Ansible架构与核心概念
Ansible是一款开源的IT自动化工具，采用无Agent架构，仅通过SSH连接目标主机即可完成配置管理、应用部署和任务编排。与Puppet、Chef等需要安装Agent的工具相比，Ansible的部署成本极低，只需在控制节点安装Ansible，目标主机无需任何额外配置。
Ansible的核心组件包括：
- Inventory：主机清单，定义被管理主机的分组与连接信息
- Modules：功能模块，如yum、copy、service、file等，是实际执行操作的单元
- Playbook：YAML格式的任务编排文件，定义配置与部署流程
- Roles：可复用的任务组织结构，将变量、任务、模板等按标准目录组织
- Filters/Plugins：数据过滤器和插件，扩展Ansible的处理能力
Inventory主机清单配置
静态Inventory使用INI或YAML格式定义主机分组：
# inventory/production.ini
[webservers]
web[01:03].example.com ansible_user=deploy ansible_port=22
[dbservers]
db01.example.com ansible_user=dbadmin
db02.example.com ansible_user=dbadmin
[appservers:children]
webservers
dbservers
[all:vars]
ansible_python_interpreter=/usr/bin/python3
env=production动态Inventory适用于云环境，实时获取主机列表：
#!/usr/bin/env python3
import json, subprocess
def get_aws_instances():
result = subprocess.run(
["aws", "ec2", "describe-instances",
"--filters", "Name=tag:Env,Values=production",
"--query", "Reservations[].Instances[].{id:InstanceId,ip:PrivateIpAddress}"],
capture_output=True, text=True
)
return json.loads(result.stdout)
def main():
instances = get_aws_instances()
inventory = {
"_meta": {"hostvars": {}},
"aws_production": {
"hosts": [],
"vars": {"ansible_user": "ec2-user"}
}
}
for inst in instances:
inventory["aws_production"]["hosts"].append(inst["ip"])
print(json.dumps(inventory))
if __name__ == "__main__":
main()Playbook编写与最佳实践
Playbook是Ansible的核心，以下展示一个完整的Nginx部署Playbook：
---
- name: Deploy and configure Nginx
hosts: webservers
become: true
vars:
nginx_version: "1.24.0"
nginx_worker_processes: "auto"
nginx_max_connections: 2048
server_name: "{{ inventory_hostname }}"
upstream_servers:
- 127.0.0.1:8000
- 127.0.0.1:8001
pre_tasks:
- name: Validate Ansible version
assert:
that:
- ansible_version.full is version("2.14", ">=")
tasks:
- name: Install Nginx dependencies
package:
name: "{{ item }}"
state: present
loop:
- gcc
- make
- libssl-dev
tags: [dependencies]
- name: Create Nginx config from template
template:
src: templates/nginx.conf.j2
dest: /etc/nginx/nginx.conf
owner: root
group: root
mode: "0644"
validate: "nginx -t -c %s"
notify: Reload Nginx
tags: [config]
- name: Ensure Nginx is running
service:
name: nginx
state: started
enabled: true
tags: [service]
handlers:
- name: Reload Nginx
service:
name: nginx
state: reloadedJinja2模板与变量管理
Ansible使用Jinja2模板引擎生成配置文件。模板文件结合变量实现配置的参数化：
# templates/nginx.conf.j2
user {{ nginx_user | default("www-data") }};
worker_processes {{ nginx_worker_processes }};
worker_rlimit_nofile {{ nginx_max_connections | int * 2 }};
events {
worker_connections {{ nginx_max_connections }};
multi_accept on;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
tcp_nopush on;
{% if nginx_gzip | default(true) %}
gzip on;
gzip_min_length 1024;
gzip_types text/plain text/css application/json;
{% endif %}
upstream backend {
{% for server in upstream_servers %}
server {{ server }} max_fails=3 fail_timeout=30s;
{% endfor %}
}
server {
listen 80;
server_name {{ server_name }};
location / {
proxy_pass http://backend;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
}
}
}变量分层管理策略：
# group_vars/all.yml - 全局变量
app_name: myapp
deploy_user: deploy
# group_vars/webservers.yml - 组级变量
nginx_max_connections: 4096
enable_ssl: true
# host_vars/web01.example.com.yml - 主机级变量
nginx_worker_processes: 4
upstream_servers:
- 10.0.1.10:8000
- 10.0.1.11:8000Role角色开发与复用
Role是Ansible的可复用单元，按照标准目录结构组织：
roles/nginx/
├── defaults/
│ └── main.yml # 默认变量
├── vars/
│ └── main.yml # 角色内部变量
├── tasks/
│ ├── main.yml # 主任务入口
│ ├── install.yml # 安装子任务
│ └── configure.yml # 配置子任务
├── handlers/
│ └── main.yml # 处理器
├── templates/
│ ├── nginx.conf.j2
│ └── vhost.conf.j2
├── files/
│ └── nginx.repo
└── meta/
└── main.yml # 角色依赖声明Role的主任务文件组织：
# roles/nginx/tasks/main.yml
---
- name: Include OS-specific variables
include_vars: "{{ ansible_os_family }}.yml"
tags: [always]
- name: Install Nginx
include_tasks: install.yml
tags: [install]
- name: Configure Nginx
include_tasks: configure.yml
tags: [config]
- name: Manage Nginx service
include_tasks: service.yml
tags: [service]高级技巧与实战模式
滚动更新与分批执行：
- name: Rolling application update
hosts: webservers
serial: 1
tasks:
- name: Drain node from load balancer
command: /usr/local/bin/drain-node {{ inventory_hostname }}
delegate_to: lb01.example.com
- name: Deploy new version
shell: "/opt/app/bin/deploy {{ app_version }}"
- name: Run health check
uri:
url: "http://{{ inventory_hostname }}:8000/health"
status_code: 200
retries: 5
delay: 10
- name: Enable node in load balancer
command: /usr/local/bin/enable-node {{ inventory_hostname }}
delegate_to: lb01.example.com异步任务与并发控制：
- name: Parallel package installation
hosts: all
tasks:
- name: Install packages asynchronously
package:
name: "{{ item }}"
state: present
loop: "{{ large_package_list }}"
async: 300
poll: 0
register: install_results
- name: Wait for all installations
async_status:
jid: "{{ item.ansible_job_id }}"
loop: "{{ install_results.results }}"
register: job_results
until: job_results.finished
retries: 60
delay: 5Molecule自动化测试
Molecule是Ansible Role的测试框架，确保Playbook的可靠性与幂等性：
# molecule/default/molecule.yml
driver:
name: docker
platforms:
- name: ubuntu2204
image: geerlingguy/docker-ubuntu2204-ansible
privileged: true
- name: centos9
image: geerlingguy/docker-rockylinux9-ansible
privileged: true
provisioner:
name: ansible
playbooks:
converge: converge.yml
verifier:
name: ansible
# molecule/default/verify.yml
- name: Verify Nginx installation
hosts: all
tasks:
- name: Check Nginx is running
command: systemctl is-active nginx
changed_when: false
- name: Check config syntax
command: nginx -t
changed_when: false结语
Ansible以其无Agent架构、声明式配置和丰富的模块生态，成为基础设施自动化管理的首选工具。通过Inventory分层管理、Playbook任务编排、Role复用和Molecule测试，可以构建可靠、可维护、可扩展的自动化运维体系。在云原生时代，Ansible与Terraform互补——Terraform负责基础设施供给，Ansible负责配置管理与应用部署，两者结合形成完整的Infrastructure as Code解决方案。