after the files are fetched.
[root@ansible ansible.test]#

[root@ansible ansible.test]# ansible all -m fetch -a 'src=/etc/passwd dest=/home/ansible.test/test'
192.168.219.137 | SUCCESS => {
"changed": true,
"checksum": "edf3216846dae3f593314cf07b8d8f328e58f067",
"dest": "/home/ansible.test/test/192.168.219.137/etc/passwd",
"md5sum": "86e07804c44a27941e1fc798a5779756",
"remote_checksum": "edf3216846dae3f593314cf07b8d8f328e58f067",
"remote_md5sum": null
}
192.168.219.136 | SUCCESS => {
"changed": true,
"checksum": "65a433c99ff5ce054264be87594828c83989aa0e",
"dest": "/home/ansible.test/test/192.168.219.136/etc/passwd",
"md5sum": "891484511715765f25fd7c4fa67f8288",
"remote_checksum": "65a433c99ff5ce054264be87594828c83989aa0e",
"remote_md5sum": null
}
[root@ansible ansible.test]# tree test
test
├── 192.168.219.136
│   └── etc
│   └── passwd
└── 192.168.219.137
└── etc
└── passwd4 directories, 2 files[root@ansible ansible.test]# cd test
[root@ansible test]# ls
192.168.219.136 192.168.219.137
[root@ansible test]# cd 192.168.219.136
[root@ansible 192.168.219.136]# ls
etc
[root@ansible 192.168.219.136]# cd etc/
[root@ansible etc]# ls
passwd
[root@ansible etc]#
#可以看到在test下各自创建了一个属于被控端机器ip的目录，抓取的文件都放在这个目录下面，方便区分

[root@ansible etc]# ansible all -m shell -a 'tar Jcf log.tar.xz /var/log/*.log'
[WARNING]: Consider using the unarchive module rather than running tar. If you
need to use command because unarchive is insufficient you can add warn=False to
this command task or set command_warnings=False in ansible.cfg to get rid of this
message.192.168.219.137 | SUCCESS | rc=0 >>
tar: Removing leading `/' from member names192.168.219.136 | SUCCESS | rc=0 >>
tar: Removing leading `/' from member names[root@ansible etc]# ansible all -m shell -a 'ls -h'
192.168.219.136 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos192.168.219.137 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos[root@ansible etc]# ansible all -m shell -a 'pwd'
192.168.219.137 | SUCCESS | rc=0 >>
/root192.168.219.136 | SUCCESS | rc=0 >>
/root[root@ansible etc]# ansible all -m fetch -a 'src=/root/log.tar.xz dest=/home/ansible.test/test/'
192.168.219.136 | SUCCESS => {
"changed": true,
"checksum": "893ff89ed3394cf7a94e6b4d2aca694a7b8f4f9e",
"dest": "/home/ansible.test/test/192.168.219.136/root/log.tar.xz",
"md5sum": "bc8e9ac43907b51c4e1e31b786e1e1ef",
"remote_checksum": "893ff89ed3394cf7a94e6b4d2aca694a7b8f4f9e",
"remote_md5sum": null
}
192.168.219.137 | SUCCESS => {
"changed": true,
"checksum": "9662827bc0da5854fe108a9847e1df4986388cfd",
"dest": "/home/ansible.test/test/192.168.219.137/root/log.tar.xz",
"md5sum": "9216f8c9dd0e41058d6ef3ca77f1919e",
"remote_checksum": "9662827bc0da5854fe108a9847e1df4986388cfd",
"remote_md5sum": null
}
[root@ansible ansible.test]# tree test
test
├── 192.168.219.136
│   ├── etc
│   │   └── passwd
│   └── root
│   └── log.tar.xz
└── 192.168.219.137
├── etc
│   └── passwd
└── root
└── log.tar.xz6 directories, 4 files
[root@ansible ansible.test]#
可以看到多个文件已经被抓取过来了

[root@ansible ~]# ansible-doc -s cron
- name: Manage cron.d and crontab entries
cron:
backup: # If set, create a backup of the crontab before it is modified. The location of the backup is returned in the `backup_file'
variable by this module.
cron_file: # If specified, uses this file instead of an individual user's crontab. If this is a relative path, it is interpreted with
respect to /etc/cron.d. (If it is absolute, it will typically be /etc/crontab). Many linux
distros expect (and some require) the filename portion to consist solely of upper- and
lower-case letters, digits, underscores, and hyphens. To use the `cron_file' parameter you
must specify the `user' as well.
day: # Day of the month the job should run ( 1-31, *, */2, etc )
disabled: # If the job should be disabled (commented out) in the crontab. Only has effect if `state=present'.
env: # If set, manages a crontab's environment variable. New variables are added on top of crontab. "name" and "value" parameters
are the name and the value of environment variable.
hour: # Hour when the job should run ( 0-23, *, */2, etc )
insertafter: # Used with `state=present' and `env'. If specified, the environment variable will be inserted after the declaration of
specified environment variable.
insertbefore: # Used with `state=present' and `env'. If specified, the environment variable will be inserted before the declaration of
specified environment variable.
job: # The command to execute or, if env is set, the value of environment variable. The command should not contain line breaks.
Required if state=present.
minute: # Minute when the job should run ( 0-59, *, */2, etc )
month: # Month of the year the job should run ( 1-12, *, */2, etc )
name: # Description of a crontab entry or, if env is set, the name of environment variable. Required if state=absent. Note that if
name is not set and state=present, then a new crontab entry will always be created,
regardless of existing ones.
reboot: # If the job should be run at reboot. This option is deprecated. Users should use special_time.
special_time: # Special time specification nickname.
state: # Whether to ensure the job or environment variable is present or absent.
user: # The specific user whose crontab should be modified.
weekday: # Day of the week that the job should run ( 0-6 for Sunday-Saturday, *, etc )
[root@ansible ~]# 1 backup：对远程主机上的原任务计划内容修改之前做备份
2 cron_file：如果指定该选项，则用该文件替换远程主机上的cron.d目录下的用户的任务计划
3 day：日（1-31，*，*/2,……）
4 hour：小时（0-23，*，*/2，……）
5 minute：分钟（0-59，*，*/2，……）
6 month：月（1-12，*，*/2，……）
7 weekday：周（0-7，*，……）
8 job：要执行的任务，依赖于state=present
9 name：该任务的描述
10 special_time：指定什么时候执行，参数：reboot,yearly,annually,monthly,weekly,daily,hourly
11 state：确认该任务计划是创建还是删除
12 user：以哪个用户的身份执行

[root@ansible ~]# ansible all -m cron -a 'minute="*/1" job="/bin/echo hello ansible" name="test cron job" state="present"'
192.168.219.137 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"kk",
"test cron job"
]
}
192.168.219.136 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"kk",
"test cron job"
]
}
[root@ansible ~]#136：
[root@web1 ~]# crontab -l
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
[root@web1 ~]#137：
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
You have new mail in /var/spool/mail/root
[root@web2 ~]#

[root@ansible ~]# ansible all -m cron -a 'minute="*/1" job="/bin/echo hello ansible" name="test cron job" state="absent"'
192.168.219.137 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
192.168.219.136 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": []
}
[root@ansible ~]#136：
[root@web1 ~]# crontab -l
You have new mail in /var/spool/mail/root
[root@web1 ~]#[root@web2 ~]# crontab -l
You have new mail in /var/spool/mail/root
[root@web2 ~]#

[root@ansible ~]# ansible all -m cron -a 'disabled=yes job="/usr/bin/wall FBI warning" name=kk'
192.168.219.136 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"test cron job",
"kk"
]
}
192.168.219.137 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"test cron job",
"kk"
]
}
[root@ansible ~]# ansible all -m shell -a 'crontab -l'
192.168.219.136 | SUCCESS | rc=0 >>
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
#Ansible: kk
#* * * * * /usr/bin/wall FBI warning192.168.219.137 | SUCCESS | rc=0 >>
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
#Ansible: kk
#* * * * * /usr/bin/wall FBI warning
发现新加的计划任务就是注释的

