Ansible基本命令

Ansible安裝完成以後就自帶不少命令，其中較經常使用的有7個：

• ansible
• ansible-doc
• ansible-galaxy
• ansible-init
• ansible-playbook
• ansible-pull
• ansible-vault

ansible

ansible -h
Usage: ansible <host-pattern> [options]

　　對本機執行一個命令：

ansible 127.0.0.1 -a "date"

127.0.0.1 | SUCCESS | rc=0 >>
Fri Apr  6 18:45:01 CST 2018

　　在遠程主機上執行命令;

ansible test -a "date"

172.16.1.10 | UNREACHABLE! => {
    "changed": false, 
    "msg": "Failed to connect to the host via ssh: Warning: Permanently added '172.16.1.10' (ECDSA) to the list of known hosts.\r\nPermission denied (publickey,password).\r\n", 
    "unreachable": true
}

由上可知：在遠程主機上執行命令的時候沒有權限（密碼不知道），因此咱們能夠在上述命令的基礎上加上-k參數：

ansible test -a "date" -k

SSH password: 
172.16.1.10 | SUCCESS | rc=0 >>
Fri Apr  6 18:56:52 CST 2018

　　ansible命令的經常使用參數;

-a MODULE_ARGS, --args=MODULE_ARGS module arguments  命令行參數
--ask-vault-pass      ask for vault password
-B SECONDS, --background=SECONDS
-C, --check           don't make any changes; instead, try to predict some
-D, --diff            when changing (small) files and templates, show the
-e EXTRA_VARS, --extra-vars=EXTRA_VARS
-f FORKS, --forks=FORKS     # 指定執行任務時併發數量
-i INVENTORY, --inventory=INVENTORY, --inventory-file=INVENTORY  #指定庫存主機文件的路徑，默認爲/etc/ansible/hosts                
-l SUBSET, --limit=SUBSET
--list-hosts          outputs a list of matching hosts; does not execute
-m MODULE_NAME, --module-name=MODULE_NAME module name to execute (default=command)  # 執行模塊的名稱，默認使用command模塊
-M MODULE_PATH, --module-path=MODULE_PATH
-u REMOTE_USER, --user=REMOTE_USER      # 執行用戶，使用這個遠程用戶而不是當前用戶
-U SUDO_USER, --sudo-user=SUDO_USER     # sudo到哪一個用戶，默認爲root
-k, --ask-pass  ask for connection password     # 登錄密碼，提示輸入ssh密碼
-K, --ask-become-pass       # 提示密碼使用sudo -s --sudo sudo運行
--new-vault-id=NEW_VAULT_ID the new vault identity to use for rekey
--new-vault-password-file=NEW_VAULT_PASSWORD_FILES new vault password file for rekey
-o, --one-line        condense output
-P POLL_INTERVAL, --poll=POLL_INTERVAL set the poll interval if using -B (default=15)
--syntax-check        perform a syntax check on the playbook, but do not execute it
-t TREE, --tree=TREE  log output to this directory
--vault-id=VAULT_IDS  the vault identity to use
--vault-password-file=VAULT_PASSWORD_FILES vault password file
-v, --verbose         verbose mode (-vvv for more, -vvvv to enable connection debugging)
--version             show program's version number and exit
--private-key=PRIVATE_KEY_FILE, --key-file=PRIVATE_KEY_FILE
-c CONNECTION, --connection=CONNECTION              
-T TIMEOUT, --timeout=TIMEOUT               
--ssh-common-args=SSH_COMMON_ARGS          
--sftp-extra-args=SFTP_EXTRA_ARGS                    
--scp-extra-args=SCP_EXTRA_ARGS       
--ssh-extra-args=SSH_EXTRA_ARGS
-s, --sudo          run operations with sudo (nopasswd) (deprecated, use become)  
-S, --su            run operations with su (deprecated, use become)
-R SU_USER, --su-user=SU_USER
-b, --become        run operations with become (does not imply password prompting)
--become-method=BECOME_METHOD privilege escalation method to use (default=sudo), valid choices: [ sudo | su | pbrun | pfexec | doas | dzdo | ksu | runas | pmrun ]
--become-user=BECOME_USER run operations as this user (default=root)
--ask-sudo-pass     ask for sudo password (deprecated, use become)
--ask-su-pass       ask for su password (deprecated, use become)

ansible-doc

ansible-doc -h
Usage: ansible-doc [-l|-s] [options] [-t <plugin type] [plugin]

plugin documentation tool

Options:
-a, --all             **For internal testing only** Show documentation for
                        all plugins.
-h, --help            show this help message and exit
-l, --list            List available plugins
-M MODULE_PATH, --module-path=MODULE_PATH
                        prepend colon-separated path(s) to module library
                        (default=[u'/root/.ansible/plugins/modules',
                        u'/usr/share/ansible/plugins/modules'])
-s, --snippet         Show playbook snippet for specified plugin(s)
-t TYPE, --type=TYPE  Choose which plugin type (defaults to "module")
-v, --verbose         verbose mode (-vvv for more, -vvvv to enable
                        connection debugging)
--version             show program's version number and exit

