$ ansible-config init --disabled > ~/.ansible.cfg

$ export ANSIBLE_HOST_KEY_CHECKING=False

[defaults]
interpreter_python = auto
#interpreter_python = /usr/bin/python3
host_key_checking=False
#inventory=~/.ansible/hosts
private_key_file=/path/to/file.pem
remote_user = root
sudo_user=root

node1.ansible.com                 
node2.ansible.com 
    192.168.1.1

[webserver]                            
192.168.10.1
192.168.10.2                

[dbserver]    
192.168.20.1
192.168.20.2

# 连续IP
[test1]
name1 ansible_ssh_host=192.168.1.[20:50] ansible_ssh_user="root" ansible_ssh_pass="1234" ansible_ssh_port=22 ansible_ssh_private_key_file=~/.ssh/id_rsa


# 带参数
[test1]
name1 ansible_ssh_host=192.168.1.[20:50]
[test1:vars]
ansible_ssh_user=root
ansible_ssh_pass="1234"
testvar="test"

ansible_ssh_host     #用于指定被管理的主机的真实IP
ansible_ssh_port     #用于指定连接到被管理主机的ssh端口号，默认是22
ansible_ssh_user     #ssh连接时默认使用的用户名
ansible_ssh_pass     #ssh连接时的密码
ansible_sudo_pass     #使用sudo连接用户时的密码
ansible_sudo_exec     #如果sudo命令不在默认路径，需要指定sudo命令路径
ansible_ssh_private_key_file     #秘钥文件路径，秘钥文件如果不想使用ssh-agent管理时可以使用此选项
ansible_shell_type     #目标系统的shell的类型，默认sh
ansible_connection     #SSH 连接的类型： local , ssh , paramiko，在 ansible 1.2 之前默认是 paramiko ，后来智能选择，优先使用基于 ControlPersist 的 ssh （支持的前提）
ansible_python_interpreter     #用来指定python解释器的路径，默认为/usr/bin/python 同样可以指定ruby 、perl 的路径
ansible_*_interpreter     #其他解释器路径，用法与ansible_python_interpreter类似，这里"*"可以是ruby或才perl等

- hosts: rocky
  become: yes
  become_user: root
  roles:
    #- role: serialt.centos_init
    - role: repo
      vars:
        elrepo_install: False
    - role: serialt.os_init
      vars:
        login_info: "        Welcome to local OPS"
        fail2ban_ignore_ip: ""
        ssh_key_message: "t@local.com"
    - role: python  
    - role: serialt.docker
      vars:
        docker_insecure_registries: ["repo.local.com"]
    # - role: serialt.chrony
    #- role: serialt.kernel
   # - role: zabbix-server

# 本地执行
- name: check | 发布文件是否存在。
  shell: "ls {{ deploy_file }}"
  connection: local
  
# 判断
- name: Create software directory.
  file: 
    path: "{{ software_files_path }}"
    state: directory
  connection: local
  when: not go_file_result.stat.exists
  
# 串行执行
- hosts: server1
  become: yes
  gather_facts: yes
  serial: 1
  tasks:
    - YOUR TASKS HERE

- hosts: serialt
  become: yes
  become_user: root
  vars:
    go_version: "1.20.2"
  tasks:
    - name: check | 发布文件是否存在。
      shell: "ls {{ deploy_file }}"
      connection: local
        

ansible add-public-key -m authorized_key -a "user=root state=present key='{{ lookup('file', '/home/root/.ssh/id_rsa.pub') }}'"

- hosts: add-public-key
  gather_facts: false
  tasks:
  - name: Add local public key to remote hosts.
    authorized_key: 
      user: sugar
      key: "{{ lookup('file', '/Users/serialt/.ssh/id_rsa.pub') }}" 
      state: present

[add-public-key]
172.16.78.53 ansible_connection=ssh  ansible_ssh_user="sugar" ansible_ssh_pass="ubuntu"
; 172.25.70.2 ansible_connection=ssh  ansible_ssh_user="root" ansible_ssh_pass="redhat"
; 172.25.70.3 ansible_connection=ssh  ansible_ssh_user="sugar" ansible_ssh_pass="redhat"

