Ansible學習筆記（一）：部署管理Windows機器遇到的一些坑

在給國盛通上海測試環境作Ansible管理Windows服務器的時候，遇到了一些坑，Google解決掉了，特此記錄，坑用紅色標記。

1、環境說明

1.Ansible管理主機

操做系統：CentOS 7.4

ip：172.50.1.119

2.Ansible客戶端主機

操做系統：Windows Server 2008 R2

ip：172.50.1.172

2、開始部署

1.Windows部分：

（1）升級PowerShell版本到4.0【Windows Server 2012的同窗就不須要升級了，Server 2012的PowerShell默認版本就是4.0】

# 1.下載並安裝Microsoft .NET Framework 4.5
https://download.microsoft.com/download/B/A/4/BA4A7E71-2906-4B2D-A0E1-80CF16844F5F/dotNetFx45_Full_setup.exe

# 2.下載並安裝PowerShell 4.0(Windows Management Framework 4.0
https://download.microsoft.com/download/3/D/6/3D61D262-8549-4769-A660-230B67E15B25/Windows6.1-KB2819745-x64-MultiPkg.msu

# 3.重啓Windows Server以後，打開PowerShell，查看升級是否成功，如圖1所示。
get-host

【圖1】

（2）Windows Server開啓winrm服務【這個服務 遠程管理做用】

如下都在PowerShell中進行

# 1.查看powershell執行策略
get-executionpolicy

# 2.更改powershell執行策略爲remotesigned【輸入y確認】
set-executionpolicy remotesigned

# 3.配置winrm service並啓動服務
winrm quickconfig

# 4.修改winrm配置，啓用遠程鏈接認證【這裏是PowerShell的命令，若是用cmd的話，@前面的' 和 末尾的' 要去掉的】【如圖2所示】
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="true"}'

# 5.查看winrm service啓動監聽狀態【若是有應答，說明服務配置並啓動成功了】【如圖3所示】
winrm enumerate winrm/config/listener

【圖2】【圖3】

（3）設置防火牆入站規則

容許5985端口入站經過。這個很簡單，略。

2.CentOS部分（Ansible管理主機）

重點：千萬不要yum安裝。選擇pip安裝，或者二進制包安裝。不然，即使安裝了pywinrm插件也沒法管理Windows主機。報圖4錯誤。

 

"msg": "winrm or requests is not installed: No module named winrm"

 

【圖4】

（1）安裝pip命令【先安裝python3環境:http://www.javashuo.com/article/p-hguhmsbl-ec.html】

# 1.從官網下載pip包到本地，官網連接：https://pypi.org/project/pip/#files
[root@localhost ~]# wget https://files.pythonhosted.org/packages/8e/76/66066b7bc71817238924c7e4b448abdb17eb0c92d645769c223f9ace478f/pip-20.0.2.tar.gz

# 2.解壓
[root@localhost ~]# tar -zxvf pip-20.0.2.tar.gz -C /usr/local

# 3.安裝
[root@localhost ~]# cd /usr/local/pip-20.0.2
[root@localhost pip-20.0.2]# python3 setup.py install

（2）安裝pywinrm插件

[root@localhost ~]# pip install pywinrm
Collecting pywinrm
  Using cached pywinrm-0.4.1.tar.gz (36 kB)
Requirement already satisfied: xmltodict in /usr/local/lib/python3.7/site-packages (from pywinrm) (0.12.0)
Requirement already satisfied: requests>=2.9.1 in /usr/local/lib/python3.7/site-packages (from pywinrm) (2.22.0)
Requirement already satisfied: requests_ntlm>=0.3.0 in /usr/local/lib/python3.7/site-packages (from pywinrm) (1.1.0)
Requirement already satisfied: six in /usr/local/lib/python3.7/site-packages (from pywinrm) (1.14.0)
Requirement already satisfied: chardet<3.1.0,>=3.0.2 in /usr/local/lib/python3.7/site-packages (from requests>=2.9.1->pywinrm) (3.0.4)
Requirement already satisfied: idna<2.9,>=2.5 in /usr/local/lib/python3.7/site-packages (from requests>=2.9.1->pywinrm) (2.8)
Requirement already satisfied: urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1 in /usr/local/lib/python3.7/site-packages (from requests>=2.9.1->pywinrm) (1.25.8)
Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python3.7/site-packages (from requests>=2.9.1->pywinrm) (2019.11.28)
Requirement already satisfied: cryptography>=1.3 in /usr/local/lib/python3.7/site-packages (from requests_ntlm>=0.3.0->pywinrm) (2.8)
Requirement already satisfied: ntlm-auth>=1.0.2 in /usr/local/lib/python3.7/site-packages (from requests_ntlm>=0.3.0->pywinrm) (1.4.0)
Requirement already satisfied: cffi!=1.11.3,>=1.8 in /usr/local/lib/python3.7/site-packages (from cryptography>=1.3->requests_ntlm>=0.3.0->pywinrm) (1.14.0)
Requirement already satisfied: pycparser in /usr/local/lib/python3.7/site-packages (from cffi!=1.11.3,>=1.8->cryptography>=1.3->requests_ntlm>=0.3.0->pywinrm) (2.19)
Installing collected packages: pywinrm
    Running setup.py install for pywinrm ... done
Successfully installed pywinrm-0.4.1

（3）pip安裝ansible

[root@localhost ~]# pip install ansible

（4）配置文件

配置文件默認路徑：/etc/ansible/hosts，在此配置文件尾巴追加如下信息，ansible_ssh_user是Windows Server的用戶名，ansible_ssh_pass是Windows Server的密碼

[windows]
172.50.1.172 ansible_ssh_user="Administrator" ansible_ssh_pass="Password" ansible_ssh_port=5985 ansible_connection="winrm" ansible_winrm_server_cert_validation=ignore

（5）驗證通不通，顯示SUCCESS表示通了

# ping下通不通
[root@localhost ~]# ansible windows -m win_ping 
172.50.1.172 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}

3、重點與說明

1.重點

（1）升級PowerShell到4.0要先升級.Net Franmwork；

（2）開啓winrm服務在CMD下、PowerShell下語法是不同的，本文是在PowerShell下進行的，有截圖爲證；

（3）必定要安裝pywinrm插件，不然管理Windows Server的時候會報錯"msg": "winrm or requests is not installed: No module named winrm"

（4）若是安裝了pywinrm仍是報這個錯，是由於yum安裝的ansible沒法調用pip安裝的pywinrm插件，故而建議用pip安裝ansible或者用源碼包安裝ansible。【這個坑埋得比較深，仍是Google解決的，這裏吐槽下Baidu搜不到】【用yum安裝ansible沒法調用pip安裝的pywinrm插件，不肯定是否是必現，但在我工做的測試環境出現了】

2.說明

ansible詳解用法