[root@ansible ~]# ansible all -m cron -a 'disabled=no job="/usr/bin/wall FBI warning" name=kk'
192.168.219.136 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"test cron job",
"kk"
]
}
192.168.219.137 | SUCCESS => {
"changed": true,
"envs": [],
"jobs": [
"test cron job",
"kk"
]
}
[root@ansible ~]# ansible all -m shell -a 'crontab -l'
192.168.219.136 | SUCCESS | rc=0 >>
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
#Ansible: kk
* * * * * /usr/bin/wall FBI warning192.168.219.137 | SUCCESS | rc=0 >>
#Ansible: test cron job
*/1 * * * * /bin/echo hello ansible
#Ansible: kk
* * * * * /usr/bin/wall FBI warning
可以看到计划任务注释取消掉了，disable后面可以接yes/no，还可以是ture和flase

[root@ansible ~]# ansible-doc -s yum
- name: Manages packages with the `yum' package manager
yum:
allow_downgrade: # Specify if the named package and version is allowed to downgrade a maybe already installed higher version of that package.
Note that setting allow_downgrade=True can make this module behave in a non-idempotent way.
The task could end up with a set of packages that does not match the complete list of
specified packages to install (because dependencies between the downgraded package and
others can cause changes to the packages which were in the earlier transaction).
bugfix: # If set to `yes', and `state=latest' then only installs updates that have been marked bugfix related.
conf_file: # The remote yum configuration file to use for the transaction.
disable_gpg_check: # Whether to disable the GPG checking of signatures of packages being installed. Has an effect only if state is `present' or
`latest'.
disable_plugin: # `Plugin' name to disable for the install/update operation. The disabled plugins will not persist beyond the transaction.
disablerepo: # `Repoid' of repositories to disable for the install/update operation. These repos will not persist beyond the transaction.
When specifying multiple repos, separate them with a ",".
enable_plugin: # `Plugin' name to enable for the install/update operation. The enabled plugin will not persist beyond the transaction.
enablerepo: # `Repoid' of repositories to enable for the install/update operation. These repos will not persist beyond the transaction.
When specifying multiple repos, separate them with a ",".
exclude: # Package name(s) to exclude when state=present, or latest
installroot: # Specifies an alternative installroot, relative to which all packages will be installed.
list: # Package name to run the equivalent of yum list <package> against. In addition to listing packages, use can also list the
following: `installed', `updates', `available' and `repos'.
name: # A package name or package specifier with version, like `name-1.0'. If a previous version is specified, the task also needs
to turn `allow_downgrade' on. See the `allow_downgrade' documentation for caveats with
downgrading packages. When using state=latest, this can be '*' which means run `yum -y
update'. You can also pass a url or a local path to a rpm file (using state=present). To
operate on several packages this can accept a comma separated list of packages or (as of
2.0) a list of packages.
security: # If set to `yes', and `state=latest' then only installs updates that have been marked security related.
skip_broken: # Resolve depsolve problems by removing packages that are causing problems from the trans‐ action.
state: # Whether to install (`present' or `installed', `latest'), or remove (`absent' or `removed') a package. `present' and
`installed' will simply ensure that a desired package is installed. `latest' will update
the specified package if it's not of the latest available version. `absent' and `removed'
will remove the specified package.
update_cache: # Force yum to check if cache is out of date and redownload if needed. Has an effect only if state is `present' or `latest'.
update_only: # When using latest, only update installed packages. Do not install packages. Has an effect only if state is `latest'
validate_certs: # This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to `no', the SSL
certificates will not be validated. This should only set to `no' used on personally
controlled sites using self-signed certificates as it avoids verifying the source site.
Prior to 2.1 the code worked as if this was set to `yes'.
(END)

name参数：必须参数，用于指定要操作的唯一的仓库ID，也就是”.repo”配置文件中每个仓库对应的”中括号”内的仓库ID。baseurl参数：此参数用于设置 yum 仓库的 baseurl。description参数：此参数用于设置仓库的注释信息，也就是”.repo”配置文件中每个仓库对应的”name字段”对应的内容。file参数：此参数用于设置仓库的配置文件名称，即设置”.repo”配置文件的文件名前缀，在不使用此参数的情况下，默认以 name 参数的仓库ID作为”.repo”配置文件的文件名前缀，同一个”.repo” 配置文件中可以存在多个 yum 源。enabled参数：此参数用于设置是否激活对应的 yum 源，此参数默认值为 yes，表示启用对应的 yum 源，设置为 no 表示不启用对应的 yum 源。gpgcheck参数：此参数用于设置是否开启 rpm 包验证功能，默认值为 no，表示不启用包验证，设置为 yes 表示开启包验证功能。gpgcakey参数：当 gpgcheck 参数设置为 yes 时，需要使用此参数指定验证包所需的公钥。state参数：默认值为 present，当值设置为 absent 时，表示删除对应的 yum 源。

卸载httpd服务
[root@ansible ~]# ansible all -m yum -a 'state=removed name=httpd'
192.168.219.136 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Remove Process\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.2.15-69.el6.centos will be erased\n--> Processing Dependency: httpd >= 2.2.0 for package: gnome-user-share-2.28.2-3.el6.x86_64\n--> Running transaction check\n---> Package gnome-user-share.x86_64 0:2.28.2-3.el6 will be erased\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nRemoving:\n httpd x86_64 2.2.15-69.el6.centos\n @base 3.0 M\nRemoving for dependencies:\n gnome-user-share\n x86_64 2.28.2-3.el6 @anaconda-CentOS-201508042137.x86_64/6.7 1.1 M\n\nTransaction Summary\n================================================================================\nRemove 2 Package(s)\n\nInstalled size: 4.1 M\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Erasing : gnome-user-share-2.28.2-3.el6.x86_64 1/2 \n\r Erasing : httpd-2.2.15-69.el6.centos.x86_64 2/2 \n\r Verifying : gnome-user-share-2.28.2-3.el6.x86_64 1/2 \n\r Verifying : httpd-2.2.15-69.el6.centos.x86_64 2/2 \n\nRemoved:\n httpd.x86_64 0:2.2.15-69.el6.centos \n\nDependency Removed:\n gnome-user-share.x86_64 0:2.28.2-3.el6 \n\nComplete!\n"
]
}
192.168.219.137 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Remove Process\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.2.15-69.el6.centos will be erased\n--> Processing Dependency: httpd >= 2.2.0 for package: gnome-user-share-2.28.2-3.el6.x86_64\n--> Running transaction check\n---> Package gnome-user-share.x86_64 0:2.28.2-3.el6 will be erased\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nRemoving:\n httpd x86_64 2.2.15-69.el6.centos\n @base 3.0 M\nRemoving for dependencies:\n gnome-user-share\n x86_64 2.28.2-3.el6 @anaconda-CentOS-201508042137.x86_64/6.7 1.1 M\n\nTransaction Summary\n================================================================================\nRemove 2 Package(s)\n\nInstalled size: 4.1 M\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Erasing : gnome-user-share-2.28.2-3.el6.x86_64 1/2 \n\r Erasing : httpd-2.2.15-69.el6.centos.x86_64 2/2 \n\r Verifying : gnome-user-share-2.28.2-3.el6.x86_64 1/2 \n\r Verifying : httpd-2.2.15-69.el6.centos.x86_64 2/2 \n\nRemoved:\n httpd.x86_64 0:2.2.15-69.el6.centos \n\nDependency Removed:\n gnome-user-share.x86_64 0:2.28.2-3.el6 \n\nComplete!\n"
]
}
[root@ansible ~]# ansible all -m shell -a 'httpd -v'
192.168.219.137 | FAILED | rc=127 >>
/bin/sh: httpd: command not foundnon-zero return code192.168.219.136 | FAILED | rc=127 >>
/bin/sh: httpd: command not foundnon-zero return code安装httpd服务
[root@ansible ~]# ansible all -m yum -a 'state=present name=httpd'
192.168.219.137 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Install Process\nLoading mirror speeds from cached hostfile\n * base: mirrors.aliyun.com\n * epel: mirrors.huaweicloud.com\n * extras: mirrors.cn99.com\n * updates: mirror.bit.edu.cn\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.2.15-69.el6.centos will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n httpd x86_64 2.2.15-69.el6.centos base 836 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package(s)\n\nTotal download size: 836 k\nInstalled size: 3.0 M\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Installing : httpd-2.2.15-69.el6.centos.x86_64 1/1 \n\r Verifying : httpd-2.2.15-69.el6.centos.x86_64 1/1 \n\nInstalled:\n httpd.x86_64 0:2.2.15-69.el6.centos \n\nComplete!\n"
]
}
192.168.219.136 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Install Process\nLoading mirror speeds from cached hostfile\n * base: mirrors.cqu.edu.cn\n * epel: mirrors.yun-idc.com\n * extras: mirrors.cqu.edu.cn\n * updates: mirrors.cqu.edu.cn\nResolving Dependencies\n--> Running transaction check\n---> Package httpd.x86_64 0:2.2.15-69.el6.centos will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n httpd x86_64 2.2.15-69.el6.centos base 836 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package(s)\n\nTotal download size: 836 k\nInstalled size: 3.0 M\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Installing : httpd-2.2.15-69.el6.centos.x86_64 1/1 \n\r Verifying : httpd-2.2.15-69.el6.centos.x86_64 1/1 \n\nInstalled:\n httpd.x86_64 0:2.2.15-69.el6.centos \n\nComplete!\n"
]
}
[root@ansible ~]# ansible all -m shell -a 'httpd -v'
192.168.219.137 | SUCCESS | rc=0 >>
Server version: Apache/2.2.15 (Unix)
Server built: Jun 19 2018 15:45:13192.168.219.136 | SUCCESS | rc=0 >>
Server version: Apache/2.2.15 (Unix)
Server built: Jun 19 2018 15:45:13

