Ansible 临时命令与常用模块实操指南

发布于:2025-09-02 ⋅ 阅读:(22) ⋅ 点赞:(0)

Ansible 临时命令与常用模块使用

Ansible 临时命令(Ad-hoc 模式)通过调用不同模块执行单条任务,适用于临时性操作。以下是模块查询方法、核心模块语法及实操案例,覆盖用户管理、文件操作、软件部署等常见场景。

在这里插入图片描述

一、模块查询基础

1. 查看系统已安装的所有模块

ansible-doc -l

2. 查看指定模块的帮助文档(以 ping 为例)

# 查看模块参数、用法及示例
[root@master ~]# ansible-doc ping
> ANSIBLE.BUILTIN.PING    (/usr/lib/python3.9/site-packages/ansible/modules/ping.p>

        A trivial test module, this module always returns `pong' on
        successful contact. It does not make sense in playbooks, but
        it is useful from `/usr/bin/ansible' to verify the ability to
        login and that a usable Python is configured. This is NOT ICMP
        ping, this is just a trivial test module that requires Python
        on the remote-node. For Windows targets, use the
        [ansible.windows.win_ping] module instead. For Network
        targets, use the [ansible.netcommon.net_ping] module instead.

ADDED IN: historical

OPTIONS (= is mandatory):

- data
        Data to return for the `ping' return value.
        If this parameter is set to `crash', the module will cause an

/EXA  #查看示例

EXAMPLES:
# Test we can logon to 'webservers' and execute python with json lib.
# ansible webservers -m ansible.builtin.ping

- name: Example from an Ansible Playbook
  ansible.builtin.ping:

- name: Induce an exception to see what happens
  ansible.builtin.ping:
    data: crash


RETURN VALUES:
- ping
        Value provided with the data parameter.

        returned: success


二、临时命令语法格式

ansible <主机/分组> -m <模块名> -a '<模块参数>'

# <主机/分组>:Inventory 中定义的主机名或分组名(如 node1、all)
# -m <模块名>:指定要调用的模块(如 user、copy)
# -a '<模块参数>':模块的具体配置(键值对格式,空格分隔)

执行结果状态说明

  • 绿色:执行成功,目标主机无变更;
  • 黄色:执行成功,目标主机产生变更(如新建用户、修改文件);
  • 红色:执行失败(如参数错误、权限不足)。

三、常用模块实操案例

(一)用户管理模块:user

用于添加、删除、修改用户账户及属性。

参数 功能说明
name 必选,指定用户名(如 name=newbie
uid 指定用户的 UID(如 uid=400),需确保唯一性
state 指定用户状态:present(创建 / 保留用户,默认)、absent(删除用户)
password 设置用户密码,需传入加密后的密码(如 openssl passwd -1 生成的密文)
update_password 密码更新策略:always(始终更新)、on_create(仅创建时设置,默认)
create_home 是否创建用户家目录:yes(默认)、no
shell 指定用户登录 Shell(如 shell=/bin/bash,默认随系统配置)
group 指定用户的主组(如 group=zhang3

node1 上创建用户 newbie,指定 UID=400:

[student@master ansible]$ ansible node1 -m user -a 'name=newbie uid=400 state=present'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "comment": "",
    "create_home": true,
    "group": 1001,
    "home": "/home/newbie",
    "name": "newbie",
    "shell": "/bin/bash",
    "state": "present",
    "stderr": "useradd warning: newbie's uid 400 outside of the UID_MIN 1000 and UID_MAX 60000 range.\n",
    "stderr_lines": [
        "useradd warning: newbie's uid 400 outside of the UID_MIN 1000 and UID_MAX 60000 range."
    ],
    "system": false,
    "uid": 400
}

创建用户 zhang3,指定密码(若用户存在则仅更改密码):

# 需要使用加密密码
[student@master ansible]$ openssl passwd -1 123
$1$NjRojGFn$y4oEdLR3M8PQvnPLqX2al1

[student@master ansible]$ ansible node1 -m user -a 'name=zhang3  state=present password="$1$NjRojGFn$y4oEdLR3M8PQvnPLqX2al1" update_password=always'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "comment": "",
    "create_home": true,
    "group": 1002,
    "home": "/home/zhang3",
    "name": "zhang3",
    "password": "NOT_LOGGING_PASSWORD",
    "shell": "/bin/bash",
    "state": "present",
    "system": false,
    "uid": 1001
}