[root@localhost test]# ansible k8s -m ping
192.168.122.100 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": false, 
    "ping": "pong"
}

# ping模块没有参数
[root@localhost test]# cat ping.yaml 
- hosts: k8s
  user: root
  gather_facts: false
  tasks:
    - name: test ping
      ping:

[root@localhost test]# ansible k8s -m  shell  -a " uptime"
192.168.122.100 | CHANGED | rc=0 >>
 11:11:05 up 25 days,  1:14,  2 users,  load average: 0.31, 0.44, 0.39

# 参数 
chdir=<Directory>

[root@localhost test]# cat shell.yaml 
- hosts: k8s
  user: root
  gather_facts: false
  tasks:
    - name: test shell
      shell: date && pwd
      args:
        chdir: /tmp/

    - name: Run expect to wait for a successful PXE boot via out-of-band CIMC
      shell: |
        set timeout 300
        spawn ssh admin@{{ cimc_host }}

        expect "password:"
        send "{{ cimc_password }}\n"

        expect "\n{{ cimc_name }}"
        send "connect host\n"

        expect "pxeboot.n12"
        send "\n"

        exit 0        
      args:
        executable: /usr/bin/expect
      delegate_to: localhost

[root@localhost test]# ansible k8s -m copy -a "src=/etc/hosts dest=/tmp/"
192.168.122.100 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    }, 
    "changed": true, 
    "checksum": "42d592f8ed1579880187c900197e1edd09688992", 
    "dest": "/tmp/hosts", 
    "gid": 0, 
    "group": "root", 
    "md5sum": "f4c82671111086eb6fa6d869e80e1128", 
    "mode": "0644", 
    "owner": "root", 
    "size": 803, 
    "src": "/root/.ansible/tmp/ansible-tmp-1608693775.8-22394-277593855767937/source", 
    "state": "file", 
    "uid": 0
}

[root@master ~]# ansible test -m fetch -a 'src=/etc/passwd dest=/tmp'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "checksum": "974b44c114ecbd71bdee11e09a9bc14c9b0395bd", 
    "dest": "/tmp/192.168.100.102/etc/passwd", 
    "md5sum": "01d72332a8d9737631212995fe1494f4", 
    "remote_checksum": "974b44c114ecbd71bdee11e09a9bc14c9b0395bd", 
    "remote_md5sum": null
}

[root@master ~]# ansible test -m cron -a 'minute=*/5 name=Ajob job="/usr/sbin/ntpdate 172.16.8.100 &> /dev/null" state=present'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "envs": [], 
    "jobs": [
        "Ajob"
    ]
}

[root@master ~]# ansible test -m shell -a 'crontab -l'
192.168.100.102 | SUCCESS | rc=0 >>
#Ansible: Ajob
*/5 * * * * /usr/sbin/ntpdate 172.16.8.100 &> /dev/null

[root@master ~]# ansible test -m cron -a 'minute=*/5 name=Ajob job="/usr/sbin/ntpdate 172.16.8.100 &> /dev/null" state=absent'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "envs": [], 
    "jobs": []
}

创建软链接的用法：
	src=  path=  state=link
修改文件属性的用法：
	path=  owner=  mode=  group=
创建目录的用法：
	path=  state=directory
删除文件：
	path= state=absent

[root@ansible etc]# ansible testsrv -m file -a "path=/tmp/1.txt mode=600 owner=root group=nobody"

[root@ansible ~]# ansible testsrv -m file -a "path=/tmp/bb mode=777 recurse=yes"

[root@master ~]# ansible test -m file -a 'src=/etc/passwd path=/tmp/passwd.link state=link'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "dest": "/tmp/passwd.link", 
    "gid": 0, 
    "group": "root", 
    "mode": "0777", 
    "owner": "root", 
    "size": 11, 
    "src": "/etc/passwd", 
    "state": "link", 
    "uid": 0
}

