了解Ansible：
Ansible是一个配置管理和应用部署工具,基于Python开发，集合了众多运维工具（puppet、cfengine、chef、func、fabric、SaltStack ）的优点，实现了批量系统配置、批量程序部署、批量运行命令等功能。
Ansible可以去对服务器上（1-N台）的一些系统应用进行配置管理，更该部分参数。
Ansible可以去安装一个新的软件应用，或者是一组软件应用。
Ansible优点：
理解Ansible架构与大体执行过程：
Ansible配置以ini格式存储配置数据，在Ansible中⼏乎所有配置都可以通过Ansible的Playbook或环境变量来重新赋值。在运⾏Ansible命令时，命令将会按照以下顺序查找配置⽂件。
ANSIBLE_CONFIG：⾸先，Ansible命令会检查环境变量，及这个环境变量指向的配置⽂件。./ansible.cfg：其次，将会检查当前⽬录下的ansible.cf g配置⽂件。~/.ansible.cfg：再次，将会检查当前⽤户home⽬录下的.ansible.cf g配置⽂件。/etc/ansible/ansible.cfg：最后，将会检查在⽤软件包管理⼯具安装Ansible时⾃动产⽣的配置⽂件。
环境介绍：
管理主机 k8s_master1 192.168.1.18
被托管主机 k8s_node1 192.168.1.19
被托管主机 K8S_node2 192.168.1.20
操作系统 Centos 7.5
环境准备：
1.生成ansible管理主机公钥，来免密登录其他被托管主机
代码语言：javascript复制[root@k8s_master1 ~]# ssh-keygen -t rsa -f /root/.ssh/id_rsa -N ''
Generating public/private rsa key pair.
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:C83s9W2AFEOhYsFt3ZDlsKtQcTBbqG7jehzG7LMHG g root@k8s_master1
The key's randomart image is:
---[RSA 2048]----
| ... =X*. |
| .. Bo*. |
| oo o . |
| ..* . o |
| =o S . |
| . @ . o |
| . * * . o |
| E B . . |
| .o. |
----[SHA256]-----
2.将ansible管理主机的ssh公钥发至其他被托管主机上
代码语言：javascript复制[root@k8s_master1 ~]# for i in 19 20
> do
> ssh-copy-id root@192.168.1.$i
> done
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.1.19's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.1.19'"
and check to make sure that only the key(s) you wanted were added.
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
The authenticity of host '192.168.1.20 (192.168.1.20)' can't be established.
ECDSA key fingerprint is SHA256:DI9rx0dRdCTu6Cl7zRfi7873nsD/quehEO m/BNxZwM.
ECDSA key fingerprint is MD5:8a:9f:cb:c8:b0:38:23:c6:95:7e:72:97:f2:d0:33:7b.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@192.168.1.20's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh 'root@192.168.1.20'"
and check to make sure that only the key(s) you wanted were added.
3.被托管主机上查看公钥发送情况
代码语言：javascript复制[root@k8s_node1 ~]# ll /root/.ssh/
总用量 4
-rw------- 1 root root 398 8月 9 17:49 authorized_keys
[root@k8s_node2 ~]# ll /root/.ssh/
总用量 4
-rw------- 1 root root 398 8月 9 17:49 authorized_keys
4.测试ansible管理主机免密登录被托管主机
代码语言：javascript复制[root@k8s_master1 ~]# ssh root@192.168.1.19
Last login: Mon Aug 9 17:53:32 2021 from 192.168.1.18
[root@k8s_node1 ~]# 登出
Connection to 192.168.1.19 closed.
[root@k8s_master1 ~]# ssh root@192.168.1.20
Last login: Mon Aug 9 17:53:29 2021 from 192.168.1.18
[root@k8s_node2 ~]# 登出
Connection to 192.168.1.20 closed.
注意：
由于我们只是在ansible管理主机上生成了公钥，并且只是单向的将ansible管理主机的公钥分别传给另外两台被托管主机，所以免密登录只能是ansible管理主机免密登录另外两台被托管主机，他们三台主机之间并不能互相免密登录。（要实现三台主机互相免密登录，需要分别在三台主机上都生成各自的公钥，并且三台主机还需要把自己的公钥在三台主机中相互发送，这样三台主机就可以实现相互免密登录了。）
修改/etc/hosts：
修改/etc/hosts项不是必须，只是为了后续使用方便（如更快解析主机名与IP）。在此之前，请提前修改主机名。临时修改主机名：hostname ‘主机名’永久修改主机名：‘修改/etc/hostname文件’，重启生效。
[root@k8s_master1 ~]# vim /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.18 k8s_master1 //管理主机
192.168.1.19 k8s_node1 //被托管主机1
192.168.1.20 k8s_node2 //被托管主机2
--发送修改好的/etc/hosts文件至另外两台被托管主机，就不用手动添加--
[root@k8s_master1 ~]# for i in 19 20
> do
> scp /etc/hosts root@192.168.1.$i:/etc/
> done
--验证发送情况--
[root@k8s_node1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.18 k8s_master1
192.168.1.19 k8s_node1
192.168.1.20 k8s_node2
[root@k8s_node2 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.18 k8s_master1
192.168.1.19 k8s_node1
192.168.1.20 k8s_node2
安装Ansible：
- 对管理主机 - 要求Python 2.6或2.7及以上
- Ansible使用以下模块，都需要安装 - paramiko - PyYAML - Jinja2 - httplib2 - six
- 对被托管主机 - ansible默认通过SSH协议管理机器 - 被管理主机要开启ssh服务，允许ansible主机登录 - 在托管节点上也需要安装Python2.5或以上的版本 - 如果托管节点上开启了SElinux，需要安装libselinux-python