创建用户 zhang3,指定密码(若用户存在不对密码做更改)

[student@master ansible]$ openssl passwd -1 555
$1$qfOdfqaN$.cPyVgM/72j/uDUCvAj270
[student@master ansible]$ ansible node1 -m user -a 'name=zhang3 password="$1$qfOdfqaN$.cPyVgM/72j/uDUCvAj270" update_password=on_create'
node1 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "append": false,
    "changed": false,
    "comment": "",
    "group": 1002,
    "home": "/home/zhang3",
    "move_home": false,
    "name": "zhang3",
    "password": "NOT_LOGGING_PASSWORD",
    "shell": "/bin/bash",
    "state": "present",
    "uid": 1001
}

(二)命令执行模块:shell

执行远程主机的 Shell 命令(支持管道、重定向等复杂语法)。

参数 功能说明
args/ 直接跟命令 必选,指定要执行的 Shell 命令(如 a='userdel -r newbie',删除用户及家目录)
chdir 执行命令前切换到指定目录(如 chdir=/tmp
creates 若指定文件存在,则不执行命令(避免重复操作,如 creates=/aaa/file1
removes 若指定文件不存在,则不执行命令(如 removes=/aaa/file1

node1 上删除用户 newbie(含家目录);

[student@master ansible]$ ansible node1 -m shell -a 'userdel -r newbie'
node1 | CHANGED | rc=0 >>

(三)文件复制模块:copy

将本地文件复制到远程主机,并可指定权限、所有者。

参数 功能说明
src 必选,本地文件路径(如 src=/etc/fstab
dest 必选,远程主机目标路径(如 dest=/var/tmp/fstab
owner 指定远程文件的所有者(如 owner=zhang3
group 指定远程文件的所属组(如 group=root
mode 指定远程文件的权限(如 mode=0644,八进制格式,需加前导 0)
backup 复制前是否备份远程已有文件:yes(备份为 dest.xxx~)、no(默认)
content 直接写入内容到远程文件(替代 src,如 content="hello" 生成含 hello 的文件)

将本地 /etc/fstab 复制到远程 用户node2的 /var/tmp/fstab:

[student@master ansible]$ ansible node2 -m copy -a 'src=/etc/fstab dest=/var/tmp/fstab'
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/var/tmp/fstab",
    "gid": 0,
    "group": "root",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "mode": "0644",
    "owner": "root",
    "secontext": "unconfined_u:object_r:user_home_t:s0",
    "size": 579,
    "src": "/home/student/.ansible/tmp/ansible-tmp-1756266300.572999-1419-214666091543219/source",
    "state": "file",
    "uid": 0
}

复制文件到node1并指定所有者为 zhang3、所属组为 zhang3

[student@master ansible]$ ansible node1 -m copy -a 'src=/etc/fstab dest=/var/tmp/fstab owner=zhang3 group=zhang3'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/var/tmp/fstab",
    "gid": 1002,
    "group": "zhang3",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "mode": "0644",
    "owner": "zhang3",
    "secontext": "unconfined_u:object_r:user_home_t:s0",
    "size": 579,
    "src": "/home/student/.ansible/tmp/ansible-tmp-1756266706.9290698-1517-277259149331136/source",
    "state": "file",
    "uid": 1001
}

查看权限
[student@master ansible]$ ansible node1 -m shell -a 'ls -l /var/tmp/fstab'
node1 | CHANGED | rc=0 >>
-rw-r--r--. 1 zhang3 zhang3 579 Aug 27 11:51 /var/tmp/fstab

(四)文件属性模块:file

设置文件/目录的权限、所有者、类型(如创建文件、目录、链接)。

参数 功能说明
path/dest 必选,指定远程文件 / 目录路径(如 path=/var/tmp/fstab
state 指定资源类型 / 状态: - file(确保为文件,默认) - directory(创建目录) - link(创建软链接) - hard(创建硬链接) - touch(创建空文件) - absent(删除文件 / 目录)
mode 设置权限(如 mode=g+w 给组加写权限,或 mode=0644
owner 指定所有者(如 owner=root
group 指定所属组(如 group=root
src 仅用于链接:软链接 / 硬链接的源路径(如 src=/aaa/file1 state=link

