5 个 Ansible 运维任务
DevOps Ansible

> 
> 让 DevOps 少一点，OpsDev 多一点。
> 
> 
> 


![](/data/attachment/album/201909/06/134240khkca18pkqkjkhsk.jpg)


在这个 DevOps 世界中，看起来开发（Dev）这一半成为了关注的焦点，而运维（Ops）则是这个关系中被遗忘的另一半。这几乎就好像是领头的开发告诉尾随的运维做什么，几乎所有的“运维”都是开发说要做的。因此，运维被抛到后面，降级到了替补席上。


我想看到更多的 OpsDev。因此，让我们来看看 Ansible 在日常的运维中可以帮助你什么。


![Job templates](/data/attachment/album/201909/06/134315p4j9rj85j2ricztj.png "Job templates")


我选择在 [Ansible Tower](https://www.ansible.com/products/tower) 中展示这些方案，因为我认为用户界面 （UI） 可以增色大多数的任务。如果你想模拟测试，你可以在 Tower 的上游开源版本 [AWX](https://github.com/ansible/awx) 中测试它。


### 管理用户


在大规模环境中，你的用户将集中在活动目录或 LDAP 等系统中。但我敢打赌，仍然存在许多包含大量的静态用户的全负荷环境。Ansible 可以帮助你将这些分散的环境集中到一起。*社区*已为我们解决了这个问题。看看 [Ansible Galaxy](https://galaxy.ansible.com) 中的 [users](https://galaxy.ansible.com/singleplatform-eng/users) 角色。


这个角色的聪明之处在于它允许我们通过*数据*管理用户，而无需更改运行逻辑。


![User data](/data/attachment/album/201909/06/134319qgx28xmh42kkxd4m.png "User data")


通过简单的数据结构，我们可以在系统上添加、删除和修改静态用户。这很有用。


### 管理 sudo


提权有[多种形式](https://docs.ansible.com/ansible/latest/plugins/become.html)，但最流行的是 [sudo](https://www.sudo.ws/intro.html)。通过每个 `user`、`group` 等离散文件来管理 sudo 相对容易。但一些人对给予特权感到紧张，并倾向于有时限地给予提权。因此[下面是一种方案](https://github.com/phips/ansible-demos/tree/master/roles/sudo)，它使用简单的 `at` 命令对授权访问设置时间限制。


![Managing sudo](/data/attachment/album/201909/06/134321mazkpfkpyk8kvhta.png "Managing sudo")


### 管理服务


给入门级运维团队提供[菜单](https://docs.ansible.com/ansible-tower/latest/html/userguide/job_templates.html#surveys)以便他们可以重启某些服务不是很好吗？看下面！


![Managing services](/data/attachment/album/201909/06/134323pz2hh6vhugia6v63.png "Managing services")


### 管理磁盘空间


这有[一个简单的角色](https://github.com/phips/ansible-demos/tree/master/roles/disk)，可在特定目录中查找字节大于某个大小的文件。在 Tower 中这么做时，启用[回调](https://docs.ansible.com/ansible-tower/latest/html/userguide/job_templates.html#provisioning-callbacks)有额外的好处。想象一下，你的监控方案发现文件系统已超过 X％ 并触发 Tower 中的任务以找出是什么文件导致的。


![Managing disk space](/data/attachment/album/201909/06/134325ss6usssysszws6uy.png "Managing disk space")


### 调试系统性能问题


[这个角色](https://github.com/phips/ansible-demos/tree/master/roles/gather_debug)相当简单：它运行一些命令并打印输出。细节在最后输出，让你 —— 系统管理员快速浏览一眼。另外可以使用 [正则表达式](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#regular-expression-filters) 在输出中找到某些条件（比如说 CPU 占用率超过 80％）。


![Debugging system performance](/data/attachment/album/201909/06/134332pxb8i0jm0hvjibcb.png "Debugging system performance")


