{"id":15942,"date":"2026-04-28T23:20:19","date_gmt":"2026-04-28T15:20:19","guid":{"rendered":"https:\/\/top.duoku.icu\/libs\/15942.html"},"modified":"2026-04-28T23:20:19","modified_gmt":"2026-04-28T15:20:19","slug":"ansible-%e8%87%aa%e5%8a%a8%e5%8c%96%e8%bf%90%e7%bb%b4%ef%bc%9a100-%e5%8f%b0%e6%9c%8d%e5%8a%a1%e5%99%a8%e7%9a%84%e6%89%b9%e9%87%8f%e7%ae%a1%e7%90%86","status":"publish","type":"post","link":"https:\/\/www.srclibs.com\/index.php\/2026\/04\/28\/ansible-%e8%87%aa%e5%8a%a8%e5%8c%96%e8%bf%90%e7%bb%b4%ef%bc%9a100-%e5%8f%b0%e6%9c%8d%e5%8a%a1%e5%99%a8%e7%9a%84%e6%89%b9%e9%87%8f%e7%ae%a1%e7%90%86\/","title":{"rendered":"Ansible \u81ea\u52a8\u5316\u8fd0\u7ef4\uff1a100 \u53f0\u670d\u52a1\u5668\u7684\u6279\u91cf\u7ba1\u7406"},"content":{"rendered":"
\"Ansible<\/div>\n

Ansible \u81ea\u52a8\u5316\u8fd0\u7ef4\uff1a100 \u53f0\u670d\u52a1\u5668\u7684\u6279\u91cf\u7ba1\u7406<\/h1>\n

\u5f15\u8a00<\/h2>\n

\u5728\u4e91\u8ba1\u7b97\u548c DevOps \u65f6\u4ee3\uff0c\u81ea\u52a8\u5316\u8fd0\u7ef4\u5df2\u6210\u4e3a\u63d0\u5347\u6548\u7387\u7684\u5173\u952e\u3002Ansible<\/strong> \u4f5c\u4e3a\u4e00\u6b3e\u65e0\u4ee3\u7406\u7684\u81ea\u52a8\u5316\u5de5\u5177\uff0c\u4ee5\u5176\u7b80\u5355\u3001\u5f3a\u5927\u7684\u7279\u6027\uff0c\u6210\u4e3a\u7ba1\u7406\u5927\u89c4\u6a21\u670d\u52a1\u5668\u96c6\u7fa4\u7684\u9996\u9009\u65b9\u6848\u3002<\/p>\n

\u4e3a\u4ec0\u4e48\u9009\u62e9 Ansible\uff1f<\/strong><\/p>\n

\u274c Shell \u811a\u672c\u7684\u75db\u70b9\uff1a\n
    \n
  • \u96be\u4ee5\u7ef4\u62a4\u548c\u6269\u5c55<\/li>\n
  • \u7f3a\u4e4f\u5e42\u7b49\u6027\u4fdd\u8bc1<\/li>\n
  • \u9519\u8bef\u5904\u7406\u590d\u6742<\/li>\n
  • \u72b6\u6001\u8ffd\u8e2a\u56f0\u96be<\/li>\n<\/ul>\n\n\u274c \u4f20\u7edf\u914d\u7f6e\u7ba1\u7406\u5de5\u5177\uff1a\n
      \n
    • \u9700\u8981\u5b89\u88c5 Agent\uff08\u5982 Puppet\u3001Chef\uff09<\/li>\n
    • \u5b66\u4e60\u66f2\u7ebf\u9661\u5ced<\/li>\n
    • \u67b6\u6784\u590d\u6742\u5ea6\u9ad8<\/li>\n<\/ul>\n\n\u2705 Ansible \u7684\u4f18\u52bf\uff1a\n
        \n
      • \u65e0\u4ee3\u7406\u67b6\u6784\uff0c\u96f6\u989d\u5916\u90e8\u7f72<\/li>\n
      • \u57fa\u4e8e SSH\uff0c\u65e0\u9700\u989d\u5916\u7aef\u53e3<\/li>\n
      • \u7b80\u5355\u6613\u5b66\u7684 YAML \u8bed\u6cd5<\/li>\n
      • \u5f3a\u5927\u7684\u6a21\u5757\u751f\u6001\u7cfb\u7edf\uff082000+ \u6a21\u5757\uff09<\/li>\n
      • \u5b8c\u5168\u5e42\u7b49\u64cd\u4f5c<\/li>\n<\/ul>\n<\/code><\/pre>\n
        \u9002\u7528\u573a\u666f\uff1a<\/strong><\/p>\n
          \n
        • ? \u670d\u52a1\u5668\u6279\u91cf\u914d\u7f6e\u7ba1\u7406<\/li>\n
        • ? \u5e94\u7528\u6279\u91cf\u90e8\u7f72<\/li>\n
        • ? \u6279\u91cf\u5347\u7ea7\u548c\u8865\u4e01\u7ba1\u7406<\/li>\n
        • ? \u5408\u89c4\u6027\u68c0\u67e5\u548c\u5ba1\u8ba1<\/li>\n
        • ? \u65e5\u5e38\u8fd0\u7ef4\u81ea\u52a8\u5316<\/li>\n<\/ul>\n
          \u9002\u7528\u8bfb\u8005\uff1a<\/strong> \u7cfb\u7edf\u8fd0\u7ef4\u5de5\u7a0b\u5e08\u3001DevOps \u5de5\u7a0b\u5e08\u3001IT \u7ba1\u7406\u5458<\/p>\n
          —<\/p>\n
          Ansible \u6838\u5fc3\u6982\u5ff5<\/h2>\n
          1. \u6838\u5fc3\u7ec4\u4ef6<\/h3>\n
          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502                   Ansible \u6838\u5fc3\u6982\u5ff5                          \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502                                                             \u2502\n\u2502  Inventory (\u6e05\u5355)                                          \u2502\n\u2502  \u2514\u2500 \u5b9a\u4e49\u8981\u7ba1\u7406\u7684\u4e3b\u673a\u5217\u8868\u548c\u5206\u7ec4                              \u2502\n\u2502      \u2502                                                      \u2502\n\u2502      \u251c\u2500 Modules (\u6a21\u5757)                                      \u2502\n\u2502      \u2502   \u2514\u2500 \u5177\u4f53\u64cd\u4f5c\u5355\u5143\uff08\u5982 copy\u3001file\u3001service \u7b49\uff09        \u2502\n\u2502      \u2502                                                             \u2502\n\u2502      \u251c\u2500 Playbooks (\u5267\u672c)                                    \u2502\n\u2502      \u2502   \u2514\u2500 YAML \u6587\u4ef6\uff0c\u5b9a\u4e49\u6267\u884c\u4efb\u52a1\u5e8f\u5217                       \u2502\n\u2502      \u2502                                                             \u2502\n\u2502      \u2514\u2500 Roles (\u89d2\u8272)                                        \u2502\n\u2502          \u2514\u2500 \u53ef\u590d\u7528\u7684\u4efb\u52a1\u96c6\u5408                                 \u2502\n\u2502                                                             \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n<\/code><\/pre>\n
          2. Inventory \u914d\u7f6e<\/h3>\n
          # hosts - \u4e3b\u673a\u6e05\u5355\n[webservers]\nweb01 ansible_host=192.168.1.10\nweb02 ansible_host=192.168.1.11\nweb03 ansible_host=192.168.1.12\n\n[database]\ndb01 ansible_host=192.168.1.20\ndb02 ansible_host=192.168.1.21\n\n[all:vars]\nansible_user=ops\nansible_port=22\nansible_python_interpreter=\/usr\/bin\/python3\n\n[webservers:vars]\nhttp_port=80\nmax_clients=200\n<\/code><\/pre>\n
          3. Inventory \u5206\u7ec4\u7ed3\u6784<\/h3>\n
          # \u591a\u5c42\u7ea7\u5206\u7ec4\n[all:children]\nwebservers\ndbservers\nappservers\n\n[webservers]\nweb01\nweb02\nweb03\n\n[appservers]\napp01\napp02\n<\/code><\/pre>\n
          —<\/p>\n
          \u5b89\u88c5\u4e0e\u914d\u7f6e<\/h2>\n
          1. \u5b89\u88c5 Ansible<\/h3>\n
          # CentOS\/RHEL\nsudo yum install epel-release\nsudo yum install ansible\n\n
          Ubuntu\/Debian<\/h1>\nsudo apt update\nsudo apt install ansible\n\n
          \u4f7f\u7528 pip \u5b89\u88c5\u6700\u65b0\u7248\u672c<\/h1>\npip install ansible\n\n
