[DevOps] Ansible 설치부터 사용까지

Intro

• Ansible설치부터 간단한 데모를 통해 어떻게 사용하는지 까지 진행해보도록 하겠습니다.
• 앤서블(Ansible)이 무엇인지는 아래 경로를 참고 바랍니다
• [https://kim-dragon.tistory.com/13?category=839107\]

사전 준비

• Ansible설치, 1대의 Ansible 실행서버, 3대의 대상서버

작업리스트

• Ansible설치
• Anslibe inventory 설정
• Ansible palybook 작성
• Ansible palybook 실행

Ansible 설치

sudo yum install ansible -y 

Ansible inventory 설정

## ansible hosts 파일 설정
vi /etc/ansible/hosts

# 대상서버에 사용할 ssh key와 user 설정
[dev:vars]
ansible_ssh_private_key_file=/etc/ansible/DEV.pem
ansible_user=ec2-user

[prod:vars]
ansible_ssh_private_key_file=/etc/ansible/PROD.pem
ansible_user=ec2-user

[stg:vars]
ansible_ssh_private_key_file=/etc/ansible/STG.pem
ansible_user=ec2-user

# 대상서버 IP
[dev]
10.144.0.1

[prod]
10.144.0.2

[stg]
10.144.0.3

## key checking false 설정 
vi /etc/ansible/ansible.cfg

[defaults]
host_key_checking = False

여기서 key checking 을 false로 설정해야 인증 확인을 물어보지 않습니다.

playbook.yaml 작성

vi playbook.yaml

- name: set up
  hosts: prod
  become_user: root
  become: yes
  tasks:

   - name: add user
     user:
      name: security_temp
      password: $6$keA0jbN9oNtWT0UE$neES8QAPl2X64ZIEt6VHBxvCxsOuUXL/PXhCV1bTTGkdCED6NZO6A4mx6xAcAnYPI1ESn4yi9PSIjB25XvU.O.
   - name: modify visudo
     lineinfile:
      path: /etc/sudoers
      insertafter: '^root*'
      state: present
      line: "security_temp\tALL=(ALL)\tALL"
      validate: 'visudo -cf %s'
   - name: modify sshd_config
     replace:
      path: /etc/ssh/sshd_config
      regexp: 'PasswordAuthentication no'
      replace: 'PasswordAuthentication yes'
   - name: restart sshd
     service:
      name: sshd
      state: restarted

- name: set up
  hosts: dev
  become_user: root
  become: yes
  tasks:

   - name: add user
     user:
      name: security_temp
      password: $6$keA0jbN9oNtWT0UE$neES8QAPl2X64ZIEt6VHBxvCxsOuUXL/PXhCV1bTTGkdCED6NZO6A4mx6xAcAnYPI1ESn4yi9PSIjB25XvU.O.
   - name: modify visudo
     lineinfile:
      path: /etc/sudoers
      insertafter: '^root*'
      state: present
      line: "security_temp\tALL=(ALL)\tALL"
      validate: 'visudo -cf %s'
   - name: modify sshd_config
     replace:
      path: /etc/ssh/sshd_config
      regexp: 'PasswordAuthentication no'
      replace: 'PasswordAuthentication yes'
   - name: restart sshd
     service:
      name: sshd
      state: restarted

- name: set up
  hosts: stg
  become_user: root
  become: yes
  tasks:

   - name: add user
     user:
      name: security_temp
      password: $6$keA0jbN9oNtWT0UE$neES8QAPl2X64ZIEt6VHBxvCxsOuUXL/PXhCV1bTTGkdCED6NZO6A4mx6xAcAnYPI1ESn4yi9PSIjB25XvU.O.
   - name: modify visudo
     lineinfile:
      path: /etc/sudoers
      insertafter: '^root*'
      state: present
      line: "security_temp\tALL=(ALL)\tALL"
      validate: 'visudo -cf %s'
   - name: modify sshd_config
     replace:
      path: /etc/ssh/sshd_config
      regexp: 'PasswordAuthentication no'
      replace: 'PasswordAuthentication yes'
   - name: restart sshd
     service:
      name: sshd
      state: restarted

위에서 사용한 User의 Password는 아래와 같이 암호화를 해야합니다. (python3.6 version으로 암호화)

Password 암호화

## python 3.6
python3 -m pip install passlib

## 아래 암호화 함수 실행 하여 암호화할 값 입력하면됨
python3 -c "from passlib.hash import sha512_crypt; import getpass; print(sha512_crypt.using(rounds=5000).hash(getpass.getpass()))"

Playbook 실행

ansible-playbook playbook.yml

linux초기 설정 Playbook 예시

 tasks:
    # Asia 시간 세팅
    - name: Set OS Time
      timezone:
        name: Asia/Seoul

    # 시간 동기화
    - name: Sync OS Time
      shell: systemctl restart rsyslog
      shell: systemctl restart chronyd

    # Redhat 패키지 설치
    - name: Install epel
      shell: amazon-linux-extras install -y epel
      args:
        executable: /bin/bash  

    # Python3 설치
    - name: Install Python3
      yum:
        state: installed
        name: 
          - python3

    # awscli / boto3
    - name: Install Python lib
      pip:
        executable: pip3
        name:
          - awscli
          - boto3

    # 기타 패키지 설치
    - name: Install software requirements
      yum:
        state: installed
        name: 
          - telnet

여기까지 Ansible을 설치하고 playbook을 작성하여 실제로 실행까지 해보았습니다.
playbook을 커스터마이징하여 업무에 잘 활용하시기 바랍니다. 감사합니다.