1.配置epel源
代码语言：javascript复制[root@k8s_master1 ~]# cat >> /etc/yum.repos.d/my.repo << EOF
> [epel]
> name=epel
> baseurl=http://mirrors.aliyun.com/epel/7Server/x86_64/
> enable=1
> gpgcheck=0
> EOF
[root@k8s_master1 ~]# cat /etc/yum.repos.d/my.repo
[epel]
name=epel
baseurl=http://mirrors.aliyun.com/epel/7Server/x86_64/
enable=1
gpgcheck=0
2.加载epel源
代码语言：javascript复制[root@k8s_master1 ~]# yum clean all
[root@k8s_master1 ~]# yum repolist
已加载插件：fastestmirror
Loading mirror speeds from cached hostfile
* base: mirrors.ustc.edu.cn
* extras: mirrors.ustc.edu.cn
* updates: mirrors.ustc.edu.cn
base | 3.6 kB 00:00:00
docker-ce-stable | 3.5 kB 00:00:00
epel | 4.7 kB 00:00:00
extras | 2.9 kB 00:00:00
updates | 2.9 kB 00:00:00
(1/6): epel/group_gz | 96 kB 00:00:00
(2/6): epel/updateinfo | 1.0 MB 00:00:00
(3/6): extras/7/x86_64/primary_db | 242 kB 00:00:00
(4/6): epel/primary_db | 6.9 MB 00:00:00
(5/6): docker-ce-stable/7/x86_64/primary_db | 63 kB 00:00:01
(6/6): updates/7/x86_64/primary_db | 9.5 MB 00:00:01
源标识 源名称 状态
base/7/x86_64 CentOS-7 - Base 10,072
docker-ce-stable/7/x86_64 Docker CE Stable - x86_64 122
epel epel 13,625
extras/7/x86_64 CentOS-7 - Extras 498
updates/7/x86_64 CentOS-7 - Updates 2,552
repolist: 26,869
3.管理主机安装ansible
代码语言：javascript复制[root@k8s_master1 ~]# yum -y install ansible
......
======================================================================================================================
正在安装:
ansible noarch 2.9.23-1.el7 epel 17 M
为依赖而安装:
PyYAML x86_64 3.10-11.el7 base 153 k
libyaml x86_64 0.1.4-11.el7_0 base 55 k
python-babel noarch 0.9.6-8.el7 base 1.4 M
python-backports x86_64 1.0-8.el7 base 5.8 k
python-backports-ssl_match_hostname noarch 3.5.0.1-1.el7 base 13 k
python-cffi x86_64 1.6.0-5.el7 base 218 k
python-enum34 noarch 1.0.4-1.el7 base 52 k
python-idna noarch 2.4-1.el7 base 94 k
python-ipaddress noarch 1.0.16-2.el7 base 34 k
python-jinja2 noarch 2.7.2-4.el7 base 519 k
python-markupsafe x86_64 0.11-10.el7 base 25 k
python-paramiko noarch 2.1.1-9.el7 base 269 k
python-ply noarch 3.4-11.el7 base 123 k
python-pycparser noarch 2.14-1.el7 base 104 k
python-setuptools noarch 0.9.8-7.el7 base 397 k
python-six noarch 1.9.0-2.el7 base 29 k
python2-cryptography x86_64 1.7.2-2.el7 base 502 k
python2-httplib2 noarch 0.18.1-3.el7 epel 125 k
python2-jmespath noarch 0.9.4-2.el7 epel 41 k
python2-pyasn1 noarch 0.1.9-7.el7 base 100 k
sshpass x86_64 1.06-2.el7 extras 21 k
......
已安装:
ansible.noarch 0:2.9.23-1.el7
作为依赖被安装:
PyYAML.x86_64 0:3.10-11.el7 libyaml.x86_64 0:0.1.4-11.el7_0
python-babel.noarch 0:0.9.6-8.el7 python-backports.x86_64 0:1.0-8.el7
python-backports-ssl_match_hostname.noarch 0:3.5.0.1-1.el7 python-cffi.x86_64 0:1.6.0-5.el7
python-enum34.noarch 0:1.0.4-1.el7 python-idna.noarch 0:2.4-1.el7
python-ipaddress.noarch 0:1.0.16-2.el7 python-jinja2.noarch 0:2.7.2-4.el7
python-markupsafe.x86_64 0:0.11-10.el7 python-paramiko.noarch 0:2.1.1-9.el7
python-ply.noarch 0:3.4-11.el7 python-pycparser.noarch 0:2.14-1.el7
python-setuptools.noarch 0:0.9.8-7.el7 python-six.noarch 0:1.9.0-2.el7
python2-cryptography.x86_64 0:1.7.2-2.el7 python2-httplib2.noarch 0:0.18.1-3.el7
python2-jmespath.noarch 0:0.9.4-2.el7 python2-pyasn1.noarch 0:0.1.9-7.el7
sshpass.x86_64 0:1.06-2.el7
完毕！
验证：
代码语言：javascript复制[root@k8s_master1 ~]# ansible --version
ansible 2.9.23
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python2.7/site-packages/ansible
executable location = /usr/bin/ansible
python version = 2.7.5 (default, Apr 11 2018, 07:36:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]