          \u9a8c\u8bc1\u5b89\u88c5<\/h1>\nansible --version\nansible-config list\n<\/code><\/pre>\n
          2. SSH \u5bc6\u94a5\u914d\u7f6e<\/h3>\n
          # \u751f\u6210 SSH \u5bc6\u94a5\nssh-keygen -t ed25519 -C \"ops@ansible\"\n\n
          \u5206\u53d1\u516c\u94a5\u5230\u6240\u6709\u4e3b\u673a<\/h1>\nfor host in web01 web02 web03 db01 db02; do\n    ssh-copy-id ops@$host\ndone\n\n
          \u6216\u8005\u4f7f\u7528\u6279\u91cf\u5206\u53d1<\/h1>\nansible all -m copy -a \"src=\/root\/.ssh\/id_ed25519.pub dest=~\/.ssh\/authorized_keys\"\n<\/code><\/pre>\n
          3. \u914d\u7f6e\u6587\u4ef6<\/h3>\n
          “`yaml<\/p>\n
          ansible.cfg \u914d\u7f6e\u793a\u4f8b<\/h1>\n
          [defaults]
          \ninventory = .\/hosts
          \nhost_key_checking = False
          \nremote_user = ops
          \ntimeout = 30
          \nforks = 50
          \nretry_files_enabled = False
          \nstdout_callback = yaml
          \nroles_path = .\/roles<\/p>\n
          [inventory]
          \nenable_plugins = host_list, script, yaml, ini<\/p>\n
          [privilege_escalation]
          \nbecome = True
          \nbecome_method = sudo
          \nbecome_user = root
          \nbecome_ask_pass = False<\/p>\n
          \n---\n\n
          \u6279\u91cf\u7ba1\u7406<\/h2>\n\n
          1. \u4e3b\u673a\u5206\u7ec4\u7ba1\u7406<\/h3>\n\n<\/code><\/pre>\n
          yaml<\/p>\n
          \u6309\u73af\u5883\u5206\u7ec4<\/h1>\n
          [production]
          \nweb01 ansible_host=10.0.1.10
          \nweb02 ansible_host=10.0.1.11
          \nweb03 ansible_host=10.0.1.12<\/p>\n
          [staging]
          \nweb04 ansible_host=10.0.2.10
          \nweb05 ansible_host=10.0.2.11<\/p>\n
          [production:children]
          \nwebservers
          \nloadbalancers<\/p>\n
          \n
          2. \u53d8\u91cf\u5b9a\u4e49<\/h3>\n\n<\/code><\/pre>\n
          yaml<\/p>\n
          group_vars\/webservers.yml<\/h1>\n
          http_port: 80
          \nmax_connections: 200
          \nssl_enabled: true
          \nssl_certificate: \/etc\/ssl\/nginx.crt
          \nssl_key: \/etc\/ssl\/nginx.key<\/p>\n
          host_vars\/web01.yml<\/h1>\n
          nginx_worker_processes: 4
          \nnginx_cache_size: 500m<\/p>\n
          \n
          3. \u6a21\u677f\u914d\u7f6e<\/h3>\n\n<\/code><\/pre>\n
          yaml<\/p>\n
          templates\/nginx.conf.j2<\/h1>\n
          server {
          \n    listen {{ http_port }};
          \n    server_name {{ ansible_fqdn }};<\/p>\n
              worker_processes {{ nginx_worker_processes | default(2) }};<\/p>\n
              location \/ {
          \n        proxy_pass http:\/\/localhost:{{ application_port | default(3000) }};
          \n        proxy_set_header Host $host;
          \n        proxy_set_header X-Real-IP $remote_addr;
          \n    }<\/p>\n
              {% if ssl_enabled %}
          \n    ssl_certificate {{ ssl_certificate }};
          \n    ssl_key {{ ssl_key }};
          \n    {% endif %}
          \n}<\/p>\n
          \n---\n\n
          \u6279\u91cf\u4efb\u52a1<\/h2>\n\n
          1. \u6279\u91cf\u6267\u884c\u547d\u4ee4<\/h3>\n\n<\/code><\/pre>\n
          yaml<\/p>\n
          \u6267\u884c\u5355\u6761\u547d\u4ee4<\/h1>\n
          ansible all -m command -a “uptime”
          \nansible webservers -m shell -a “df -h”<\/p>\n
          \u4f7f\u7528\u6a21\u5757\u6267\u884c<\/h1>\n
          ansible all -m ping
          \nansible webservers -m copy -a “src=file.txt dest=\/tmp\/”<\/p>\n
          \n
          2. \u6279\u91cf\u914d\u7f6e\u6587\u4ef6<\/h3>\n\n<\/code><\/pre>\n
          yaml<\/p>\n
          playbook.yml<\/h1>\n
            \n
          • name: \u914d\u7f6e Nginx<\/li>\n<\/ul>\n
              hosts: webservers
            \n  become: yes
            \n  vars:
            \n    http_port: 80<\/p>\n
              tasks:<\/p>\n
              \n
            • name: \u5b89\u88c5 Nginx<\/li>\n<\/ul>\n
                    apt:
              \n        name: nginx
              \n        state: present
              \n      when: ansible_os_family == “Debian”<\/p>\n
                \n
              • name: \u590d\u5236\u914d\u7f6e\u6587\u4ef6<\/li>\n<\/ul>\n
                      template:
                \n        src: templates\/nginx.conf.j2
                \n        dest: \/etc\/nginx\/nginx.conf
                \n        mode: ‘0644’
                \n      notify: restart nginx<\/p>\n
                  \n
                • name: \u542f\u52a8 Nginx<\/li>\n<\/ul>\n
                        service:
                  \n        name: nginx
                  \n        state: started
                  \n        enabled: yes<\/p>\n
                    handlers:<\/p>\n
                    \n
                  • name: restart nginx<\/li>\n<\/ul>\n
                          service:
                    \n        name: nginx
                    \n        state: restarted<\/p>\n
                    \n
                    3. \u6279\u91cf\u8f6f\u4ef6\u5b89\u88c5<\/h3>\n\n<\/code><\/pre>\n
                    yaml<\/p>\n
                      \n
                    • name: \u6279\u91cf\u5b89\u88c5\u5e38\u7528\u8f6f\u4ef6<\/li>\n<\/ul>\n
                        hosts: all
                      \n  become: yes
                      \n  vars:
                      \n    packages:<\/p>\n
                        \n
                      • vim<\/li>\n
                      • htop<\/li>\n
                      • net-tools<\/li>\n
                      • git<\/li>\n
                      • curl<\/li>\n<\/ul>\n
                          tasks:<\/p>\n
                          \n
                        • name: \u5b89\u88c5\u8f6f\u4ef6\u5305<\/li>\n<\/ul>\n
                                package:
                          \n        name: “{{ packages }}”
                          \n        state: present<\/p>\n
                            \n
                          • name: \u9a8c\u8bc1\u5b89\u88c5<\/li>\n<\/ul>\n
                                  command: “{{ item }} –version”
                            \n      register: version_output
                            \n      loop: “{{ packages }}”
                            \n      failed_when: false<\/p>\n
                              \n
                            • name: \u663e\u793a\u7248\u672c\u4fe1\u606f<\/li>\n<\/ul>\n
                                    debug:
                              \n        var: version_output.stdout<\/p>\n
                              \n---\n\n
                              \u5b89\u5168\u7ba1\u7406<\/h2>\n\n
                              1. SSH \u5bc6\u94a5\u7ba1\u7406<\/h3>\n\n<\/code><\/pre>\n
                              yaml<\/p>\n
                              \u4f7f\u7528 SSH \u5bc6\u94a5\u8ba4\u8bc1<\/h1>\n
                                \n
                              • name: \u4f7f\u7528 SSH \u5bc6\u94a5<\/li>\n<\/ul>\n
                                  hosts: webservers
                                \n  connection: ssh
                                \n  user: ops
                                \n  private_key_file: ~\/.ssh\/id_ed25519
                                \n  become: yes
                                \n  become_user: root<\/p>\n
                                \n
                                2. Vault \u52a0\u5bc6<\/h3>\n\n<\/code><\/pre>\n
                                bash<\/p>\n
                                \u521b\u5efa\u52a0\u5bc6\u6587\u4ef6<\/h1>\n
                                ansible-vault create secrets.yml<\/p>\n
                                \u7f16\u8f91\u52a0\u5bc6\u6587\u4ef6<\/h1>\n
                                ansible-vault edit secrets.yml<\/p>\n
                                \u8fd0\u884c\u52a0\u5bc6 Playbook<\/h1>\n
                                ansible-playbook playbook.yml –ask-vault-pass<\/p>\n
                                \u4f7f\u7528\u5bc6\u7801\u6587\u4ef6<\/h1>\n
                                ansible-playbook playbook.yml –vault-password-file=.vault_pass<\/p>\n
                                \n<\/code><\/pre>\n
                                yaml<\/p>\n
                                secrets.yml (\u52a0\u5bc6\u5185\u5bb9)<\/h1>\n
                                db_password: “s3cur3p@ssw0rd”
                                \napi_key: “sk-1234567890abcdef”
                                \njwt_secret: “your-jwt-secret-here”<\/p>\n
                                \n
                                3. \u6743\u9650\u63a7\u5236<\/h3>\n\n<\/code><\/pre>\n
                                yaml<\/p>\n
                                playbook.yml \u6743\u9650\u63a7\u5236<\/h1>\n
                                  \n
                                • name: \u53d7\u9650\u7ba1\u7406<\/li>\n<\/ul>\n
                                    hosts: webservers
                                  \n  become: yes
                                  \n  vars_files:<\/p>\n
                                    \n
                                  • secrets.yml<\/li>\n<\/ul>\n
                                      tasks:<\/p>\n
                                      \n
                                    • name: \u53ea\u8bfb\u64cd\u4f5c\uff08\u65e0\u9700\u7279\u6743\uff09<\/li>\n<\/ul>\n
                                            ansible.builtin.shell: cat \/etc\/hostname
                                      \n      changed_when: false
                                      \n      check_mode: yes<\/p>\n
                                        \n
                                      • name: \u7cfb\u7edf\u914d\u7f6e\uff08\u9700\u8981\u7279\u6743\uff09<\/li>\n<\/ul>\n
                                              ansible.builtin.copy:
                                        \n        content: “privileged content”
                                        \n        dest: \/etc\/privileged.conf
                                        \n        mode: ‘0600’
                                        \n      become: yes<\/p>\n
                                        \n---\n\n
                                        \u5b9e\u6218\u6848\u4f8b<\/h2>\n\n
                                        1. Web \u670d\u52a1\u5668\u6279\u91cf\u90e8\u7f72<\/h3>\n\n<\/code><\/pre>\n
                                        yaml<\/p>\n
                                          \n
                                        • name: Web \u670d\u52a1\u5668\u6279\u91cf\u90e8\u7f72<\/li>\n<\/ul>\n
                                            hosts: webservers
                                          \n  become: yes
                                          \n  gather_facts: yes<\/p>\n
                                            vars:
                                          \n    app_user: www-data
                                          \n    app_group: www-data
                                          \n    app_dir: \/var\/www\/myapp<\/p>\n
                                            tasks:<\/p>\n
                                            \n
                                          • name: \u5b89\u88c5\u4f9d\u8d56\u5305<\/li>\n<\/ul>\n
                                                  apt:
                                            \n        name:<\/p>\n
                                              \n
                                            • nginx<\/li>\n
                                            • python3<\/li>\n
                                            • python3-pip<\/li>\n