[root@ansible ansible.test]# ansible all -m file -a 'name=/home/soft state=directory'
192.168.219.137 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"path": "/home/soft",
"size": 4096,
"state": "directory",
"uid": 0
}
192.168.219.136 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"path": "/home/soft",
"size": 4096,
"state": "directory",
"uid": 0
}
[root@ansible ansible.test]# ansible all -m copy -a 'src=/home/ansible.test/htop-1.0.3-1.el6.rf.x86_64.rpm dest=/home/soft'
192.168.219.137 | SUCCESS => {
"changed": true,
"checksum": "2deed7a9030c2963c677cce6ecaccb4750106052",
"dest": "/home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm",
"gid": 0,
"group": "root",
"md5sum": "683cc37192a76556c0847aaf93459abf",
"mode": "",
"owner": "root",
"size": 88608,
"src": "/root/.ansible/tmp/ansible-tmp-1550738545.61-57323277206137/source",
"state": "file",
"uid": 0
}
192.168.219.136 | SUCCESS => {
"changed": true,
"checksum": "2deed7a9030c2963c677cce6ecaccb4750106052",
"dest": "/home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm",
"gid": 0,
"group": "root",
"md5sum": "683cc37192a76556c0847aaf93459abf",
"mode": "",
"owner": "root",
"size": 88608,
"src": "/root/.ansible/tmp/ansible-tmp-1550738545.6-127862535278548/source",
"state": "file",
"uid": 0
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls -h /home/soft'
192.168.219.136 | SUCCESS | rc=0 >>
htop-1.0.3-1.el6.rf.x86_64.rpm192.168.219.137 | SUCCESS | rc=0 >>
htop-1.0.3-1.el6.rf.x86_64.rpm[root@ansible ansible.test]# ansible all -m yum -a 'name=/home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm'
192.168.219.137 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Install Process\nExamining /home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm: htop-1.0.3-1.el6.rf.x86_64\nMarking /home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm to be installed\nLoading mirror speeds from cached hostfile\n * base: mirrors.aliyun.com\n * epel: mirrors.aliyun.com\n * extras: mirrors.163.com\n * updates: ftp.sjtu.edu.cn\nResolving Dependencies\n--> Running transaction check\n---> Package htop.x86_64 0:1.0.3-1.el6.rf will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n htop x86_64 1.0.3-1.el6.rf /htop-1.0.3-1.el6.rf.x86_64 209 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package(s)\n\nTotal size: 209 k\nInstalled size: 209 k\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Installing : htop-1.0.3-1.el6.rf.x86_64 1/1 \n\r Verifying : htop-1.0.3-1.el6.rf.x86_64 1/1 \n\nInstalled:\n htop.x86_64 0:1.0.3-1.el6.rf \n\nComplete!\n"
]
}
192.168.219.136 | SUCCESS => {
"changed": true,
"msg": "",
"rc": 0,
"results": [
"Loaded plugins: fastestmirror, refresh-packagekit, security\nSetting up Install Process\nExamining /home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm: htop-1.0.3-1.el6.rf.x86_64\nMarking /home/soft/htop-1.0.3-1.el6.rf.x86_64.rpm to be installed\nLoading mirror speeds from cached hostfile\n * base: centos.ustc.edu.cn\n * epel: mirror.premi.st\n * extras: mirrors.163.com\n * updates: mirrors.tuna.tsinghua.edu.cn\nResolving Dependencies\n--> Running transaction check\n---> Package htop.x86_64 0:1.0.3-1.el6.rf will be installed\n--> Finished Dependency Resolution\n\nDependencies Resolved\n\n================================================================================\n Package Arch Version Repository Size\n================================================================================\nInstalling:\n htop x86_64 1.0.3-1.el6.rf /htop-1.0.3-1.el6.rf.x86_64 209 k\n\nTransaction Summary\n================================================================================\nInstall 1 Package(s)\n\nTotal size: 209 k\nInstalled size: 209 k\nDownloading Packages:\nRunning rpm_check_debug\nRunning Transaction Test\nTransaction Test Succeeded\nRunning Transaction\n\r Installing : htop-1.0.3-1.el6.rf.x86_64 1/1 \n\r Verifying : htop-1.0.3-1.el6.rf.x86_64 1/1 \n\nInstalled:\n htop.x86_64 0:1.0.3-1.el6.rf \n\nComplete!\n"
]
}
[root@ansible ansible.test]# ansible all -m shell -a 'htop -v'
192.168.219.136 | SUCCESS | rc=0 >>
htop 1.0.3 - (C) 2004-2012 Hisham Muhammad
Released under the GNU GPL.192.168.219.137 | SUCCESS | rc=0 >>
htop 1.0.3 - (C) 2004-2012 Hisham Muhammad
Released under the GNU GPL.[root@ansible ansible.test]#
可以看到服务都已经安装成功了

[root@ansible ~]# ansible-doc -s service
- name: Manage services
service:
arguments: # Additional arguments provided on the command line
enabled: # Whether the service should start on boot. *At least one of state and enabled are required.*
name: # (required) Name of the service.
pattern: # If the service does not respond to the status command, name a substring to look for as would be found in the output of the
`ps' command as a stand-in for a status result. If the string is found, the service will
be assumed to be running.
runlevel: # For OpenRC init scripts (ex: Gentoo) only. The runlevel that this service belongs to.
sleep: # If the service is being `restarted' then sleep this many seconds between the stop and start command. This helps to
workaround badly behaving init scripts that exit immediately after signaling a process to
stop.
state: # `started'/`stopped' are idempotent actions that will not run commands unless necessary. `restarted' will always bounce
the service. `reloaded' will always reload. *At least one of state and enabled are
required.* Note that reloaded will start the service if it is not already started, even if
your chosen init system wouldn't normally.
use: # The service module actually uses system specific modules, normally through auto detection, this setting can force a
specific module. Normally it uses the value of the 'ansible_service_mgr' fact and falls
back to the old 'service' module when none matching is found.
[root@ansible ~]#

[root@ansible ~]# ansible all -m shell -a 'httpd -v'
192.168.219.137 | SUCCESS | rc=0 >>
Server version: Apache/2.2.15 (Unix)
Server built: Jun 19 2018 15:45:13192.168.219.136 | SUCCESS | rc=0 >>
Server version: Apache/2.2.15 (Unix)
Server built: Jun 19 2018 15:45:13[root@ansible ~]# ansible all -m service -a 'name=httpd state=restarted enabled=yes'
192.168.219.137 | SUCCESS => {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
192.168.219.136 | SUCCESS => {
"changed": true,
"enabled": true,
"name": "httpd",
"state": "started"
}
[root@ansible ~]# ansible all -m shell -a 'ps -aux | grep http'
192.168.219.137 | SUCCESS | rc=0 >>
root 3342 0.0 0.3 183896 3816 ? Ss 13:16 0:00 /usr/sbin/httpd
apache 3345 0.0 0.2 184028 2500 ? S 13:16 0:00 /usr/sbin/httpd
apache 3346 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3347 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3348 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3349 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3350 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3351 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3352 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
root 3389 0.0 0.1 106096 1120 pts/1 S+ 13:17 0:00 /bin/sh -c ps -aux | grep http
root 3391 0.0 0.0 103312 860 pts/1 S+ 13:17 0:00 grep httpWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ192.168.219.136 | SUCCESS | rc=0 >>
root 3323 0.0 0.3 183896 3824 ? Ss 13:16 0:00 /usr/sbin/httpd
apache 3326 0.0 0.2 184028 2500 ? S 13:16 0:00 /usr/sbin/httpd
apache 3327 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3328 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3329 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3330 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3331 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3332 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
apache 3333 0.0 0.2 184028 2476 ? S 13:16 0:00 /usr/sbin/httpd
root 3370 0.0 0.1 106096 1128 pts/1 S+ 13:17 0:00 /bin/sh -c ps -aux | grep http
root 3372 0.0 0.0 103312 856 pts/1 S+ 13:17 0:00 grep httpWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ[root@ansible ~]# ansible all -m shell -a 'netstat -anptu | grep 80'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::80 :::* LISTEN 3342/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::80 :::* LISTEN 3323/httpd[root@ansible ~]# ansible all -m shell -a 'chkconfig httpd --list'
192.168.219.137 | SUCCESS | rc=0 >>
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off192.168.219.136 | SUCCESS | rc=0 >>
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off[root@ansible ~]#

