【自动化运维神器Ansible】Ansible常用模块之Copy模块详解

• 源文件检查：Ansible首先检查控制节点上的源文件是否存在
• 校验和计算：计算源文件的校验和用于后续比较
• 目标文件检查：检查远程主机上目标文件的状态（存在与否、校验和）
• 文件传输决策：比较源文件和目标文件的校验和，决定是否需要传输
• 文件传输：如需更新，则传输文件内容
• 属性设置：设置远程文件的权限、所有者和所属组
• 结果返回：返回操作执行结果

- name: Copy single file
  ansible.builtin.copy:
    src: /path/local/file.conf
    dest: /etc/app/file.conf
    owner: root
    group: root
    mode: '0644'

- name: Copy using inline content
  copy:
    content: |
      This is the file content
      Line 2
      Line 3
    dest: /tmp/inline_file.txt

- name: Copy directory recursively
  copy:
    src: /path/local/dir/
    dest: /remote/dir/

• 注意：src路径结尾的"/"表示复制目录内容而非目录本身

• 当设置backup: yes时，Copy模块会在覆盖现有文件前创建备份：

• 备份文件名格式：原文件名.时间戳.备份
• 示例：

- name: Copy with backup
  copy:
    src: /tmp/app.conf
    dest: /etc/app.conf
    backup: yes

• validate参数允许在文件实际部署前执行验证命令：

- name: Copy and validate config
  copy:
    src: /tmp/nginx.conf
    dest: /etc/nginx/nginx.conf
    validate: '/usr/sbin/nginx -t -c %s'

• 虽然Template模块专门用于模板渲染，但Copy模块也可通过content参数实现简单模板功能：

- name: Copy with simple templating
  copy:
    content: |
      ServerName {{ ansible_hostname }}
      Listen {{ http_port }}
    dest: /etc/httpd/conf.d/custom.conf

• 权限最小化：为目标文件设置最小必要权限

mode: '0600'  # 仅所有者可读写

• 敏感文件处理：避免在版本控制中存储含敏感信息的文件

- name: Copy secret file from vault
  copy:
    src: "{{ lookup('file', '/secure/passwords.txt') }}"
    dest: /etc/secret.txt
    no_log: true  # 隐藏任务输出

• 输入验证：对动态生成的内容进行验证

validate: '/usr/bin/check_config --file %s'

• 批量文件处理：使用循环复制多个文件

- name: Copy multiple files
  copy:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
  loop:
    - { src: 'file1', dest: '/path/file1' }
    - { src: 'file2', dest: '/path/file2' }

• 减少不必要传输：依赖Ansible内置的校验和检查机制

force: no # 仅在文件不同时传输

• 大文件处理：对于大文件考虑使用synchronize模块

- name: Sync large files
  synchronize:
    src: /large/files/
    dest: /remote/path/

• 错误捕获与处理：

- name: Copy with error handling
  block:
    - name: Copy important file
      copy:
        src: /critical/config
        dest: /etc/config
  rescue:
    - name: Handle copy failure
      debug:
        msg: "Failed to copy config file!"

• 状态检查：

- name: Check file existence
  stat:
    path: /etc/config
  register: file_stat
  
- name: Copy if missing
  copy:
    src: /backup/config
    dest: /etc/config
  when: not file_stat.stat.exists

- name: Distribute application config
  hosts: app_servers
  tasks:
    - name: Ensure config directory exists
      file:
        path: /etc/myapp
        state: directory
        mode: '0755'
        
    - name: Deploy main config
      copy:
        src: "files/{{ ansible_os_family }}/myapp.conf"
        dest: /etc/myapp/myapp.conf
        mode: '0644'
        backup: yes

- name: Deploy SSH keys
  hosts: database_servers
  vars:
    admin_key: "{{ lookup('file', '/secure/keys/admin_rsa.pub') }}"
  tasks:
    - name: Install admin key
      copy:
        content: "{{ admin_key }}"
        dest: /root/.ssh/authorized_keys
        owner: root
        group: root
        mode: '0600'

- name: Deploy environment-specific files
  hosts: all
  tasks:
    - name: Copy environment config
      copy:
        src: "configs/{{ env }}/settings.ini"
        dest: /opt/app/settings.ini
      when: env is defined

• 增加超时设置

- name: Copy large file with timeout
  copy:
    src: /big/file.iso
    dest: /mnt/file.iso
  async: 600
  poll: 15

• 考虑使用分块传输或rsync