                                            • build-essential<\/li>\n<\/ul>\n
                                                      state: present<\/p>\n
                                                \n
                                              • name: \u521b\u5efa\u5e94\u7528\u7528\u6237<\/li>\n<\/ul>\n
                                                      user:
                                                \n        name: “{{ app_user }}”
                                                \n        group: “{{ app_group }}”
                                                \n        shell: \/bin\/bash
                                                \n        create_home: no<\/p>\n
                                                  \n
                                                • name: \u521b\u5efa\u5e94\u7528\u76ee\u5f55<\/li>\n<\/ul>\n
                                                        file:
                                                  \n        path: “{{ app_dir }}”
                                                  \n        state: directory
                                                  \n        owner: “{{ app_user }}”
                                                  \n        group: “{{ app_group }}”
                                                  \n        mode: ‘0755’<\/p>\n
                                                    \n
                                                  • name: \u90e8\u7f72\u5e94\u7528\u4ee3\u7801<\/li>\n<\/ul>\n
                                                          synchronize:
                                                    \n        src: .\/app\/
                                                    \n        dest: “{{ app_dir }}\/”
                                                    \n        owner: “{{ app_user }}”
                                                    \n        group: “{{ app_group }}”
                                                    \n        archive: true<\/p>\n
                                                      \n
                                                    • name: \u914d\u7f6e Nginx<\/li>\n<\/ul>\n
                                                            template:
                                                      \n        src: templates\/nginx.conf.j2
                                                      \n        dest: \/etc\/nginx\/nginx.conf
                                                      \n        owner: root
                                                      \n        group: root
                                                      \n        mode: ‘0644’
                                                      \n      notify: restart nginx<\/p>\n
                                                        \n
                                                      • name: \u6d4b\u8bd5 Nginx \u914d\u7f6e<\/li>\n<\/ul>\n
                                                              command: nginx -t
                                                        \n      changed_when: false<\/p>\n
                                                          \n
                                                        • name: \u542f\u7528\u7f51\u7ad9<\/li>\n<\/ul>\n
                                                                command: ln -s \/etc\/nginx\/sites-available\/default \/etc\/nginx\/sites-enabled\/
                                                          \n      args:
                                                          \n        creates: \/etc\/nginx\/sites-enabled\/default<\/p>\n
                                                            handlers:<\/p>\n
                                                            \n
                                                          • name: restart nginx<\/li>\n<\/ul>\n
                                                                  service:
                                                            \n        name: nginx
                                                            \n        state: restarted
                                                            \n        daemon_reload: yes<\/p>\n
                                                            \n
                                                            2. \u6570\u636e\u5e93\u670d\u52a1\u5668\u6279\u91cf\u914d\u7f6e<\/h3>\n\n<\/code><\/pre>\n
                                                            yaml<\/p>\n
                                                              \n
                                                            • name: \u6570\u636e\u5e93\u670d\u52a1\u5668\u914d\u7f6e<\/li>\n<\/ul>\n
                                                                hosts: database
                                                              \n  become: yes<\/p>\n
                                                                vars:
                                                              \n    mysql_root_password: “{{ vault_mysql_root_password }}”
                                                              \n    mysql_datadir: \/var\/lib\/mysql
                                                              \n    mysql_bind_address: 127.0.0.1<\/p>\n
                                                                tasks:<\/p>\n
                                                                \n
                                                              • name: \u5b89\u88c5 MySQL<\/li>\n<\/ul>\n
                                                                      apt:
                                                                \n        name:<\/p>\n
                                                                  \n
                                                                • mysql-server<\/li>\n