[root@master ~]# ansible test -m file -a 'path=/tmp/cc.txt state=absent'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "path": "/tmp/cc.txt", 
    "state": "absent"
}

[root@master ~]# ansible test -m file -a 'path=/tmp/bb.txt mode=700 owner=root group=nobody'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "gid": 99, 
    "group": "nobody", 
    "mode": "0700", 
    "owner": "root", 
    "path": "/tmp/bb.txt", 
    "size": 14, 
    "state": "file", 
    "uid": 0
}
[root@master ~]# ansible test -m shell -a 'ls -l /tmp/bb.txt'
192.168.100.102 | SUCCESS | rc=0 >>
-rwx------ 1 root nobody 14 Dec  2  2016 /tmp/bb.txt

[root@master ~]# ansible test -m file -a 'path=/tmp/bj state=directory'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "gid": 0, 
    "group": "root", 
    "mode": "0755", 
    "owner": "root", 
    "path": "/tmp/bj", 
    "size": 4096, 
    "state": "directory", 
    "uid": 0
}

[root@master ~]# ansible test -m file -a 'path=/tmp/bj state=absent'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "path": "/tmp/bj", 
    "state": "absent"
}
[root@master ~]# ansible test -m shell -a 'ls -l /tmp'
192.168.100.102 | SUCCESS | rc=0 >>
total 16
-rw-r--r-- 1 root   root      0 Dec  2  2016 aa.txt
drwx------ 2 root   root   4096 Dec  2 13:41 ansible_twMJYb
-rwx------ 1 root   nobody   14 Dec  2  2016 bb.txt
-rw-r--r-- 1 root   root    158 Dec  2  2016 hosts
-rw------- 1 nobody nobody  947 Dec  2  2016 passwd
lrwxrwxrwx 1 root   root     11 Dec  2 13:35 passwd.link -> /etc/passwd
-rw------- 1 root   root      0 Dec  2 00:58 yum.log

[root@master ~]# ansible test -m shell -a 'hostname'
192.168.100.102 | SUCCESS | rc=0 >>
node1.ansible.com

[root@master ~]# ansible test -m hostname -a 'name=node2.ansible.com'
192.168.100.102 | SUCCESS => {
    "ansible_facts": {
        "ansible_domain": "ansible.com", 
        "ansible_fqdn": "node2.ansible.com", 
        "ansible_hostname": "node2", 
        "ansible_nodename": "node2.ansible.com"
    }, 
    "changed": true, 
    "name": "node2.ansible.com"
}

# 卸载软件包:
[root@master ~]# ansible test -m yum -a 'name=httpd state=absent'
[root@master ~]# ansible test -m shell -a 'rpm -q httpd'


# 安装软件包:
[root@master ~]# ansible test -m yum -a 'name=httpd state=present'

[root@ansible ~]# ansible 192.168.122.102 -m yum -a "name=ftp state=present disablerepo=zabbix"

[root@ansible_server ~]# ansible test_server -m yum -a "name=zabbix-agent state=present enablerepo=zabbix3.2 disablerepo=zabbix"


# 更新软件
[root@ansible_server ~]# ansible test_server -m yum -a "name=zabbix-agent state=latest"

- hosts: all
  tasks:
  - name: yum
    yum:
      name: "{{ item }}"
      state: present
    with_items:
    - git
    - httpd
    - mysql

[root@ansible-manager ~]# ansible ansible-demo3 -m yum_repository -a 'name=aliEpel description="alibaba EPEL" baseurl=https://mirrors.aliyun.com/epel/$releasever\Server/$basearch/'
ansible-demo3 | SUCCESS => {
    "changed": true, 
    "repo": "aliEpel", 
    "state": "present"
}