### 总结


我已经录制了这五个任务的简短视频。你也可以在 Github 上找到[所有代码](https://github.com/phips/ansible-demos)！




---


via: <https://opensource.com/article/19/8/ops-tasks-ansible>


作者：[Mark Phillips](https://opensource.com/users/markphttps://opensource.com/users/adminhttps://opensource.com/users/alsweigarthttps://opensource.com/users/belljennifer43) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
In this DevOps world, it sometimes appears the Dev half gets all the limelight, with Ops the forgotten half in the relationship. It's almost as if the leading Dev tells the trailing Ops what to do, with almost everything "Ops" being whatever Dev says it should be. Ops, therefore, gets left behind, punted to the back, relegated to the bench.

I'd like to see more OpsDev happening. So let's look at a handful of things Ansible can help you do with your day-to-day Ops life.

![Job templates Job templates](https://opensource.com/sites/default/files/uploads/00_templates.png)

I've chosen to present these solutions within [Ansible Tower](https://www.ansible.com/products/tower) because I think a user interface (UI) adds value to most of these tasks. If you want to emulate this, you can test it out in [AWX](https://github.com/ansible/awx), the upstream open source version of Tower.

## Manage users

In a large-scale environment, your users would be centralised in a system like Active Directory or LDAP. But I bet there are still a whole load of environments with lots of static users in them, too. Ansible can help you centralise that decentralised problem. And *the community* has already solved it for us. Meet the [Ansible Galaxy](https://galaxy.ansible.com) role ** users**.

What's clever about this role is it allows us to manage users via *data—*no changes to play logic required.

![User data User data](https://opensource.com/sites/default/files/uploads/01_users_data.png)

With simple data structures, we can add, remove and modify static users on a system. Very useful.

## Manage sudo

Privilege escalation comes [in many forms](https://docs.ansible.com/ansible/latest/plugins/become.html), but one of the most popular is [sudo](https://www.sudo.ws/intro.html). It's relatively easy to manage sudo through discrete files per user, group, etc. But some folk get nervous about giving privilege escalation willy-nilly and prefer it to be time-bound. So [here's a take on that](https://github.com/phips/ansible-demos/tree/master/roles/sudo), using the simple **at** command to put a time limit on the granted access.

![Managing sudo Managing sudo](https://opensource.com/sites/default/files/uploads/02_sudo.png)

## Manage services

Wouldn't it be great to give a [menu](https://docs.ansible.com/ansible-tower/latest/html/userguide/job_templates.html#surveys) to an entry-level ops team so they could just restart certain services? Voila!

![Managing services Managing services](https://opensource.com/sites/default/files/uploads/03_services.png)

## Manage disk space

Here's [a simple role](https://github.com/phips/ansible-demos/tree/master/roles/disk) that can be used to look for files larger than size *N* in a particular directory. Doing this in Tower, we have the bonus of enabling [callbacks](https://docs.ansible.com/ansible-tower/latest/html/userguide/job_templates.html#provisioning-callbacks). Imagine your monitoring solution spotting a filesystem going over X% full and triggering a job in Tower to go find out what files are the cause.

![Managing disk space Managing disk space](https://opensource.com/sites/default/files/uploads/04_diskspace.png)

## Debug a system performance problem

[This role](https://github.com/phips/ansible-demos/tree/master/roles/gather_debug) is fairly simple: it runs some commands and prints the output. The details are printed at the end of the run for you, sysadmin, to cast your skilled eyes over. Bonus homework: use [regexs](https://docs.ansible.com/ansible/latest/user_guide/playbooks_filters.html#regular-expression-filters) to find certain conditions in the output (CPU hog over 80%, say).

![Debugging system performance Debugging system performance](https://opensource.com/sites/default/files/uploads/05_debug.png)

## Summary

I've recorded a short video of these five tasks in action. You can find all [the code on GitHub](https://github.com/phips/ansible-demos) too!

## 2 Comments