                                                                • mysql-client<\/li>\n
                                                                • python3-mysqldb<\/li>\n<\/ul>\n
                                                                          state: present<\/p>\n
                                                                    \n
                                                                  • name: \u914d\u7f6e MySQL<\/li>\n<\/ul>\n
                                                                          template:
                                                                    \n        src: templates\/mysql.cnf.j2
                                                                    \n        dest: \/etc\/mysql\/mysql.conf.d\/server.cnf
                                                                    \n        owner: root
                                                                    \n        group: root
                                                                    \n        mode: ‘0644’
                                                                    \n      notify: restart mysql<\/p>\n
                                                                      \n
                                                                    • name: \u8bbe\u7f6e root \u5bc6\u7801<\/li>\n<\/ul>\n
                                                                            mysql_user:
                                                                      \n        name: root
                                                                      \n        host: localhost
                                                                      \n        password: “{{ mysql_root_password }}”
                                                                      \n      when: ansible_os_family == “Debian”<\/p>\n
                                                                        \n
                                                                      • name: \u521b\u5efa\u6570\u636e\u5e93<\/li>\n<\/ul>\n
                                                                              mysql_db:
                                                                        \n        name: “{{ item }}”
                                                                        \n        state: present
                                                                        \n        collation: utf8_general_ci
                                                                        \n        encoding: utf8
                                                                        \n      loop:<\/p>\n
                                                                          \n
                                                                        • production_db<\/li>\n
                                                                        • staging_db<\/li>\n<\/ul>\n
                                                                            \n
                                                                          • name: \u521b\u5efa\u5e94\u7528\u7528\u6237<\/li>\n<\/ul>\n
                                                                                  mysql_user:
                                                                            \n        name: “{{ item.user }}”
                                                                            \n        password: “{{ item.password }}”
                                                                            \n        priv: “*.*:ALL”
                                                                            \n        host: “%”
                                                                            \n        state: present
                                                                            \n      loop:<\/p>\n
                                                                              \n
                                                                            • { user: ‘app_user’, password: “{{ vault_app_password }}” }<\/li>\n
                                                                            • { user: ‘readonly_user’, password: “{{ vault_readonly_password }}” }<\/li>\n<\/ul>\n
                                                                                handlers:<\/p>\n
                                                                                \n
                                                                              • name: restart mysql<\/li>\n<\/ul>\n
                                                                                      service:
                                                                                \n        name: mysql
                                                                                \n        state: restarted<\/p>\n
                                                                                \n---\n\n
                                                                                \u6700\u4f73\u5b9e\u8df5<\/h2>\n\n
                                                                                1. Playbook \u7ec4\u7ec7<\/h3>\n\n<\/code><\/pre>\n
                                                                                yaml<\/p>\n
                                                                                project\/<\/h1>\n
                                                                                \u251c\u2500\u2500 ansible.cfg<\/h1>\n
                                                                                \u251c\u2500\u2500 inventory\/<\/h1>\n
                                                                                \u2502   \u251c\u2500\u2500 hosts<\/h1>\n