See man pages for Ansible CLI options or website for tutorials
https://docs.ansible.com

ansible-doc 至關於一個幫助文檔，結合-s參數

ansible-doc -s file

- name: Sets attributes of files
file:
  attributes:            # Attributes the file or directory should have. To get supported flags look at the man page for `chattr' on the
                           target system. This string should contain the attributes in the same order as the
                           one displayed by `lsattr'.
  follow:                # This flag indicates that filesystem links, if they exist, should be followed.
  force:                 # force the creation of the symlinks in two cases: the source file does not exist (but will appear later); the
                           destination exists and is a file (so, we need to unlink the "path" file and create
                           symlink to the "src" file in place of it).
  group:                 # Name of the group that should own the file/directory, as would be fed to `chown'.
  mode:                  # Mode the file or directory should be. For those used to `/usr/bin/chmod' remember that modes are actually octal
                           numbers (like 0644). Leaving off the leading zero will likely have unexpected
                           results. As of version 1.8, the mode may be specified as a symbolic mode (for
                           example, `u+rwx' or `u=rw,g=r,o=r').
  owner:                 # Name of the user that should own the file/directory, as would be fed to `chown'.
  path:                  # (required) path to the file being managed.  Aliases: `dest', `name'
  recurse:               # recursively set the specified file attributes (applies only to state=directory)
  selevel:               # Level part of the SELinux file context. This is the MLS/MCS attribute, sometimes known as the `range'. `_default'
                           feature works as for `seuser'.
  serole:                # Role part of SELinux file context, `_default' feature works as for `seuser'.
  setype:                # Type part of SELinux file context, `_default' feature works as for `seuser'.
  seuser:                # User part of SELinux file context. Will default to system policy, if applicable. If set to `_default', it will use
                           the `user' portion of the policy if available.
  src:                   # path of the file to link to (applies only to `state=link'). Will accept absolute, relative and nonexisting paths.
                           Relative paths are not expanded.
  state:                 # If `directory', all immediate subdirectories will be created if they do not exist, since 1.7 they will be created
                           with the supplied permissions. If `file', the file will NOT be created if it does
                           not exist, see the [copy] or [template] module if you want that behavior.  If
                           `link', the symbolic link will be created or changed. Use `hard' for hardlinks. If
                           `absent', directories will be recursively deleted, and files or symlinks will be
                           unlinked. Note that `absent' will not cause `file' to fail if the `path' does not
                           exist as the state did not change. If `touch' (new in 1.4), an empty file will be
                           created if the `path' does not exist, while an existing file or directory will
                           receive updated file access and modification times (similar to the way `touch`
                           works from the command line).
  unsafe_writes:         # Normally this module uses atomic operations to prevent data corruption or inconsistent reads from the target
                           files, sometimes systems are configured or just broken in ways that prevent this.
                           One example are docker mounted files, they cannot be updated atomically and can
                           only be done in an unsafe manner. This boolean option allows ansible to fall back
                           to unsafe methods of updating files for those cases in which you do not have any
                           other choice. Be aware that this is subject to race conditions and can lead to data
                           corruption.

　　ansible新版已經添加了操做docker的相關模塊：

ansible-doc -l |grep docker

docker                                    manage docker containers                                                                           
docker_container                          manage docker containers                                                                           
docker_image                              Manage docker images.                                                                              
docker_image_facts                        Inspect docker images                                                                              
docker_login                              Log into a Docker registry.                                                                        
docker_network                            Manage Docker networks                                                                             
docker_secret                             Manage docker secrets.                                                                             
docker_service                            Manage docker services and containers.                                                             
docker_volume                             Manage Docker volumes

ansible-galaxy

　　從官網下載其餘第三方模塊和插件。

ansible-galaxy install username.rolename

ansible-init

　　ansible-init是對Ansible的playbook進行語法檢查的一個工具。

ansible-playbook

　　該命令時使用最多的命令，其經過讀取playbook文件後，執行相應的動做。

ansible-pull

　　ansible的另外一種模式-- pull模式。跟日常使用的push模式恰好相反，適用於如下場景;

• 操做巨大數量的主機，即便使用很是高的線程仍是須要很長時間；
• 在沒有網絡鏈接的主機上運行Ansible時；

ansible-vault

　　ansible-vault主要應用於配置文件中含有敏感信息的時候，不但願別人看到，這時使用這個命令能夠將某些配置文件加密，屬於高級用法。主要對於playbook裏涉及到配置密碼或者其餘敏感信息時，可使用該命令加密。在使用相似cat等查看命令查看加密後的配置文件時，須要輸入密碼才能夠查看。這種playbook執行時，須要加上--ask-vault-pass參數，一樣須要輸入密碼以後才能執行。