[root@ansible ansible.test]# ansible all -m file -a 'name=/root/date state=touch'
192.168.219.137 | SUCCESS => {
"changed": true,
"dest": "/root/date",
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"size": 0,
"state": "file",
"uid": 0
}
192.168.219.136 | SUCCESS => {
"changed": true,
"dest": "/root/date",
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"size": 0,
"state": "file",
"uid": 0
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls -h date'
192.168.219.137 | SUCCESS | rc=0 >>
date192.168.219.136 | SUCCESS | rc=0 >>
date[root@ansible ansible.test]#

[root@ansible ansible.test]# ansible all -m shell -a 'ls -l date'
192.168.219.137 | SUCCESS | rc=0 >>
-rw-r--r-- 1 root root 0 Feb 20 13:17 date192.168.219.136 | SUCCESS | rc=0 >>
-rw-r--r-- 1 root root 0 Feb 20 13:17 date[root@ansible ansible.test]# ansible all -m file -a 'name=/root/date state=absent'
192.168.219.136 | SUCCESS => {
"changed": true,
"path": "/root/date",
"state": "absent"
}
192.168.219.137 | SUCCESS => {
"changed": true,
"path": "/root/date",
"state": "absent"
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls'
192.168.219.137 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos192.168.219.136 | SUCCESS | rc=0 >>
anaconda-ks.cfg
Desktop
Documents
Downloads
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos[root@ansible ansible.test]#
可以看到date目录已经删除了

[root@ansible ansible.test]# ansible all -m file -a 'name=/root/file123/file321 state=directory'
192.168.219.137 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"path": "/root/file123/file321",
"size": 4096,
"state": "directory",
"uid": 0
}
192.168.219.136 | SUCCESS => {
"changed": true,
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"path": "/root/file123/file321",
"size": 4096,
"state": "directory",
"uid": 0
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls -l file123'
192.168.219.137 | SUCCESS | rc=0 >>
total 4
drwxr-xr-x 2 root root 4096 Feb 20 13:27 file321192.168.219.136 | SUCCESS | rc=0 >>
total 4
drwxr-xr-x 2 root root 4096 Feb 20 13:27 file321[root@ansible ansible.test]#
可以看到递归创建成功了

[root@ansible ansible.test]# ansible all -m file -a 'src=/etc/passwd name=/root/file123/passwd.link state=link'
192.168.219.137 | SUCCESS => {
"changed": true,
"dest": "/root/file123/passwd.link",
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"size": 11,
"src": "/etc/passwd",
"state": "link",
"uid": 0
}
192.168.219.136 | SUCCESS => {
"changed": true,
"dest": "/root/file123/passwd.link",
"gid": 0,
"group": "root",
"mode": "",
"owner": "root",
"size": 11,
"src": "/etc/passwd",
"state": "link",
"uid": 0
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls -l /root/file123/passwd.link'
192.168.219.136 | SUCCESS | rc=0 >>
lrwxrwxrwx 1 root root 11 Feb 20 13:33 /root/file123/passwd.link -> /etc/passwd192.168.219.137 | SUCCESS | rc=0 >>
lrwxrwxrwx 1 root root 11 Feb 20 13:33 /root/file123/passwd.link -> /etc/passwd[root@ansible ansible.test]#
软连接创建成功删除软连接
[root@ansible ansible.test]# ansible all -m file -a 'name=/root/file123/passwd.link state=absent'
[WARNING]: The src option requires state to be 'link' or 'hard'. This will become
an error in Ansible 2.10192.168.219.137 | SUCCESS => {
"changed": true,
"path": "/root/file123/passwd.link",
"state": "absent"
}
192.168.219.136 | SUCCESS => {
"changed": true,
"path": "/root/file123/passwd.link",
"state": "absent"
}
[root@ansible ansible.test]# ansible all -m shell -a 'ls -l /root/file123/passwd.link'

保证服务器能访问互联网的情况下
ansible-galaxy install geerlingguy.nginx
直接使用ansible-galaxy命令安装网站的角色名就可以

[root@ansible playbook]# cat playbook.test.yml
--- #三横杠是代表剧本编写的开始，不用写也没有关系，语法上也是没有错误的。
- hosts: web #- hosts指定主机清单，就是组名，必须有空格
remote_user: root #remote_user代表我接下的剧本是以什么身份运行的 tasks: #接下来就为剧本的命令内容
- name: test #给我接下来的命令取一个名字
shell: 'hostname' #指定模块，后面接操作的命令即可，-a就不需要了这就是一个简单的playbook的语法和基本格式。

[root@ansible playbook]# ansible-playbook playbook.test.ymlPLAY [web] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [test] **********************************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]#
可以看到剧本在被控端确实执行成功了，但是没有得到我们想要的结果。

[root@ansible playbook]# ansible-vault encrypt playbook.test.yml
New Vault password:
Confirm New Vault password:
Encryption successful
[root@ansible playbook]# cat playbook.test.yml
$ANSIBLE_VAULT;1.1;AES256
30666539373365363535623538663639366633303138333730656264333935636531626537623665
3032393434646461613334393739636362653035376131610a333463343461353538373038303765
30323861353330666135313038353966366635386338643434376232643062373165343361316432
3231316430643036660a353730623063353031626634663538333565633130613637353232313361
36383762653337303133303932333631633538666430313465653934636432643732613835643663
35626535623631613937616266343366353730663662343961353164343330666538346162663138
39333432303631643465396265386430653834363233626137356632383739383935393430343935
34326666323132343461643765616537376337376533653933663764306435663233393833366361
34366232346663666362316565363264373261353063643965313863333330393365373233623032
39623163623936343762666537613439376439313564616438383930313233623931653331396663
66613436646661306531363362663539316532326561363633646437376134396337363139316361
32663038653733343739306233643636653237333364313833386330666434623331636363393965
63623338373730346431613065666561303338393538646133346636306531306566363639333331
32646435613565613861396135313862313331653432323339636636323237323865313335326164
33613432396539636637356263656466633036616232616238393462363030616336343037373566
61353738343435623138336432376534393061393232356438396130643738633233633862626565
65393764323234353238623934343635326364333565643132363963323865633265343533313764
62336438313637623833643735623933353639643064356631323963316265303566333437383736
35323565613532616363303937623539376535396162643864396337393366366463323535346538
33393062653338303234346165633434616132333961613463393136633161353765313838646338
61353566666430353161323136383230303361396336653064653638656134396265613636636639
33633066623165333337363233646232366663613939613066386338636665646333353039386439
61336633626531333961663861303064663065353732353139363934333361396236613330306632
36363564373264616233626530373062656133633130633835626632393232613639353263643633
62653565313361386538386162356565383762666138643139323265613734373565643363373661
62383037356664343063393434633766333734343261306563333365653737323533323238383538
39646338613536313831303266653239663933366531363863353136323135363466303636636531
34393931333930383035
[root@ansible playbook]#
可以看到加密之后的剧本我们就不能通过正常的方式查看了，而且使用的是AES的加密算法。[root@ansible playbook]# ansible-playbook playbook.test.yml
ERROR! Attempting to decrypt but no vault secrets found
[root@ansible playbook]#
加密状态下剧本是无法执行的