                                                                                \u2502   \u251c\u2500\u2500 group_vars\/<\/h1>\n
                                                                                \u2502   \u2502   \u251c\u2500\u2500 all.yml<\/h1>\n
                                                                                \u2502 \u2502   \u2502   \u2514\u2500\u2500 webservers.yml<\/h1>\n
                                                                                \u2502 \u2514\u2500\u2500 host_vars\/<\/h1>\n
                                                                                \u2502     \u2514\u2500\u2500 web01.yml<\/h1>\n
                                                                                \u251c\u2500\u2500 playbooks\/<\/h1>\n
                                                                                \u2502   \u251c\u2500\u2500 deploy.yml<\/h1>\n
                                                                                \u2502   \u251c\u2500\u2500 upgrade.yml<\/h1>\n
                                                                                \u2502   \u2514\u2500\u2500 cleanup.yml<\/h1>\n
                                                                                \u251c\u2500\u2500 roles\/<\/h1>\n
                                                                                \u2502   \u251c\u2500\u2500 nginx\/<\/h1>\n
                                                                                \u2502   \u2502   \u251c\u2500\u2500 tasks\/<\/h1>\n
                                                                                \u2502   \u2502   \u251c\u2500\u2500 handlers\/<\/h1>\n
                                                                                \u2502   \u2502   \u251c\u2500\u2500 templates\/<\/h1>\n
                                                                                \u2502   \u2502   \u251c\u2500\u2500 vars\/<\/h1>\n
                                                                                \u2502   \u2502   \u2514\u2500\u2500 defaults\/<\/h1>\n
                                                                                \u2502   \u2514\u2500\u2500 mysql\/<\/h1>\n
                                                                                \u2514\u2500\u2500 vault\/<\/h1>\n
                                                                                \u2514\u2500\u2500 secrets.yml<\/h1>\n
                                                                                \n
                                                                                2. CI\/CD \u96c6\u6210<\/h3>\n\n<\/code><\/pre>\n
                                                                                yaml<\/p>\n
                                                                                .github\/workflows\/ansible.yml<\/h1>\n
                                                                                name: Ansible CI<\/p>\n
                                                                                on:
                                                                                \n  push:
                                                                                \n    paths:<\/p>\n
                                                                                  \n
                                                                                • ‘ansible\/**’<\/li>\n<\/ul>\n
                                                                                    pull_request:
                                                                                  \n    paths:<\/p>\n
                                                                                    \n
                                                                                  • ‘ansible\/**’<\/li>\n<\/ul>\n
                                                                                    jobs:
                                                                                    \n  validate:
                                                                                    \n    runs-on: ubuntu-latest
                                                                                    \n    steps:<\/p>\n
                                                                                      \n
                                                                                    • uses: actions\/checkout@v3<\/li>\n<\/ul>\n
                                                                                        \n
                                                                                      • name: Install Ansible<\/li>\n<\/ul>\n
                                                                                                run: pip install ansible-lint ansible-vault<\/p>\n
                                                                                          \n
                                                                                        • name: Lint Playbooks<\/li>\n<\/ul>\n
                                                                                                  run: ansible-lint playbooks\/<\/p>\n
                                                                                            \n
                                                                                          • name: Syntax Check<\/li>\n<\/ul>\n
                                                                                                    run: ansible-playbook playbooks\/*.yml –syntax-check<\/p>\n
                                                                                              \n