[root@localhost test]# cat yum_repo.yaml 
- hosts: 127.0.0.1
  user: root
  gather_facts: false
  tasks:
    - name: config postgresql with tsinghua
      yum_repository:
        file: postgresql-10
        name: postgresql
        description: postgresql-10 tsinghua
        baseurl: https://mirrors.tuna.tsinghua.edu.cn/postgresql/repos/yum/10/redhat/rhel-7-x86_64/
        enabled: yes
        gpgcheck: no

[root@localhost yum.repos.d]# cat postgresql-10.repo 
[postgresql]
baseurl = https://mirrors.tuna.tsinghua.edu.cn/postgresql/repos/yum/10/redhat/rhel-7-x86_64/
enabled = 1
gpgcheck = 0
name = postgresql-10 tsinghua

[root@master ~]# ansible test -m service -a 'name=nginx state=started'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "name": "nginx", 
    "state": "started"
}
[root@master ~]# ansible test -m shell -a 'service nginx status'
192.168.100.102 | SUCCESS | rc=0 >>
nginx (pid  4054) is running...

[root@master ~]# 


[root@master ~]# ansible test -m service -a 'name=nginx state=stopped'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "name": "nginx", 
    "state": "stopped"
}
[root@master ~]# ansible test -m shell -a 'service nginx status'
192.168.100.102 | FAILED | rc=3 >>
nginx is stopped


[root@master ~]# ansible test -m service -a 'name=nginx state=started enabled=yes runlevel=2345'
192.168.100.102 | SUCCESS => {
    "changed": true, 
    "enabled": true, 
    "name": "nginx", 
    "state": "started"
}
[root@master ~]# ansible test -m shell -a 'chkconfig --list nginx'
192.168.100.102 | SUCCESS | rc=0 >>
nginx          	0:off	1:off	2:on	3:on	4:on	5:on	6:off

[root@localhost test]# cat daemon_reload.yaml 
- hosts: 127.0.0.1
  user: root
  gather_facts: false
  tasks:
    - name: daemon reload
      systemd:
        daemon_reload: yes

[root@localhost test]# cat nginx.yaml 
- hosts: 127.0.0.1
  user: root
  gather_facts: false
  tasks:
    - name: daemon reload
      systemd:
        name: nginx
        enabled: yes
        state: restarted

EXAMPLES:

# Manage the state of program to be in 'started' state.
- supervisorctl:
    name: my_app
    state: started

# Manage the state of program group to be in 'started' state.
- supervisorctl:
    name: 'my_apps:'
    state: started

# Restart my_app, reading supervisorctl configuration from a specified file.
- supervisorctl:
    name: my_app
    state: restarted
    config: /var/opt/my_project/supervisord.conf

# Restart my_app, connecting to supervisord with credentials and server URL.
- supervisorctl:
    name: my_app
    state: restarted
    username: test
    password: testpass
    server_url: http://localhost:9001

# Send a signal to my_app via supervisorctl
- supervisorctl:
    name: my_app
    state: signalled
    signal: USR1

EXAMPLES:

- name: Compress directory /path/to/foo/ into /path/to/foo.tgz
  archive:
    path: /path/to/foo
    dest: /path/to/foo.tgz

- name: Compress regular file /path/to/foo into /path/to/foo.gz and remove it
  archive:
    path: /path/to/foo
    remove: yes

- name: Create a zip archive of /path/to/foo
  archive:
    path: /path/to/foo
    format: zip

- name: Create a bz2 archive of multiple files, rooted at /path
  archive:
    path:
    - /path/to/foo
    - /path/wong/foo
    dest: /path/file.tar.bz2
    format: bz2

- name: Create a bz2 archive of a globbed path, while excluding specific dirnames
  archive:
    path:
    - /path/to/foo/*
    dest: /path/file.tar.bz2
    exclude_path:
    - /path/to/foo/bar
    - /path/to/foo/baz
    format: bz2

- name: Create a bz2 archive of a globbed path, while excluding a glob of dirnames
  archive:
    path:
    - /path/to/foo/*
    dest: /path/file.tar.bz2
    exclude_path:
    - /path/to/foo/ba*
    format: bz2