[root@ansible playbook]# ansible-vault decrypt playbook.test.yml
Vault password:
Decryption successful
解密是需要输入加密之后的口令的。
[root@ansible playbook]# cat playbook.test.yml
--- #三横杠是代表剧本编写的开始，不用写也没有关系，语法上也是没有错误的。
- hosts: web #- hosts指定主机清单，就是组名，必须有空格
remote_user: root #remote_user代表我接下的剧本是以什么身份运行的 tasks: #接下来就为剧本的命令内容
- name: test #给我接下来的命令取一个名字
shell: 'init 0' #指定模块，后面接操作的命令即可，-a就不需要了
[root@ansible playbook]# ansible-playbook playbook.test.ymlPLAY [web] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [test] *****************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]#
加密文件要执行必须解密才能继续使用

[root@ansible playbook]# ansible-vault encrypt playbook.test.yml
New Vault password:
Confirm New Vault password:
Encryption successful
[root@ansible playbook]# ansible-vault view playbook.test.yml
Vault password:
--- #三横杠是代表剧本编写的开始，不用写也没有关系，语法上也是没有错误的。
- hosts: web #- hosts指定主机清单，就是组名，必须有空格
remote_user: root #remote_user代表我接下的剧本是以什么身份运行的 tasks: #接下来就为剧本的命令内容
- name: test #给我接下来的命令取一个名字
shell: 'init 0' #指定模块，后面接操作的命令即可，-a就不需要了
[root@ansible playbook]#
如果我只是想看看playbook脚本，也可以使用view参数去查看，还是需要输入口令。

[root@ansible playbook]# ansible-vault edit playbook.test.yml
Vault password:
[root@ansible playbook]#
如果不想解密就把文件内容直接调整了，就可以使用edit参数。输入口令就能调整了

[root@ansible playbook]# ansible-vault rekey playbook.test.yml
Vault password: 输入老密码之后
New Vault password: 提示输入新密码
Confirm New Vault password:
Rekey successful
[root@ansible playbook]#
直接修改老的密码，

[root@ansible playbook]# ansible-vault create playbook.test011.yml
New Vault password:
Confirm New Vault password:[root@ansible playbook]# ls
playbook.test011.yml playbook.test.retry playbook.test.yml
[root@ansible playbook]#
如果想在编写playbook的时候就把文件加密了，就可以使用create参数，进去剧本直接编写。

[root@ansible playbook]# ansible-playbook -C playbook.test.yml
在执行脚本的时候加上-C就能查看脚本是否有错误PLAY [web] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [test] *****************************************************************************************************************
skipping: [192.168.219.136]
skipping: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=1 changed=0 unreachable=0 failed=0
192.168.219.137 : ok=1 changed=0 unreachable=0 failed=0[root@ansible playbook]#

[root@ansible playbook]# ansible-playbook playbook.test.yml --list-hostsplaybook: playbook.test.yml play #1 (web): web TAGS: []
pattern: [u'web']
hosts (2):
192.168.219.136
192.168.219.137
[root@ansible playbook]# ansible-playbook playbook.test.yml --limit 192.168.219.136PLAY [web] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.136]TASK [test] *****************************************************************************************************************
changed: [192.168.219.136]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]#

[root@ansible playbook]# cat playbook.test.yml
---
-hosts: all
remote_user: root tasks:
-name: copy file
copy: src=/home/ansible.test/playbook/11.sh dest=/home/ansible/
copy: src=/home/ansible.test/playbook/22.sh dest=/home/ansible/
[root@ansible playbook]#
可以看到copy的操作有两个
[root@ansible playbook]# ansible-playbook playbook.test.yml
[WARNING]: While constructing a mapping from /home/ansible.test/playbook/playbook.test.yml, line 6, column 6, found a
duplicate dict key (copy). Using last defined value only.PLAY [all] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [copy file] ************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'ls /home/ansible'
192.168.219.136 | SUCCESS | rc=0 >>
22.sh192.168.219.137 | SUCCESS | rc=0 >>
22.sh[root@ansible playbook]#
可以看到就拷贝了22.sh，这个就说明在tasks里面一个模块只能对应一个name，一个name也只能对应一个操作。

[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install httpd service
yum: name=httpd
- name: start service
service: name=httpd state=started enabled=yes[root@ansible playbook]# ansible-playbook playbook.test.ymlPLAY [all] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [install httpd service] ************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [start service] ********************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=3 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=1 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep 80'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::80 :::* LISTEN 5631/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::80 :::* LISTEN 4599/httpd
可以看到httpd服务已经装好了，但是这个时候我要把默认的80端口改成8088的话，那么更新我本地的配置文件同步到备机，配置文件变动过，服务就需要重启才能生效。
我们在本地将修改httpd的配置文件
[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install httpd service
yum: name=httpd
- name: start service
service: name=httpd state=started enabled=yes
- name: copy conf file
copy: src=/etc/httpd/conf/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service #这个notify就要写handiers后面定义的名字 handlers:
- name: restart service
service: name=httpd state=restarted #当监控有变动之后handlers需要做什么操作[root@ansible playbook]# ansible-playbook playbook.test.ymlPLAY [all] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [install httpd service] ************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [start service] ********************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [copy conf file] *******************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]RUNNING HANDLER [restart service] *******************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=5 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=5 changed=2 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep 8088'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::8088 :::* LISTEN 6045/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::8088 :::* LISTEN 5016/httpd[root@ansible playbook]#
执行之后就可以看到服务重启成功了，而且8088端口修改也生效了

notify：- 空格之后接第一个handlers的名字- 空格之后接第二个handlers的名字

[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install httpd service
yum: name=httpd
- name: start service
service: name=httpd state=started enabled=yes
tags: rehttpd #在此位置加一个tags的标签，后面写上标签名，标签名要有意义且简单，最好加上注释。
- name: copy conf file
copy: src=/etc/httpd/conf/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service handlers:
- name: restart service
service: name=httpd state=restarted[root@ansible playbook]# ansible all -m shell -a 'ps -aux | grep httpd'
192.168.219.136 | SUCCESS | rc=0 >>
root 5969 0.0 0.1 106096 1128 pts/1 S+ 06:12 0:00 /bin/sh -c ps -aux | grep httpd
root 5971 0.0 0.0 103308 852 pts/1 S+ 06:12 0:00 grep httpdWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ192.168.219.137 | SUCCESS | rc=0 >>
root 6998 0.0 0.1 106096 1120 pts/1 S+ 06:12 0:00 /bin/sh -c ps -aux | grep httpd
root 7000 0.0 0.0 103308 848 pts/1 S+ 06:12 0:00 grep httpdWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ
可以看到httpd服务是没有启动的
[root@ansible playbook]# ansible-playbook -t rehttpd playbook.test.yml
-t 指定标签名执行playbook
PLAY [all] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [start service] ********************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'ps -aux | grep httpd'
192.168.219.136 | SUCCESS | rc=0 >>
root 6101 0.0 0.3 183896 3832 ? Ss 06:12 0:00 /usr/sbin/httpd
apache 6104 0.0 0.2 184028 2508 ? S 06:12 0:00 /usr/sbin/httpd
apache 6105 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6106 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6107 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6108 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6109 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6110 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
apache 6111 0.0 0.2 184028 2484 ? S 06:12 0:00 /usr/sbin/httpd
root 6143 0.0 0.1 106096 1128 pts/1 S+ 06:12 0:00 /bin/sh -c ps -aux | grep httpd
root 6145 0.0 0.0 103312 860 pts/1 S+ 06:12 0:00 grep httpdWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ192.168.219.137 | SUCCESS | rc=0 >>
root 7130 0.0 0.3 183896 3824 ? Ss 06:12 0:00 /usr/sbin/httpd
apache 7133 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7134 0.0 0.2 184028 2500 ? S 06:12 0:00 /usr/sbin/httpd
apache 7135 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7136 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7137 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7138 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7139 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
apache 7140 0.0 0.2 184028 2476 ? S 06:12 0:00 /usr/sbin/httpd
root 7172 0.0 0.1 106096 1124 pts/1 S+ 06:12 0:00 /bin/sh -c ps -aux | grep httpd
root 7174 0.0 0.0 103312 856 pts/1 S+ 06:12 0:00 grep httpdWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ[root@ansible playbook]#
可以看到httpd服务就启动了