                                                                                            • name: Check Vault Files<\/li>\n<\/ul>\n
                                                                                                      run: ansible-vault view vault\/secrets.yml<\/p>\n
                                                                                              \n
                                                                                              3. \u9519\u8bef\u5904\u7406<\/h3>\n\n<\/code><\/pre>\n
                                                                                              yaml<\/p>\n
                                                                                                \n
                                                                                              • name: \u9519\u8bef\u5904\u7406\u793a\u4f8b<\/li>\n<\/ul>\n
                                                                                                  hosts: all
                                                                                                \n  tasks:<\/p>\n
                                                                                                  \n
                                                                                                • name: \u6267\u884c\u53ef\u80fd\u5931\u8d25\u7684\u64cd\u4f5c<\/li>\n<\/ul>\n
                                                                                                        shell: risky_command
                                                                                                  \n      ignore_errors: yes
                                                                                                  \n      register: result<\/p>\n
                                                                                                    \n
                                                                                                  • name: \u68c0\u67e5\u9519\u8bef<\/li>\n<\/ul>\n
                                                                                                          fail:
                                                                                                    \n        msg: “\u64cd\u4f5c\u5931\u8d25: {{ result.msg }}”
                                                                                                    \n      when: result.failed<\/p>\n
                                                                                                      \n
                                                                                                    • name: \u6267\u884c\u91cd\u8bd5\u903b\u8f91<\/li>\n<\/ul>\n
                                                                                                            shell: recovery_command
                                                                                                      \n      when: result.failed<\/p>\n
                                                                                                        \n
                                                                                                      • name: \u8bb0\u5f55\u9519\u8bef<\/li>\n<\/ul>\n
                                                                                                              debug:
                                                                                                        \n        msg: “\u53d1\u751f\u9519\u8bef\uff1a{{ result }}”
                                                                                                        \n      when: result.failed<\/p>\n
                                                                                                          \n
                                                                                                        • name: \u53d1\u9001\u901a\u77e5<\/li>\n<\/ul>\n
                                                                                                                shell: “notify_admin ‘{{ inventory_hostname }} – {{ result.msg }}'”
                                                                                                          \n      when: result.failed and ansible_run_tags != [‘skip_notify’]<\/p>\n
                                                                                                          \n---\n\n
                                                                                                          \u603b\u7ed3<\/h2>\n\n
                                                                                                          \u6838\u5fc3\u8981\u70b9\u56de\u987e<\/h3>\n\n\u2705 Ansible \u4f18\u52bf<\/strong>\uff1a\u65e0\u4ee3\u7406\u3001SSH \u7ba1\u7406\u3001YAML \u7b80\u5355  \n\u2705 \u6838\u5fc3\u6982\u5ff5<\/strong>\uff1aInventory\u3001Modules\u3001Playbooks\u3001Roles  \n\u2705 \u6279\u91cf\u7ba1\u7406<\/strong>\uff1a\u4e3b\u673a\u5206\u7ec4\u3001\u53d8\u91cf\u3001\u6a21\u677f  \n\u2705 \u5b89\u5168\u7ba1\u7406<\/strong>\uff1aSSH \u5bc6\u94a5\u3001Vault\u3001\u6743\u9650\u63a7\u5236  \n\u2705 \u6700\u4f73\u5b9e\u8df5<\/strong>\uff1aPlaybook \u7ec4\u7ec7\u3001CI\/CD\u3001\u9519\u8bef\u5904\u7406  \n\n
                                                                                                          \u6027\u80fd\u4f18\u5316\u5efa\u8bae<\/h3>\n\n<\/code><\/pre>\n
                                                                                                          yaml<\/p>\n
                                                                                                          \u4f18\u5316\u914d\u7f6e<\/h1>\n
                                                                                                          [defaults]