- name: Use gzip to compress a single archive (i.e don't archive it first with tar)
  archive:
    path: /path/to/foo/single.file
    dest: /path/file.gz
    format: gz

- name: Create a tar.gz archive of a single file.
  archive:
    path: /path/to/foo/single.file
    dest: /path/file.tar.gz
    format: gz
    force_archive: true


RETURN VALUES:

- name: Create a zip archive of /path/to/foo
  archive:
    path: /path/to/foo
    format: zip

- name: Create a bz2 archive of multiple files, rooted at /path
  archive:
    path:
    - /path/to/foo
    - /path/wong/foo
    dest: /path/file.tar.bz2
    format: bz2

- name: Create a bz2 archive of a globbed path, while excluding specific dirnames
  archive:
    path:
    - /path/to/foo/*
    dest: /path/file.tar.bz2
    exclude_path:
    - /path/to/foo/bar
    - /path/to/foo/baz
    format: bz2

- name: Create a bz2 archive of a globbed path, while excluding a glob of dirnames
  archive:
    path:
    - /path/to/foo/*
    dest: /path/file.tar.bz2
    exclude_path:
    - /path/to/foo/ba*
    format: bz2

- name: Use gzip to compress a single archive (i.e don't archive it first with tar)
  archive:
    path: /path/to/foo/single.file
    dest: /path/file.gz
    format: gz

- name: Create a tar.gz archive of a single file.
  archive:
    path: /path/to/foo/single.file
    dest: /path/file.tar.gz
    format: gz
    force_archive: true

EXAMPLES:

- name: Extract foo.tgz into /var/lib/foo
  unarchive:
    src: foo.tgz
    dest: /var/lib/foo

- name: Unarchive a file that is already on the remote machine
  unarchive:
    src: /tmp/foo.zip
    dest: /usr/local/bin
    remote_src: yes

- name: Unarchive a file that needs to be downloaded (added in 2.0)
  unarchive:
    src: https://example.com/example.zip
    dest: /usr/local/bin
    remote_src: yes

- name: Unarchive a file with extra options
  unarchive:
    src: /tmp/foo.zip
    dest: /usr/local/bin
    extra_opts:
    - --transform
    - s/^xxx/yyy/

EXAMPLES:

- name: Check that you can connect (GET) to a page and it returns a status 200
  uri:
    url: http://www.example.com

- name: Check that a page returns a status 200 and fail if the word AWESOME is not in the page contents
  uri:
    url: http://www.example.com
    return_content: yes
  register: this
  failed_when: "'AWESOME' not in this.content"

- name: Create a JIRA issue
  uri:
    url: https://your.jira.example.com/rest/api/2/issue/
    user: your_username
    password: your_pass
    method: POST
    body: "{{ lookup('file','issue.json') }}"
    force_basic_auth: yes
    status_code: 201
    body_format: json

- name: Login to a form based webpage, then use the returned cookie to access the app in later tasks
  uri:
    url: https://your.form.based.auth.example.com/index.php
    method: POST
    body_format: form-urlencoded
    body:
      name: your_username
      password: your_password
      enter: Sign in
    status_code: 302
  register: login

- name: Login to a form based webpage using a list of tuples
  uri:
    url: https://your.form.based.auth.example.com/index.php
    method: POST
    body_format: form-urlencoded
    body:
    - [ name, your_username ]
    - [ password, your_password ]
    - [ enter, Sign in ]
    status_code: 302
  register: login

- name: Connect to website using a previously stored cookie
  uri:
    url: https://your.form.based.auth.example.com/dashboard.php
    method: GET
    return_content: yes
    headers:
      Cookie: "{{ login.set_cookie }}"

- name: Queue build of a project in Jenkins
  uri:
    url: http://{{ jenkins.host }}/job/{{ jenkins.job }}/build?token={{ jenkins.token }}
    user: "{{ jenkins.user }}"
    password: "{{ jenkins.password }}"
    method: GET
    force_basic_auth: yes
    status_code: 201

