ansible中的角色使用--nginx+持续交付和滚动升级+时间同步角色+selinux+自动添加磁盘

文章目录

1. nginx
2. 持续交付和滚动升级
3. noarch(时间同步角色)
4. selinux
5.自动添加磁盘
- 使用角色添加磁盘
- 用任务命令创建lv
- 用任务命令进行设备分区

ansible文档:https://docs.ansible.com/ansible/2.9/

1. nginx

角色： geerlingguy.nginx

Linux服务之nginx介绍及配置:https://www.cnblogs.com/dragonyear22/p/13482709.htmlB

[root@server1 ansible]# ansible-galaxy install geerlingguy.nginx
- downloading role 'nginx', owned by geerlingguy
- downloading role from https://github.com/geerlingguy/ansible-role-nginx/archive/3.1.0.tar.gz
- extracting geerlingguy.nginx to /mnt/ansible/roles/geerlingguy.nginx
- geerlingguy.nginx (3.1.0) was installed successfully
[root@server1 ansible]# ansible-galaxy list
# /mnt/ansible/roles
- apache, (unknown version)
- haproxy, (unknown version)
- geerlingguy.nginx, 3.1.0
[root@server1 ansible]# cat ansible.cfg
[defaults]
inventory = ./hosts
remote_user = westos
roles_path = ./roles
[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False[root@server1 ansible]# cd roles/
[root@server1 roles]# ls
apache  geerlingguy.nginx  haproxy
[root@server1 roles]# tree .
[root@server1 roles]# cd geerlingguy.nginx/
[root@server1 geerlingguy.nginx]# ls
defaults  handlers  LICENSE  meta  molecule  README.md  tasks  templates  vars
[root@server4 ~]# systemctl stop httpd[root@server1 ansible]# cd roles/geerlingguy.nginx/defaults/
[root@server1 defaults]# vim main.yml
nginx_vhosts:
# Example vhost below, showing all available options:- listen: "80" # default: "80"server_name: "localhost" # default: N/Aroot: "/var/www/html" # default: N/Aindex: "index.html index.htm" # default: "index.html index.htm"filename: "example.com.conf" # Can be used to set the vhost filename.[root@server1 ansible]# vim playbook1.yml
---
- hosts: 192.168.0.4roles:- geerlingguy.nginx
[root@server1 ansible]# ansible-playbook playbook1.yml [root@server4 conf.d]# cd /etc/nginx/conf.d/
[root@server4 conf.d]# ls
example.com.conf
[root@server4 conf.d]# cat example.com.conf
[root@server4 conf.d]# netstat -antlp
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      31583/nginx: master
[root@server4 conf.d]# curl localhost
server4[root@server1 ansible]# ansible-galaxy remove geerlingguy.nginx
[root@server1 ansible]# ansible-galaxy --list
[root@server1 roles]# ls
apache  haproxy
[root@server4 conf.d]# systemctl stop nginx
[root@server4 conf.d]# systemctl disable nginx
Removed /etc/systemd/system/multi-user.target.wants/nginx.service.

2. 持续交付和滚动升级

[root@server1 ansible]# vim playbook1.yml
---
- hosts: allroles:- role: apachewhen: inventory_hostname in groups['webserver']- role: haproxywhen: ansible_hostname == '192.168.0.1'
[root@server1 ansible]# ansible-playbook playbook1.yml
[root@server4 conf.d]# systemctl stop httpd

server4处于维护状态

[root@server4 conf.d]# systemctl start httpd
[root@server1 haproxy]# vim /etc/haproxy/haproxy.cfg stats socket /var/lib/haproxy/stats level admin
[root@server1 haproxy]# systemctl reload haproxy.service
[root@server1 haproxy]# echo "disable server app/server4" | socat stdio /var/lib/haproxy/stats
[root@server1 haproxy]# echo "enable server app/server4" | socat stdio /var/lib/haproxy/stats

disable

enable

滚动更新

3. noarch(时间同步角色)

时间同步角色：rhel-system-roles.timesync

[root@server1 ansible]# dnf install -y rhel-system-roles.noarch
[root@server1 ansible]# rpm -qa | grep role
rhel-system-roles-1.0-10.el8_1.noarch
[root@server1 ansible]# rpm -ql rhel-system-roles
/usr/share/ansible/roles
[root@server1 ansible]# cd /usr/share/ansible/roles
[root@server1 roles]# ls
linux-system-roles.kdump    linux-system-roles.selinux   rhel-system-roles.kdump    rhel-system-roles.selinux
linux-system-roles.network  linux-system-roles.storage   rhel-system-roles.network  rhel-system-roles.storage
linux-system-roles.postfix  linux-system-roles.timesync  rhel-system-roles.postfix  rhel-system-roles.timesync
[root@server1 roles]# ansible-galaxy list
[root@server1 roles]# cd /mnt/ansible
[root@server1 ansible]# cat ansible.cfg
[defaults]
inventory = ./hosts
remote_user = westos
roles_path = /usr/share/ansible/roles  ##更改角色路径[privilege_escalation]
become=True
become_method=sudo
become_user=root
become_ask_pass=False
[root@server1 ansible]# ansible-galaxy list

