Host *
Compression yes
TCPKeepAlive yes
ServerAliveInterval 120
ServerAliveCountMax 5
ControlMaster auto
ControlPath ~/.ssh/sockets/%r@%h-%p
ControlPersist 1m
[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
[ssh_connection] pipelining = true
UseDNS is an SSH-server setting (/etc/ssh/sshd_config file) which forces a server to check a client’s PTR-record upon connection. It may cause connection delays especially with slow DNS servers on the server side. In modern Linux distribution, this setting is turned off by default, which is correct.
It is an SSH-client setting which informs server about preferred authentication methods. By default Ansible uses:
-o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey
So if GSSAPIAuthenticationis enabled on the server (at the time of writing this it is turned on in RHEL EC2 AMI) it will be tried as the first option, forcing the client and server to make PTR-record lookups. But in most cases, we want to use only public key auth. We can force Ansible to do so by changing ansible.cfg:
[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o PreferredAuthentications=publickey
gather_facts: no
The default value is 5, which is quite conservative. You can experiment with this setting depending on your local CPU and network bandwidth resources.
[defaults]
forks = 20
When module is executed on remote host, Ansible starts to poll for its result. The lower is interval between poll attempts, the higher is CPU load on Ansible control host. But we want to have CPU available for greater forks number (see above). You can tweak poll interval in ansible.cfg: If you run “slow” jobs (like backups) on multiple hosts, you may want to increase the interval to 0.05 to use less CPU.
[defaults]
internal_poll_interval = 0.001
ping 無參數
comand -a 'ifconfig'
user -a 'name= state={present(創建)|absent(刪除)} force=(是否強制操作刪除傢目錄) system= uid= shell= home='
group -a 'name= state={present|absent} gid= system=(系統組)'
cron -a 'name= state= minute= hour= day= month= weekday= job='
file -a 'path= mode= owner= group= state={file|directory|link|hard|touch|absent} src=(link，鏈接至何處)'
copy -a 'dest=(遠程主機上路徑) src=(本地主機路徑) content=(直接指明內容) owner= group= mode='
yum -a 'name= state={present(已安裝)|latest(最新版)|absent(未安裝)}'
service -a 'name= state=started|restarted|stopped|reloaded'
unarchive -a 'src= dest= remote_src={True|False}'
lineinfile -a ''
setup 無參數
[all:vars]
ansible_connection=ssh
ansible_ssh_user='{{ user }}'
ansible_ssh_pass='{{ password }}'
ansible_become_pass='{{ password }}'
# file: production
[atlanta-webservers]
www-atl-1.example.com
www-atl-2.example.com
[boston-webservers]
www-bos-1.example.com
www-bos-2.example.com
[atlanta-dbservers]
db-atl-1.example.com
db-atl-2.example.com
[boston-dbservers]
db-bos-1.example.com
# webservers in all geos
[webservers:children]
atlanta-webservers
boston-webservers
# dbservers in all geos
[dbservers:children]
atlanta-dbservers
boston-dbservers
# everything in the atlanta geo
[atlanta:children]
atlanta-webservers
atlanta-dbservers
# everything in the boston geo
[boston:children]
boston-webservers
boston-dbservers
ansible <Patterns> -m <module_name> -a <arguments> <Options>
Options:
--list-hosts outputs a list of matching hosts
--module-name module name to execute (default=command)
--args module arguments
--user connect as this user
--ask-pass Prompt for the connection password
--become Use privilege escalation
--ask-become-pass Ask for privilege escalation password
--inventory The PATH to the inventory, which defaults to /etc/ansible/hosts
--limit further limit selected hosts to an additional pattern or comma separated host list.
--check Check mode is just a simulation it will not make any changes on remote systems
--verbose verbose mode (-vvv for more, -vvvv to enable connection debugging)
--background= run asynchronously, failing after X seconds(default=N/A)
--poll set the poll interval if using -B (default=15)
--forks specify number of parallel processes to use(default=5)
--extra-vars Extra variables to inject into a playbook, in key=value key=value format or as quoted YAML/JSON (hashes and arrays). To load variables from a file, specify the file preceded by @ (e.g. @vars.yml).
ansible localhost -m ping #連本機自己,無須驗證
ansible localhost -m ping -i "localhost," -u 帳號 -k 密碼 --key-file=私鑰檔案
ansible-playbook playbook.yml <Options>
Options:
--check Check mode is just a simulation it will not make any changes on remote systems
--inventory The PATH to the inventory, which defaults to /etc/ansible/hosts
--limit further limit selected hosts to an additional pattern
--list-hosts outputs a list of matching hosts
--syntax-check perform a syntax check on the playbook, but do not execute it
--tags=TAGS only run plays and tasks tagged with these values
--flush-cache clear the fact cache
ansible-vault [create|decrypt|edit|encrypt|rekey|view] [--help] [options] vaultfile.yml
Options:
create foo.yml 建立加密 (Encrypted) 檔案。
edit foo.yml 編輯加密檔案內容。
rekey foo.yml 更換加密金鑰 (密碼)。
encrypt foo.yml 對已存在的明文檔案進行加密
decrypt foo.yml 解開 (Decrypt) 已加密檔案。
view foo.yml 檢視已加密的檔案內容。
- hosts: all
gather_facts: no
tasks:
- name: ensure enable_twrd is running
service: name=enable_twrd state=started
- hosts: all
gather_facts: no
tasks:
- name: enable twrd account
shell: /etc/init.d/enable_twrd start
- name: check twrd status
shell: /etc/init.d/enable_twrd status
register: ps
- debug: var=ps.stdout_lines
- hosts: all
gather_facts: no
tasks:
- name: copy news archive file to target news path
copy:
src: /root/news.zip
dest: /mydlink/portal/web/_news/news.zip
- name: unzip news archive file to target news path
unarchive:
src: /mydlink/portal/web/_news/news.zip
dest: /mydlink/portal/web/_news/
remote_src: True
- name: change owner and permission to news files
file:
path: /mydlink/portal/web/_news/
owner: webuser
group: daemon
mode: 0750
recurse: yes
- name: template configuration file
template: src=template.j2 dest=/etc/foo.conf
notify:
- restart memcached
- restart apache
handlers:
- name: restart memcached
service: name=memcached state=restarted
- name: restart apache
service: name=apache state=restarted
- hosts: all
connection: local
tasks:
- shell: exit 1
register: task_result
until: task_result.rc == 0
retries: 10
delay: 1
ignore_errors: yes
- name: test play
hosts: webservers
service: name=httpd state=started
serial: "30%"
---
- name: test play
hosts: webservers
service: name=httpd state=started
serial: 3
---
- name: test play
hosts: webservers
serial:
- 1
- 5
- "20%"
[all:vars]
ansible_connection=ssh
ansible_ssh_user='{{ ansible_ssh_user }}'
ansible_ssh_pass='{{ ansible_ssh_pass }}'
ansible_become_pass='{{ ansible_become_pass }}'
---
- hosts: all
gather_facts: no
tasks:
- name: restart sshd service
shell: /etc/init.d/sshd restart
- name: check sshd status
ansible_ssh_user: YOUR_USER_NAME
ansible_ssh_pass: 'YOUR_PASSWORD'
ansible_become_pass: 'YOUR_SUDO_PASSWORD'
echo "`ansible-playbook YOUR_PLAYBOOK.yml --inventory "localhost," --user --ask-ssh-pass --become --ask-become-pass --ask-vault-pass -e@YOUR_VAULT_FILE -vvv`" | tee -a LOG-FILE-PATH