使用playbook實現一鍵優化集羣

環境

外網IP	內網IP	主機名
10.0.0.5	172.16.1.5	lb01 （負載均衡）
10.0.0.6	172.16.1.6	lb02
10.0.0.7	172.16.1.7	web01(服務器)
10.0.0.8	172.16.1.8	web02
10.0.0.9	172.16.1.9	web03
10.0.0.31	172.16.1.31	nfs （共享存儲）
10.0.0.41	172.16.1.41	backup
10.0.0.51	172.16.1.51	db01 （數據庫）
10.0.0.52	172.16.1.52	db02
10.0.0.53	172.16.1.53	db03（代理機）
10.0.0.54	172.16.1.54	db04（代理機）
10.0.0.61	172.16.1.61	m01 （跳板機）
10.0.0.71	172.16.1.71	zabbix

流程分析

1.安裝ansible
2.優化ansible
3.推送公鑰
4.開啓防火牆
5.開啓80 443 873 nfs等端口和服務白名單
6.關閉selinux
7.建立同一的用戶

推送公鑰

1.建立密鑰對
[root@m01 ~]# ssh-keygen
2.推送公鑰
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.5
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.6
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.7
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.8
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.9
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.31
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.41
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.51
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.52
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.53
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.54
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.61
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.71
[root@m01 ~]# ssh-copy-id -i ~/.ssh/id_rsa.pub root@172.16.1.81

ansible優化

1.下載
[root@m01 ~]#  yum install -y ansible
2.優化
[root@m01 ~]#  vim /etc/ansible/ansible.cfg		#改成
host_key_checking = False

配置主機清單

[root@m01 ~]# vim /root/ansible/hosts 
#[]標籤名任意，可是最好不要用特殊符號（- | &）和大寫字母，中文（不能是nginx）
#端口是22的時候能夠省略
[web_group]
172.16.1.7 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.8 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.9 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[db_group]
172.16.1.51 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.52 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.53 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.54 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[nfs_group]
172.16.1.31 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[redis_group]
172.16.1.81 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[lb_group]
172.16.1.5 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'
172.16.1.6 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[backup_group]
172.16.1.41 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[zabbix_group]
172.16.1.71 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[m01_group]
172.16.1.61 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

[mtj_group]
172.16.1.202 ansible_ssh_port=22 asible_ssh_user=root ansible_ssh_pass='1'

yml

mkdir /root/ansible/ -p &&\
vim /root/ansible/base.yml

- hosts: all
  tasks:
    - name: Start FireWall
      service:
        name: firewalld
        state: started

    - name: Stop SeLinux
      selinux:
        state: disabled

    - name: Create www Group
      group:
        name: www
        gid: 666
        state: present

    - name: Create www User
      user:
        name: www
        uid: 666
        group: www
        shell: /sbin/nologin
        create_home: false

    - name: Open http Port
      firewalld:
        service: http
        state: enabled
        permanent: no

    - name: Open https Port
      firewalld:
        service: https
        state: enabled
        permanent: no

    - name: Open rsync Port
      firewalld:
        port: 873/tcp
        state: enabled
        permanent: no

    - name: Open nfs Port
      firewalld:
        service: nfs
        state: enabled
        permanent: no

yml2

- hosts: all 
  tasks: 
    - name: Start FireWall 
      service: 
        name: firewalld 
        state: started
        enabled: yes
 
    - name: Stop SeLinux 
      selinux: 
        state: disabled 

    - name: open ports
      firewalld: 
        port: '{{ item.port }}'
        state: enabled
        permanent: no
      with_items:
        - { port: "80/tcp" }
        - { port: "443/tcp" }
        - { port: "873/tcp" }

    - name: open nfs 
      firewalld:
        service: nfs
        state: enabled
        permanent: no

    - name: Create www Group
      group:
        name: www
        gid: 666
        state: present

    - name: Create www User
      user:
        name: www
        uid: 666
        group: www
        shell: /sbin/nologin
        create_home: false