[root@server1 ansible]# cd /usr/share/ansible/roles/
[root@server1 roles]# cd rhel-system-roles.timesync
[root@server1 rhel-system-roles.timesync]# ls
COPYING  defaults  examples  handlers  library  meta  README.html  README.md  tasks  templates  tests  vars
[root@server1 rhel-system-roles.timesync]# cd /usr/share/doc/rhel-system-roles/
[root@server1 rhel-system-roles]# ls
kdump  network  postfix  selinux  storage  timesync
[root@server1 rhel-system-roles]# cd timesync/
[root@server1 timesync]# ls
COPYING  example-timesync-playbook.yml  example-timesync-pool-playbook.yml  README.html  README.md
[root@server1 timesync]# cp example-timesync-playbook.yml /mnt/ansible/
[root@server1 timesync]# cd /mnt/ansible/
[root@server1 ansible]# vim example-timesync-playbook.yml
---
- hosts: webservervars:timesync_ntp_servers:- hostname: 192.168.0.100iburst: yesroles:- rhel-system-roles.timesync
[root@server1 ansible]# ansible-playbook example-timesync-playbook.yml [root@foundation15 templates]# vim /etc/chrony.conf
# Allow NTP client access from local network.
allow 192.168/16
[root@foundation15 templates]# systemctl restart chronyd.service
[root@server4 conf.d]# cat /etc/chrony.conf  ##server2 3 4
[root@server4 conf.d]# chronyc sources -v

4. selinux

通过角色改变selinux 值：rhel-system-roles.selinux

[root@server1 ~]# cd /usr/share/doc/rhel-system-roles/selinux
[root@server1 selinux]# ls
COPYING  example-selinux-playbook.yml  README.html  README.md
[root@server1 selinux]# cp example-selinux-playbook.yml /mnt/ansible/
[root@server1 selinux]# cd /mnt/ansible/
[root@server4 conf.d]# cat /etc/sysconfig/selinux
[root@server4 conf.d]# getenforce
permissive
[root@server1 ansible]# vim selinux-playbook.yml
---
- hosts: server4vars:selinux_policy: targetedselinux_state: enforcingroles:- rhel-system-roles.selinux
[root@server1 ansible]# ansible-playbook selinux-playbook.yml
[root@server4 conf.d]# getenforce
enforcing

permissive <----> enforcing 不需要重启 enforcing 、permissive <----> disabled 需要重启

[root@server1 ansible]# cp example-selinux-playbook.yml selinux-playbook.yml
[root@server3 ~]# getenforce
Disabled
[root@server4 ~]# getenforce
enforcing
[root@server1 ansible]# vim selinux-playbook.yml
[root@server1 ansible]# ansible-playbook selinux-playbook.yml[root@server3 ~]# Connection to 192.168.0.3 closed by remote host.
Connection to 192.168.0.3 closed.
[root@foundation Desktop]# ssh root@192.168.0.3
[root@server3 ~]# getenforce
enforcing

改变selinux端口、服务的bool值、内核安全上下文、文件存储目录

[root@server3 ~]# getsebool -a | grep samba_enable_home_dirs
samba_enable_home_dirs --> off
[root@server3 ~]# getsebool samba_enable_home_dirs
samba_enable_home_dirs --> off
[root@server3 ~]# ll -Zd /tmp/
drwxrwxrwt. 13 root root system_u:object_r:tmp_t:s0 4096 Jul  9 14:41 /tmp/
[root@server1 ansible]# vim selinux-playbook.yml
[root@server1 ansible]# ansible-playbook selinux-playbook.yml
[root@server3 ~]# getsebool -a | grep samba
[root@server3 ~]# cd /samba/
[root@server3 samba]# ll -Zd .
drwxr-xr-x. 2 root root unconfined_u:object_r:samba_share_t:s0 6 Jul  9 14:49 .
[root@server3 samba]# vim /etc/httpd/conf/httpd.conf
Listen 82
[root@server3 samba]# systemctl restart httpd
[root@server3 samba]# netstat -antlp