- name: POST from contents of local file
  uri:
    url: https://httpbin.org/post
    method: POST
    src: file.json

- name: POST from contents of remote file
  uri:
    url: https://httpbin.org/post
    method: POST
    src: /path/to/my/file.json
    remote_src: yes

- name: Pause play until a URL is reachable from this host
  uri:
    url: "http://192.0.2.1/some/test"
    follow_redirects: none
    method: GET
  register: _result
  until: _result.status == 200
  retries: 720 # 720 * 5 seconds = 1hour (60*60/5)
  delay: 5 # Every 5 seconds

# There are issues in a supporting Python library that is discussed in
# https://github.com/ansible/ansible/issues/52705 where a proxy is defined
# but you want to bypass proxy use on CIDR masks by using no_proxy
- name: Work around a python issue that doesn't support no_proxy envvar
  uri:
    follow_redirects: none
    validate_certs: false
    timeout: 5
    url: "http://{{ ip_address }}:{{ port | default(80) }}"
  register: uri_data
  failed_when: false
  changed_when: false
  vars:
    ip_address: 192.0.2.1
  environment: |
      {
        {% for no_proxy in (lookup('env', 'no_proxy') | regex_replace('\s*,\s*', ' ') ).split() %}
          {% if no_proxy | regex_search('\/') and
                no_proxy | ipaddr('net') != '' and
                no_proxy | ipaddr('net') != false and
                ip_address | ipaddr(no_proxy) is not none and
                ip_address | ipaddr(no_proxy) != false %}
            'no_proxy': '{{ ip_address }}'
          {% elif no_proxy | regex_search(':') != '' and
                  no_proxy | regex_search(':') != false and
                  no_proxy == ip_address + ':' + (port | default(80)) %}
            'no_proxy': '{{ ip_address }}:{{ port | default(80) }}'
          {% elif no_proxy | ipaddr('host') != '' and
                  no_proxy | ipaddr('host') != false and
                  no_proxy == ip_address %}
            'no_proxy': '{{ ip_address }}'
          {% elif no_proxy | regex_search('^(\*|)\.') != '' and
                  no_proxy | regex_search('^(\*|)\.') != false and
                  no_proxy | regex_replace('\*', '') in ip_address %}
            'no_proxy': '{{ ip_address }}'
          {% endif %}
        {% endfor %}
      }      

- stat:
    path: /etc/foo.conf
  register: st
- fail:
    msg: "Whoops! file ownership has changed"
  when: st.stat.pw_name != 'root'

- stat:
    path: /path/to/something
  register: sym

- debug:
    msg: "islnk isn't defined (path doesn't exist)"
  when: sym.stat.islnk is not defined

- debug:
    msg: "islnk is defined (path must exist)"
  when: sym.stat.islnk is defined

- debug:
    msg: "Path exists and is a symlink"
  when: sym.stat.islnk is defined and sym.stat.islnk

- debug:
    msg: "Path exists and isn't a symlink"
  when: sym.stat.islnk is defined and sym.stat.islnk == False

- stat:
    path: /path/to/something
  register: p
- debug:
    msg: "Path exists and is a directory"
  when: p.stat.isdir is defined and p.stat.isdir

# Don't do checksum
- stat:
    path: /path/to/myhugefile
    get_checksum: no

# Use sha256 to calculate checksum
- stat:
    path: /path/to/something
    checksum_algorithm: sha256

- name: Pause for 5 minutes to build app cache
  pause:
    minutes: 5

- name: Pause until you can verify updates to an application were successful
  pause:

- name: A helpful reminder of what to look out for post-update
  pause:
    prompt: "Make sure org.foo.FooOverload exception is not present"

- name: Did you Backup DB
  pause: prompt="Did you commit it? Enter to continue or CTRL-C to quit."

- name: Pause to get some sensitive input
  pause:
    prompt: "Enter a secret"
    echo: no