                                                                                                          \nforks = 50  # \u5e76\u53d1\u6570
                                                                                                          \ntimeout = 30
                                                                                                          \nretry_files_enabled = False<\/p>\n
                                                                                                          [ssh_connection]
                                                                                                          \npipelining = True
                                                                                                          \ncontrol_path = \/tmp\/ansible-ssh-%%h-%%p-%%r<\/p>\n
                                                                                                          \n
                                                                                                          \u63a8\u8350\u5de5\u4f5c\u6d41<\/h3>\n\n<\/code><\/pre>\n
                                                                                                          Ansible \u5de5\u4f5c\u6d41\uff1a<\/p>\n
                                                                                                            \n
                                                                                                          1. \u73af\u5883\u51c6\u5907<\/li>\n<\/ul>\n
                                                                                                               \u251c\u2500 \u5b89\u88c5 Ansible
                                                                                                            \n   \u251c\u2500 \u914d\u7f6e SSH \u5bc6\u94a5
                                                                                                            \n   \u2514\u2500 \u521b\u5efa Inventory<\/p>\n
                                                                                                              \n
                                                                                                            1. \u5f00\u53d1 Playbook<\/li>\n<\/ul>\n
                                                                                                                 \u251c\u2500 \u7f16\u5199\u4efb\u52a1
                                                                                                              \n   \u251c\u2500 \u521b\u5efa Roles
                                                                                                              \n   \u2514\u2500 \u6d4b\u8bd5\u9a8c\u8bc1<\/p>\n
                                                                                                                \n
                                                                                                              1. \u90e8\u7f72\u6267\u884c<\/li>\n<\/ul>\n
                                                                                                                   \u251c\u2500 \u5e72\u8fd0\u884c (–check)
                                                                                                                \n   \u251c\u2500 \u5206\u6279\u90e8\u7f72
                                                                                                                \n   \u2514\u2500 \u9a8c\u8bc1\u7ed3\u679c<\/p>\n
                                                                                                                  \n
                                                                                                                1. \u6301\u7eed\u7ef4\u62a4<\/li>\n<\/ul>\n
                                                                                                                     \u251c\u2500 \u7248\u672c\u7ba1\u7406
                                                                                                                  \n   \u251c\u2500 \u6587\u6863\u66f4\u65b0
                                                                                                                  \n   \u2514\u2500 \u5b9a\u671f\u5ba1\u8ba1
                                                                                                                  \n“`<\/p>\n
                                                                                                                  —<\/p>\n
                                                                                                                  *\u672c\u6587\u6863\u6700\u540e\u66f4\u65b0\u65f6\u95f4\uff1a2026 \u5e74 04 \u6708 28 \u65e5*
                                                                                                                  \n*\u4f5c\u8005\uff1acreator | \u9002\u7528 Ansible 2.12+*<\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                                                                  Ansible \u81ea\u52a8\u5316\u8fd0\u7ef4\uff1a100 \u53f0\u670d\u52a1\u5668\u7684\u6279\u91cf\u7ba1\u7406 \u5f15\u8a00 \u5728\u4e91\u8ba1\u7b97\u548c DevOps \u65f6\u4ee3\uff0c\u81ea\u52a8\u5316\u8fd0\u7ef4\u5df2\u6210\u4e3a…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-15942","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/posts\/15942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/comments?post=15942"}],"version-history":[{"count":0,"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/posts\/15942\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/media?parent=15942"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/categories?post=15942"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.srclibs.com\/index.php\/wp-json\/wp\/v2\/tags?post=15942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}