执行命令前只能httpd端口更改为80和8080。

5.自动添加磁盘

使用角色添加磁盘

rhel-system-roles.storage
server4 添加10G 虚拟磁盘

[root@server1 ansible]# cat hosts
[test]
server2
[prod]
server3
server4
[webserver:children]
test
prod
[lb]
server1
[root@server1 ansible]# cp /usr/share/doc/rhel-system-roles/storage/README.md storage.yml
[root@server1 ansible]# vim storage.yml
---
##hosts文件与yml文件内需一致，ip对应ip，名称对应名称
- hosts: server4   roles:- name: rhel-system-roles.storagestorage_pools:- name: appdisks:- vdbvolumes:- name: sharedsize: "5 GiB"mount_point: "/mnt/app/shared"fs_type: xfsstate: present          - name: userssize: "4.9 GiB"mount_point: "/mnt/app/users"fs_type: ext4state: present## state: absent 回收
[root@server1 ansible]# ansible-playbook storage.yml
[root@server1 ansible]# ansible-doc -l | grep vol  ##支持各种卷
[root@server4 ~]# cat /etc/fstab
[root@server4 ~]# lvs
[root@server4 ~]# vgs
[root@server4 ~]# pvs## state: absent 回收
[root@server4 ~]# vgremove app
[root@server4 ~]# pvremove /dev/vdb

用任务命令创建lv

[root@server1 ansible]# ansible-doc lvol
[root@server1 ansible]# ansible-doc mount
[root@server1 ansible]# vim lvs.yml
[root@server1 ansible]# ansible-playbook lvs.yml
[root@server1 ansible]# ansible server4 -m setup | less
搜索ansible_lvm##absent 回收
[root@server4 ~]# lvremove /dev/demovg/demolv
[root@server4 ~]# vgremove demovg
[root@server4 ~]# pvremove /dev/vdb

第一次执行 state: mounted ##absent 回收

用任务命令进行设备分区

[root@server1 ansible]# cp lvs.yml parted.yml
[root@server1 ansible]# ansible-doc parted
[root@server1 ansible]# ansible-doc filesystem
/force
[root@server1 ansible]# vim parted.yml
[root@server1 ansible]# ansible-playbook parted.yml
[root@server1 ansible]# ansible server4 -m setup | less ##查看事实变量
/device

ansible中的角色使用--nginx+持续交付和滚动升级+时间同步角色+selinux+自动添加磁盘相关推荐

持续交付模型中文化转型的重要意义
为了加速业务创新,技术领导者正在向持续交付和敏捷靠拢. \\ CIO.com的资深作家Clint Boulton,最近写了一篇新闻分析Agile,continuous delivery models ...
研发协同平台持续交付之代理服务实践
源宝导读:插件系统大大提高了系统的扩展性,有利于模块化开发.系统发布后,当我们需要对系统进行扩充,可以再不编译的情况下更新系统的插件即可.基于热拔插的软件系统提高了持续交付能力,在添加新特性的同时保持 ...
阿里巴巴1682亿背后的“企业级”高效持续交付
摘要: 在2017北京云栖大会上,阿里巴巴高级技术专家陈鑫(花名神秀),给大家带来了<1682亿背后的企业级高效持续交付>,引起强烈共鸣.神秀从技术负责人关心的研发流程混乱.质量无法保障. ...
研发管理---（1）持续交付
拥有3万多人的阿里巴巴,线上有上万个应用,上亿的用户即时在线,每天有几百个应用在线上更新,就像在时速200公里的高速公路上横穿马路维修栅栏一样,时刻保持着心惊胆战,而保护这个过程的体系就是阿里巴巴持续 ...
阿里巴巴1582.73亿背后的持续交付如何玩
在2017在线技术峰会--首届阿里巴巴研发效能嘉年华上,来自阿里云研发协同的技术专家怀虎分享了<阿里巴巴1582.73亿背后的持续交付如何玩>.他详细介绍了阿里巴巴的企业级持续交付,从研发 ...
Atlassian是怎样进行持续交付的？且听 Steve Smith一一道来
在Devoxx UK 2015大会上的一场演讲中,Steve Smith为听众展示了Atlassian是如何进行持续交付的.会后,InfoQ有幸与Steve进行了一次访谈,深入地探讨了演讲内容的更多细 ...
GitOps | 一种云原生的持续交付模型
在此之前您可能听说过"GitOps",但并不知道它到底是什么,除了GitOps,您可能还听说过的DevOps,或者AIOps,GOP的等,是的,现在是"行动"盛 ...
《持续交付》读书笔记
读乔梁先生<持续交付2.0>摘要,仅供学习交流一.持续交付2.0 1.1 软件工程发展 1.瀑布软件开发传统的瀑布软件开发模型每个阶段都花费属于的实际那,需要花费大量的经历确定需求的范 ...
基于Jenkins的持续交付全流程设计与实践
1 从理论开始什么是DevOps? 近年来,随着DevOps理念的逐渐深入人心,企业逐渐意识到从看似重复的手工劳动中实现自动化流程处理,对于提高企业劳动生产力已经非常重要,尤其是面向互联网的开发者, ...