[root@ansible conf]# ansible all -m shell -a 'netstat -anptu | grep 8088'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::8088 :::* LISTEN 7130/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::8088 :::* LISTEN 6101/httpd
可以看到服务端口是8088
我们把配置文件改9099，并执行在copy位置加的标签
[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install httpd service
yum: name=httpd
- name: start service
service: name=httpd state=started enabled=yes
tags: rehttpd
- name: copy conf file
copy: src=/etc/httpd/conf/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service
tags: cohttpd #在此处加了标签 handlers:
- name: restart service
service: name=httpd state=restarted[root@ansible playbook]# ansible-playbook -t cohttpd playbook.test.ymlPLAY [all] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [copy conf file] *******************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]RUNNING HANDLER [restart service] *******************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=3 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=2 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep 9099'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::9099 :::* LISTEN 7464/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::9099 :::* LISTEN 6435/httpd[root@ansible playbook]#
可以看到端口是9099，我们执行了copy的配置文件下发同时也触发了重启任务的操作。

[root@ansible playbook]# ansible all -m shell -a 'httpd -v'
192.168.219.136 | FAILED | rc=127 >>
/bin/sh: httpd: command not foundnon-zero return code192.168.219.137 | FAILED | rc=127 >>
/bin/sh: httpd: command not foundnon-zero return code[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install httpd service
yum: name=httpd
tags: inhttpd #在此处我加了一个安装httpd服务的标签
- name: start service
service: name=httpd state=started enabled=yes
- name: copy conf file
copy: src=/etc/httpd/conf/httpd.conf dest=/etc/httpd/conf/ backup=yes
notify: restart service
tags: cohttpd #增加了该端口配置的标签 handlers:
- name: restart service
service: name=httpd state=restarted[root@ansible playbook]# ansible-playbook -t inhttpd,cohttpd playbook.test.yml
在-t指定标签执行的时候我可以选择多个标签进行执行，中间逗号区分即可
PLAY [all] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [install httpd service] *****************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]TASK [copy conf file] ************************************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]RUNNING HANDLER [restart service] ************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=4 changed=3 unreachable=0 failed=0
192.168.219.137 : ok=4 changed=3 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep 1234'
192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::1234 :::* LISTEN 7152/httpd192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::1234 :::* LISTEN 8120/httpd[root@ansible playbook]#

[root@ansible playbook]# ansible 192.168.219.136 -m setup | grep 'ansible_kernel'
"ansible_kernel": "2.6.32-573.el6.x86_64",
[root@ansible playbook]# ansible 192.168.219.136 -m setup -a 'filter=ansible_kernel'
192.168.219.136 | SUCCESS => {
"ansible_facts": {
"ansible_kernel": "2.6.32-573.el6.x86_64"
},
"changed": false
}
[root@ansible playbook]#
两种方式都可以，但是你要写到playbook里面的grep命令可能会出问题，还是使用推荐的命令，这个setup过滤出来的数值我们到时候就可以进行调用，以满足其他的需求。

[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root tasks:
- name: install soft
yum: name={{ deploy }} #在安装的名字的位置使用变量名，格式就是两组花括号，前后留有空格不是强制要求，只是为了更加简洁易读
- name: start service
service: name={{ deploy }} state=started enabled=yes
#同样在只要使用到包名的位置都要替换成变量[root@ansible playbook]# ansible-playbook -e 'deploy=vsftpd' playbook.test.yml
#在执行的时候跟上-e参数，后面的变量直接指定实际要安装的程序名即可PLAY [all] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [install soft] *****************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]TASK [start service] *************************************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=3 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=2 unreachable=0 failed=0
可以看到ftp程序安装成，我们进行检查，看下服务是否启动
[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep 21'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 2906/vsftpd
tcp 0 0 192.168.219.137:22 192.168.219.135:38357 ESTABLISHED 2928/sshd
tcp 0 0 192.168.219.137:22 192.168.219.1:50993 ESTABLISHED 2679/sshd
tcp 0 0 192.168.219.137:22 192.168.219.1:50994 ESTABLISHED 2681/sshd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 2936/vsftpd
tcp 0 0 192.168.219.136:22 192.168.219.1:50861 ESTABLISHED 2640/sshd
tcp 0 0 192.168.219.136:22 192.168.219.135:34572 ESTABLISHED 2954/sshd
tcp 0 0 192.168.219.136:22 192.168.219.1:50865 ESTABLISHED 2642/sshd[root@ansible playbook]#
可以看到21端口启用了，ftp程序安装并启动成功。

[root@ansible playbook]# cat playbook.test.yml
---
- hosts: all
remote_user: root
vars:
- deploy1: redis #在脚本里面就把变量进行赋值
- deploy2: subversion
tasks:
- name: install soft
yum: name={{ deploy1 }}
- name: install soft
yum: name={{ deploy2 }}[root@ansible playbook]# ansible-playbook playbook.test.yml
#执行的时候就不需要在给变量传参
PLAY [all] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [install soft] **************************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]TASK [install soft] **************************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=3 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=2 unreachable=0 failed=0[root@ansible playbook]# ansible all -m shell -a 'rpm -qa redis'
[WARNING]: Consider using the yum, dnf or zypper module rather than running rpm. If you need to use command because yum, dnf or zypper is insufficient
you can add warn=False to this command task or set command_warnings=False in ansible.cfg to get rid of this message.192.168.219.136 | SUCCESS | rc=0 >>
redis-3.2.12-2.el6.x86_64192.168.219.137 | SUCCESS | rc=0 >>
redis-3.2.12-2.el6.x86_64[root@ansible playbook]# ansible all -m shell -a 'rpm -qa subversion'
[WARNING]: Consider using the yum, dnf or zypper module rather than running rpm. If you need to use command because yum, dnf or zypper is insufficient
you can add warn=False to this command task or set command_warnings=False in ansible.cfg to get rid of this message.192.168.219.137 | SUCCESS | rc=0 >>
subversion-1.6.11-15.el6_7.x86_64192.168.219.136 | SUCCESS | rc=0 >>
subversion-1.6.11-15.el6_7.x86_64
可以看到都安装成功

## db-[99:101]-node.example.com
[web]
192.168.219.136 httpd_server=8080
192.168.219.137 httpd_server=9090
在组所属的ip后面在加以区分，相当于标记，不竟能在第一时间查看到机器服务还能看到端口[root@ansible playbook]# cat playbook.test.yml
---
- hosts: web
remote_user: root tasks:
- name: mod hostname
hostname: name=www.{{http_server}}.http.com
#在脚本里面调用变量进行主机名批量修改[root@ansible playbook]# cat playbook.test.yml
---
- hosts: web
remote_user: root tasks:
- name: set server
hostname: name=www{{http_server}}.http.com[root@ansible playbook]# vim playbook.test.yml
[root@ansible playbook]# ansible-playbook -C playbook.test.ymlPLAY [web] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [set server] ****************************************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]# cat playbook.test.yml
---
- hosts: web
remote_user: root tasks:
- name: set server
hostname: name=www{{httpd_server}}.http.com[root@ansible playbook]# ansible-playbook playbook.test.ymlPLAY [web] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [set server] ****************************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0[root@ansible playbook]# ansible web -a 'hostname'
192.168.219.137 | SUCCESS | rc=0 >>
www9090.http.com192.168.219.136 | SUCCESS | rc=0 >>
www8080.http.com[root@ansible playbook]#
可以看到主机名修改成hosts里面事先定义好了的端口

[web:vars] #也可以在组里面使用变量，指需要在组名后面添加vars即可
name1=www
name2=httpd.com在 hostname: name={{name1}}{{httpd_server}}.{{name2}}位置使用变量，也可以

[root@ansible playbook]# cat vars.yml
db_backup: dbbackup
time: date +%Y%m%d
[root@ansible playbook]#
创建一个vars.yml的文件，把需要定义的变量和指实现写好
[root@ansible playbook]# cat backup.yml
---
- hosts: web
remote_user: root
vars_files:
- vars.yml tasks:
- name: create flie
file: name=/root/{{ db_backup }} state=touch
[root@ansible playbook]#
在playbook里面指定变量使用vars文件来定义，下面要使用变量的部分直接使用vars里面的变量即可
[root@ansible playbook]# ansible web -m shell -a 'ls -h /root'
192.168.219.137 | SUCCESS | rc=0 >>
anaconda-ks.cfg
dbbackup
Desktop
Documents
Downloads
file123
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos192.168.219.136 | SUCCESS | rc=0 >>
anaconda-ks.cfg
dbbackup
Desktop
Documents
Downloads
file123
install.log
install.log.syslog
log.tar.xz
Music
Pictures
Public
Templates
Videos
可以看到创建成功

