Ansible Playbook
清单（Inventory）
# inventory/hosts.ini
[webservers]
web1.example.com
web2.example.com ansible_user=ubuntu
[dbservers]
db1.example.com ansible_host=10.0.1.10
[production:children]
webservers
dbservers
[production:vars]
ansible_user=deploy
# 运行命令
ansible -i inventory/hosts.ini webservers -m ping
ansible-playbook -i inventory/hosts.ini deploy.yml
Playbook 结构
---
- name: 部署 Web 应用
hosts: webservers
become: yes
serial: 2 # 滚动更新：每次 2 台
vars:
app_version: "2.1.0"
app_dir: /opt/myapp
vars_files:
- vars/common.yml
tasks:
- name: 创建应用目录
file:
path: "{{app_dir}}"
state: directory
mode: '0755'
- name: 部署应用
copy:
src: dist/
dest: "{{app_dir}}/"
notify: Restart nginx
handlers:
- name: Restart nginx
service:
name: nginx
state: restarted
任务与模块
tasks:
# 包管理
- name: 安装软件包
package:
name: "{{item}}"
state: present
loop: [nginx, git, python3-pip]
# 模板文件
- name: 部署 Nginx 配置
template:
src: templates/nginx.conf.j2
dest: /etc/nginx/nginx.conf
validate: nginx -t -c %s
notify: Reload nginx
# 注册命令输出
- name: 获取当前版本
command: /opt/myapp/bin/version
register: current_version
changed_when: false
变量与条件
# 条件判断
- name: 在 RHEL 上安装 Apache
yum:
name: httpd
state: present
when: ansible_os_family == "RedHat"
# 循环
- name: 创建用户
user:
name: "{{item.name}}"
groups: "{{item.groups}}"
loop:
- { name: alice, groups: sudo }
- { name: bob, groups: developers }
Ansible Vault
# 加密文件
ansible-vault encrypt vars/secrets.yml
# 编辑加密文件
ansible-vault edit vars/secrets.yml
# 使用 vault 密码运行 Playbook
ansible-playbook deploy.yml --ask-vault-pass
ansible-playbook deploy.yml --vault-password-file ~/.vault_pass