Ansible Playbook 自动化运维实战

# Ansible Playbook 自动化运维实战 ## Inventory 管理 ```ini # inventory/production.ini [webservers] web1 ansible_host=10.0.1.10 web2 ansible_host=10.0.1.11 [dbservers] db1 ansible_host=10.0.2.10 [all:vars] ansible_user=deploy ansible_python_interpreter=/usr/bin/python3 ``` ## Playbook 结构 ```yaml # playbooks/deploy-app.yml --- - name: Deploy application hosts: webservers become: yes vars_files: - ../vars/app_config.yml - ../vars/secrets.yml # ansible-vault encrypted pre_tasks: - name: Update apt cache apt: update_cache: yes cache_valid_time: 3600 roles: - common - nginx - app post_tasks: - name: Verify service health uri: url: "http://{{ inventory_hostname }}:8080/health" status_code: 200 retries: 5 delay: 10 ``` ## Role 设计 ```yaml # roles/app/tasks/main.yml --- - name: Create app directory file: path: "{{ app_dir }}" state: directory owner: "{{ app_user }}" mode: "0755" - name: Copy application jar copy: src: "{{ app_jar_path }}" dest: "{{ app_dir }}/app.jar" owner: "{{ app_user }}" notify: restart app - name: Deploy systemd service file template: src: app.service.j2 dest: /etc/systemd/system/{{ app_name }}.service notify: - reload systemd - restart app ``` ## Handler 定义 ```yaml # roles/app/handlers/main.yml --- - name: reload systemd systemd: daemon_reload: yes - name: restart app systemd: name: "{{ app_name }}" state: restarted enabled: yes ``` ## Vault 加密敏感信息 ```bash # 加密文件 ansible-vault encrypt vars/secrets.yml # 运行时解密 ansible-playbook playbooks/deploy-app.yml --ask-vault-pass # 查看加密内容 ansible-vault view vars/secrets.yml ``` Ansible 的幂等性设计使得 Playbook 可以安全地反复执行，建议结合 CI/CD 流水线实现变更自动审批与部署。