我们将服务的配置文件拷贝一份放到建立好的路径下，并修改成.j2结尾的文件
[root@ansible templates]# pwd
/home/ansible.test/templates
[root@ansible templates]# ls
httpd.conf.j2 templates.retry templates.yml
修改hosts文件如下：
## db-[99:101]-node.example.com
[web]
192.168.219.136 httpd_server=1010 在hosts文件夹定义好变量
192.168.219.137 httpd_server=2020在httpd.conf里面使用该变量
#Listen 12.34.56.78:80
Listen {{httpd_server}}[root@ansible templates]# cat templates.yml
---
- hosts: web
remote_user: root tasks:
- name: copy httpd
template: src=/home/ansible.test/templates/httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
notify: service restart handlers:
- name: service restart
service: name=httpd state=restarted[root@ansible templates]# ansible-playbook templates.ymlPLAY [web] ***********************************************************************************************************************************************TASK [Gathering Facts] ***********************************************************************************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [copy httpd] ****************************************************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]RUNNING HANDLER [service restart] ************************************************************************************************************************
changed: [192.168.219.137]
changed: [192.168.219.136]PLAY RECAP ***********************************************************************************************************************************************
192.168.219.136 : ok=3 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=2 unreachable=0 failed=0[root@ansible templates]# ansible all -m shell -a 'netstat -anptu | grep httpd'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::2020 :::* LISTEN 5710/httpd
udp 0 0 192.168.219.137:53613 192.168.219.2:53 ESTABLISHED 5710/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::1010 :::* LISTEN 5704/httpd
udp 0 0 192.168.219.136:37088 192.168.219.2:53 ESTABLISHED 5704/httpd[root@ansible templates]#
可以看到两台机器的ip都按照设定的下发了不同端口的配置文件并重启生效了

[root@ansible templates]# cat templates.yml
---
- hosts: web
remote_user: root tasks:
- name: copy httpd
service: name=httpd state=statred
notify: service restart
when: httpd_server == "" handlers:
- name: service restart
service: name=httpd state=stoped[root@ansible templates]#
例如我判断端口等于1010的才会关闭httpd服务

[root@ansible playbook]# cat item.yml
---
- hosts: web
remote_user: root tasks:
- name: create file
file: name=/root/{{ item }} state=touch
#这个item在此处比较特殊，它代表了下面with_items里面的每一个元素 with_items: #在with_items里面定义没一个元素，让上面的item变量来迭代使用
- file1
- file2
- file3[root@ansible playbook]# ansible-playbook item.ymlPLAY [web] ****************************************************************************TASK [Gathering Facts] ****************************************************************
ok: [192.168.219.136]
ok: [192.168.219.137]TASK [create file] ********************************************************************
changed: [192.168.219.136] => (item=file1)
changed: [192.168.219.137] => (item=file1)
changed: [192.168.219.136] => (item=file2)
changed: [192.168.219.137] => (item=file2)
changed: [192.168.219.136] => (item=file3)
changed: [192.168.219.137] => (item=file3)PLAY RECAP ****************************************************************************
192.168.219.136 : ok=2 changed=1 unreachable=0 failed=0
192.168.219.137 : ok=2 changed=1 unreachable=0 failed=0
[root@ansible playbook]# ansible all -m shell -a 'ls /root/ -l'
192.168.219.137 | SUCCESS | rc=0 >>
total 156
-rw-------. 1 root root 3341 Feb 14 01:57 anaconda-ks.cfg
-rw-r--r-- 1 root root 0 Feb 25 06:09 dbbackup
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Desktop
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Documents
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Downloads
-rw-r--r-- 1 root root 0 Feb 27 01:48 file1
drwxr-xr-x 3 root root 4096 Feb 20 13:35 file123
-rw-r--r-- 1 root root 0 Feb 27 01:48 file2
-rw-r--r-- 1 root root 0 Feb 27 01:48 file3
-rw-r--r--. 1 root root 41800 Feb 14 01:57 install.log
-rw-r--r--. 1 root root 9154 Feb 14 01:54 install.log.syslog
-rw-r--r-- 1 root root 55144 Feb 20 13:05 log.tar.xz
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Music
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Pictures
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Public
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Templates
drwxr-xr-x. 2 root root 4096 Feb 14 02:02 Videos192.168.219.136 | SUCCESS | rc=0 >>
total 156
-rw-------. 1 root root 3341 Feb 14 01:56 anaconda-ks.cfg
-rw-r--r-- 1 root root 0 Feb 25 06:09 dbbackup
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Desktop
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Documents
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Downloads
-rw-r--r-- 1 root root 0 Feb 27 01:48 file1
drwxr-xr-x 3 root root 4096 Feb 20 13:35 file123
-rw-r--r-- 1 root root 0 Feb 27 01:48 file2
-rw-r--r-- 1 root root 0 Feb 27 01:48 file3
-rw-r--r--. 1 root root 41800 Feb 14 01:56 install.log
-rw-r--r--. 1 root root 9154 Feb 14 01:53 install.log.syslog
-rw-r--r-- 1 root root 55452 Feb 20 13:05 log.tar.xz
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Music
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Pictures
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Public
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Templates
drwxr-xr-x. 2 root root 4096 Feb 14 02:01 Videos[root@ansible playbook]#
可以看到迭代帮忙创建的空的目录

[root@ansible playbook]# cat item2.yml
---
- hosts: all
remote_user: root tasks:
- name: create groups
group: name={{ item }} state=present
在创建组的时候使用变量的格式
with_items:
- group1
- group2
- group3
- name: add users
user: name={{ item.name }} group={{ item.group }} state=present
#在创建用户的时候把属组参数调用上面定义好的变量
with_items:
- { name: 'user1',group: 'group1' } #在with_items下面以字典的格式记录数据
- { name: 'user2',group: 'group2' }
- { name: 'user3',group: 'group3' }
[root@ansible playbook]# ansible all -m shell -a 'getent passwd'
192.168.219.137 | SUCCESS | rc=0 >>
。。。。。。。
user1:x:502:502::/home/user1:/bin/bash
user2:x:503:503::/home/user2:/bin/bash
user3:x:504:504::/home/user3:/bin/bash[root@ansible playbook]# ansible all -m shell -a 'getent group'
192.168.219.137 | SUCCESS | rc=0 >>
。。。。。
group1:x:502:
group2:x:503:
group3:x:504:
可以看到创建的用户和所属组的关系是我们上面定义好的形式

{% for pote in nginx_pote %}
server{}{% if server_name is defined %}
server name {{}}
{% endif %}
......

[root@ansible playbook]# cat for.yml
---
- hosts: all
remote_user: root
vars:
ports: #在此处定义一个元素列表
- 81
- 82
- 83 tasks:
- name: copy conf
template: src=/home/ansible.test/playbook/for.conf.j2 dest=/root/file123/for.conf
#在拷贝的时候运用模板功能拷贝相应的文件
[root@ansible playbook]# cat for.conf.j2 #创建模板文件。
{% for port in ports %} #此处需要注意的就是ports，这个ports是playbook里面定义好的元素列表名
server{
listen {{ port }} #用for后面的port去拿ports里面的数据，不断赋值给此处的变量port，直到ports里面的数据取完为止
}
{% endfor %}
[root@ansible playbook]#
运行playbook脚本
[root@ansible playbook]# ansible all -m shell -a 'cat /root/file123/for.conf'
192.168.219.137 | SUCCESS | rc=0 >>
server{
listen 81
}
server{
listen 82
}
server{
listen 83
}192.168.219.136 | SUCCESS | rc=0 >>
server{
listen 81
}
server{
listen 82
}
server{
listen 83
}可以看到for.conf文件取到的指就是ports被模板循环赋值的结果。

[root@ansible playbook]# cat for.yml
---
- hosts: all
remote_user: root
vars:
ports: #我们把ports里面的数据定义成字典的形式
- licent: 85
- licent: 86
- licent: 87 tasks:
- name: copy conf
template: src=/home/ansible.test/playbook/for.conf.j2 dest=/root/file123/for.conf[root@ansible playbook]# cat for.conf.j2
{% for port in ports %}
server{
listen {{ port.licent }} #变量的位置就需要用到字典的键名
}
{% endfor %}
[root@ansible playbook]# ansible all -m shell -a 'cat /root/file123/for.conf'
192.168.219.137 | SUCCESS | rc=0 >>
server{
listen 85
}
server{
listen 86
}
server{
listen 87
}192.168.219.136 | SUCCESS | rc=0 >>
server{
listen 85
}
server{
listen 86
}
server{
listen 87
}[root@ansible playbook]#

[root@ansible playbook]# cat for.yml
---
- hosts: all
remote_user: root
vars:
ports: #ports里面我定义多个键值对
- licent: 88
name: www.88.com
- licent: 89
name: www.89.com
- licent: 90
name: www.90.com tasks:
- name: copy conf
template: src=/home/ansible.test/playbook/for.conf.j2 dest=/root/file123/for.conf[root@ansible playbook]# cat for.conf.j2
{% for port in ports %}
server{
listen {{ port.licent }}
server {{ port.name }} #在模板里面我只需要调用playbook里面定义好的变量即可
}
{% endfor %}
[root@ansible playbook]# ansible all -m shell -a 'cat /root/file123/for.conf'
192.168.219.136 | SUCCESS | rc=0 >>
server{
listen 88
server www.88.com
}
server{
listen 89
server www.89.com
}
server{
listen 90
server www.90.com
}192.168.219.137 | SUCCESS | rc=0 >>
server{
listen 88
server www.88.com
}
server{
listen 89
server www.89.com
}
server{
listen 90
server www.90.com
}[root@ansible playbook]#

[root@ansible playbook]# cat for.conf.j2
{% for port in ports %}
server{
listen {{ port.licent }}
{% if port.name is defined %} #增加判断，判断下name是否有指，有指我才执行下面的语句
server {{ port.name }}
{% endif %}
}
{% endfor %}
[root@ansible playbook]# cat for.yml
---
- hosts: all
remote_user: root
vars:
ports:
- licent: 91
# name: www.91.com #将91的name注释掉，让其检查的时候判断为没有指
- licent: 92
name: www.92.com
- licent: 93
name: www.93.com tasks:
- name: copy conf
template: src=/home/ansible.test/playbook/for.conf.j2 dest=/root/file123/for.conf[root@ansible playbook]# ansible all -m shell -a 'cat /root/file123/for.conf'
192.168.219.137 | SUCCESS | rc=0 >>
server{
listen 91
}
server{
listen 92
server www.92.com
}
server{
listen 93
server www.93.com
}192.168.219.136 | SUCCESS | rc=0 >>
server{
listen 91
}
server{
listen 92
server www.92.com
}
server{
listen 93
server www.93.com
}可以看到所属的91是没有创建name的

[root@ansible playbook]# tree roles/
roles/
├── httpd
│ ├── tasks #分别在tasks目录下创建相应的操作剧本
│ │ ├── copy.yml #这每一个剧本只做一件事情，例如copy就做配置文件的拷贝
│ │ ├── group.yml #创建组
│ │ ├── main.yml #这个剧本的名字是固定的，用来规定这所有剧本的执行顺序
│ │ ├── restart.yml #重启
│ │ ├── start.yml #启动
│ │ ├── user.yml #创建用户
│ │ └── yum.yml #安装包
│ └── templates
│ └── httpd.conf.j2
├── mysql
└── nginx
directories, 8 files
[root@ansible tasks]# cat copy.yml
- name: copy httpd.conf
template:src=/home/ansible.test/playbook/roles/httpd/templates/httpd.conf.j2 dest=/etc/httpd/conf/httpd.conf
[root@ansible tasks]# cat group.yml
- name: create group #因是roles形式就不需要在单个剧本定义hosts了，在总运行的剧本里面定义即可
group: name=httpd
[root@ansible tasks]# cat restart.yml
- name: restart server
service: name=hhtpd state=restarted
[root@ansible tasks]# cat start.yml
- name: start server
service: name=httpd state=started enabled=yes
[root@ansible tasks]# cat user.yml
- name: create user
user: name=httpd group=httpd system=yes shell=/sbin/nologin
[root@ansible tasks]# cat yum.yml
- name: install
yum: name=httpd
用main.yml来规定这些剧本的执行顺序
[root@ansible tasks]# cat main.yml
- include: group.yml
- include: user.yml
- include: yum.yml
- include: copy.yml
- include: start.yml
#include是固定词
[root@ansible tasks]#
[root@ansible templates]# cat httpd.conf.j2 | grep httpd_server
Listen {{ httpd_server }}
[root@ansible templates]#
定义模板，端口在hosts里面提前定义
[root@ansible playbook]# cat httpd.yml
---
- hosts: web
remote_user: root
roles: #用关键字来调用roles角色下面的httpd，一层层的执行剧本。
- role: httpd
在roles平级的目录下写一个总调用的剧本
[root@ansible playbook]# ansible-playbook httpd.ymlPLAY [web] ******************************************************************************************************************TASK [Gathering Facts] ******************************************************************************************************
ok: [192.168.219.137]
ok: [192.168.219.136]TASK [httpd : copy httpd.conf] **********************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]TASK [httpd : start server] *************************************************************************************************
changed: [192.168.219.136]
changed: [192.168.219.137]PLAY RECAP ******************************************************************************************************************
192.168.219.136 : ok=3 changed=2 unreachable=0 failed=0
192.168.219.137 : ok=3 changed=2 unreachable=0 failed=0
[root@ansible playbook]# ansible all -m shell -a 'netstat -anptu | grep httpd'
192.168.219.137 | SUCCESS | rc=0 >>
tcp 0 0 :::9090 :::* LISTEN 3560/httpd192.168.219.136 | SUCCESS | rc=0 >>
tcp 0 0 :::8080 :::* LISTEN 3382/httpd[root@ansible playbook]#
这样我们通过roles把流程规划的很清晰，不会再出现单一playbook出现的问题而难以调整或者复用的问题

[root@ansible ansible.test]# tree roles
roles
├── keepalived
│   ├── handlers
│   │   └── restart.yml
│   ├── tasks
│   │   ├── copy.yml
│   │   ├── main.yml
│   │   ├── start.yml
│   │   └── yum.yml
│   ├── templates
│   │   └── keepalived.conf.j2
│   └── vars
│   └── main.yml
├── nginx
│   ├── handlers
│   ├── tasks
│   │   ├── copy.yml
│   │   ├── main.yml
│   │   ├── start.yml
│   │   └── yum.yml
│   ├── templates
│   │   └── nginx.conf.j2
│   └── vars
└── redis
├── handlers
├── tasks
├── templates
└── vars15 directories, 12 files
[root@ansible ansible.test]# cat roles/keepalived/vars/main.yml
ip_addr: 192.168.219.130/24 把keep需要的虚拟ip通过变量存在vars里面
[root@ansible ansible.test]# cat roles/keepalived/templates/keepalived.conf.j2vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority {{ vrrp }}
advert_int 210
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
{{ ip_addr }}
}
}
[root@ansible ansible.test]# cat setup.yml
---
- hosts: all
remote_user: root
roles:
- { role: keepalived,tags: ['keepalived','web'],when：ansible_nodename == "www8080.http.com"}
- { role: nginx,tags: ['nginx','web']}
[root@ansible ansible.test]#
在总控制的剧本里面加入tags标签，并加入判断，当主机名等于指定的名称之后才装keep。
ansible-playbook --tags="keepalived" setup.yml 在执行的时候加上标签来执行
[root@ansible ansible.test]# ansible all -m shell -a 'ps -aux | grep keepalived'
192.168.219.137 | SUCCESS | rc=0 >>
root 8382 0.0 0.1 106096 1128 pts/1 S+ 08:24 0:00 /bin/sh -c ps -aux | grep keepalived
root 8384 0.0 0.0 103308 852 pts/1 S+ 08:24 0:00 grep keepalivedWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ192.168.219.136 | SUCCESS | rc=0 >>
root 10398 0.0 0.1 110276 1088 ? Ss 08:23 0:00 /usr/sbin/keepalived -D
root 10400 0.0 0.2 114584 2944 ? S 08:23 0:00 /usr/sbin/keepalived -D
root 10401 0.0 0.2 114452 2024 ? S 08:23 0:00 /usr/sbin/keepalived -D
root 10440 0.0 0.1 106096 1128 pts/1 S+ 08:24 0:00 /bin/sh -c ps -aux | grep keepalived
root 10442 0.0 0.0 103308 856 pts/1 S+ 08:24 0:00 grep keepalivedWarning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.8/FAQ[root@ansible ansible.test]# ansible all -m shell -a 'hostname'
192.168.219.137 | SUCCESS | rc=0 >>
www9090.http.com192.168.219.136 | SUCCESS | rc=0 >>
www8080.http.com
可以看到总程序能自动判断并安装相应的程序