修改node1的 /var/tmp/fstab 的权限(组可写、其他可写),所有者、所属组为root

[student@master ansible]$ ansible node1 -m file -a 'path=/var/tmp/fstab mode=g+w mode=o+w owner=root group=root '
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "gid": 0,
    "group": "root",
    "mode": "0646",
    "owner": "root",
    "path": "/var/tmp/fstab",
    "secontext": "unconfined_u:object_r:user_home_t:s0",
    "size": 579,
    "state": "file",
    "uid": 0
}

在远程创建目录 /aaa,指定所有者为zhang3,所属组为root

[student@master ansible]$ ansible node1 -m file -a 'path=/aaa owner=zhang3 group=root state=directory'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "gid": 0,
    "group": "root",
    "mode": "0755",
    "owner": "zhang3",
    "path": "/aaa",
    "secontext": "unconfined_u:object_r:default_t:s0",
    "size": 6,
    "state": "directory",
    "uid": 1001
}

在远程创建空文件 /aaa/file1,权限为0644:

[student@master ansible]$ ansible node1 -m file -a 'path=/aaa/file1 mode=0644 state=touch'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "dest": "/aaa/file1",
    "gid": 0,
    "group": "root",
    "mode": "0644",
    "owner": "root",
    "secontext": "unconfined_u:object_r:default_t:s0",
    "size": 0,
    "state": "file",
    "uid": 0
}

创建软链接:/aaa/abc 指向 /aaa/file1:

[student@master ansible]$ ansible node1 -m file -a 'dest=/aaa/abc src=/aaa/file1 state=link'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "dest": "/aaa/abc",
    "gid": 0,
    "group": "root",
    "mode": "0777",
    "owner": "root",
    "secontext": "unconfined_u:object_r:default_t:s0",
    "size": 10,
    "src": "/aaa/file1",
    "state": "link",
    "uid": 0
}

创建硬链接同上,仅需将state=link改为state=hard

删除远程 /aaa/file1(文件/目录均适用):

[student@master ansible]$ ansible node1 -m file -a 'path=/aaa/file1 state=absent'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "path": "/aaa/file1",
    "state": "absent"
}

(五)YUM 仓库配置模块:yum_repository

在远程主机配置 YUM 仓库(生成 .repo 文件)。

参数 功能说明
file 必选,生成的 .repo 文件名(如 file=server 对应 /etc/yum.repos.d/server.repo
name 必选,仓库 ID(.repo 文件中 [NAME] 部分,如 name=BASE
description 仓库描述(如 description="software base"
baseurl 必选,仓库源地址(如 baseurl=http://ansible.example.com/rhel9/BaseOS
enabled 是否启用仓库:yes(默认)、no
gpgcheck 是否校验 GPG 签名:yes(默认)、no
gpgkey GPG 密钥文件地址(如 gpgkey=http://xxx/RPM-GPG-KEY-redhat-release

为所有主机配置 BASE 仓库(指向远程源):

[student@master ansible]$ ansible all -m yum_repository -a 'file=server name=BASE description="software base" baseurl=http://ansible.example.com/rhel9/BaseOS enabled=yes gpgcheck=yes gpgkey=http://ansible.example.com/rhel9/RPM-GPG-KEY-redhat-release'
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "BASE",
    "state": "present"
}
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "BASE",
    "state": "present"
}
node3 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "BASE",
    "state": "present"
}
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "BASE",
    "state": "present"
}
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "BASE",
    "state": "present"
}

为所有主机配置 STREAM 仓库;

[student@master ansible]$ ansible all -m yum_repository -a 'file=server name=STREAM description="software stream" baseurl=http://ansible.example.com/rhel9/AppStream enabled=yes gpgcheck=yes gpgkey=http://ansible.example.com/rhel9/RPM-GPG-KEY-redhat-release'
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "STREAM",
    "state": "present"
}
node3 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "STREAM",
    "state": "present"
}
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "STREAM",
    "state": "present"
}
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "repo": "STREAM",
    "state": "present"
}

(六)软件安装模块:yum

通过 YUM 管理器安装/卸载软件包(适用于 RHEL/CentOS 系统)。

参数 功能说明
name 必选,软件包名(单个包如 name=httpd,多个包如 name=httpd,nginx
state 软件状态: - installed/present(安装软件,默认) - removed/absent(卸载软件) - latest(升级到最新版本)
update_cache 安装前是否更新 YUM 缓存:yesno(默认)
disable_gpg_check 禁用 GPG 校验:yesno(默认)

所有主机安装 httpd:

[student@master ansible]$ ansible all -m yum -a 'name=httpd state=installed'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: httpd-filesystem-2.4.53-7.el9.noarch",
        "Installed: mod_http2-1.15.19-2.el9.x86_64",
        "Installed: httpd-tools-2.4.53-7.el9.x86_64",
        "Installed: apr-util-openssl-1.6.1-20.el9.x86_64",
        "Installed: mod_lua-2.4.53-7.el9.x86_64",
        "Installed: httpd-2.4.53-7.el9.x86_64",
        "Installed: redhat-logos-httpd-90.4-1.el9.noarch",
        "Installed: mailcap-2.1.49-5.el9.noarch",
        "Installed: apr-1.7.0-11.el9.x86_64",
        "Installed: apr-util-1.6.1-20.el9.x86_64",
        "Installed: apr-util-bdb-1.6.1-20.el9.x86_64",
        "Installed: httpd-core-2.4.53-7.el9.x86_64"
    ]
}
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: httpd-filesystem-2.4.53-7.el9.noarch",
        "Installed: mod_http2-1.15.19-2.el9.x86_64",
        "Installed: httpd-tools-2.4.53-7.el9.x86_64",
        "Installed: apr-util-openssl-1.6.1-20.el9.x86_64",
        "Installed: mod_lua-2.4.53-7.el9.x86_64",
        "Installed: httpd-2.4.53-7.el9.x86_64",
        "Installed: redhat-logos-httpd-90.4-1.el9.noarch",
        "Installed: mailcap-2.1.49-5.el9.noarch",
        "Installed: apr-1.7.0-11.el9.x86_64",
        "Installed: apr-util-1.6.1-20.el9.x86_64",
        "Installed: apr-util-bdb-1.6.1-20.el9.x86_64",
        "Installed: httpd-core-2.4.53-7.el9.x86_64"
    ]
}
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: httpd-filesystem-2.4.53-7.el9.noarch",
        "Installed: mod_http2-1.15.19-2.el9.x86_64",
        "Installed: httpd-tools-2.4.53-7.el9.x86_64",
        "Installed: apr-util-openssl-1.6.1-20.el9.x86_64",
        "Installed: mod_lua-2.4.53-7.el9.x86_64",
        "Installed: httpd-2.4.53-7.el9.x86_64",
        "Installed: redhat-logos-httpd-90.4-1.el9.noarch",
        "Installed: mailcap-2.1.49-5.el9.noarch",
        "Installed: apr-1.7.0-11.el9.x86_64",
        "Installed: apr-util-1.6.1-20.el9.x86_64",
        "Installed: apr-util-bdb-1.6.1-20.el9.x86_64",
        "Installed: httpd-core-2.4.53-7.el9.x86_64"
    ]
}
node3 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: httpd-filesystem-2.4.53-7.el9.noarch",
        "Installed: mod_http2-1.15.19-2.el9.x86_64",
        "Installed: httpd-tools-2.4.53-7.el9.x86_64",
        "Installed: apr-util-openssl-1.6.1-20.el9.x86_64",
        "Installed: mod_lua-2.4.53-7.el9.x86_64",
        "Installed: httpd-2.4.53-7.el9.x86_64",
        "Installed: redhat-logos-httpd-90.4-1.el9.noarch",
        "Installed: mailcap-2.1.49-5.el9.noarch",
        "Installed: apr-1.7.0-11.el9.x86_64",
        "Installed: apr-util-1.6.1-20.el9.x86_64",
        "Installed: apr-util-bdb-1.6.1-20.el9.x86_64",
        "Installed: httpd-core-2.4.53-7.el9.x86_64"
    ]
}
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: httpd-filesystem-2.4.53-7.el9.noarch",
        "Installed: mod_http2-1.15.19-2.el9.x86_64",
        "Installed: httpd-tools-2.4.53-7.el9.x86_64",
        "Installed: apr-util-openssl-1.6.1-20.el9.x86_64",
        "Installed: mod_lua-2.4.53-7.el9.x86_64",
        "Installed: httpd-2.4.53-7.el9.x86_64",
        "Installed: redhat-logos-httpd-90.4-1.el9.noarch",
        "Installed: mailcap-2.1.49-5.el9.noarch",
        "Installed: apr-1.7.0-11.el9.x86_64",
        "Installed: apr-util-1.6.1-20.el9.x86_64",
        "Installed: apr-util-bdb-1.6.1-20.el9.x86_64",
        "Installed: httpd-core-2.4.53-7.el9.x86_64"
    ]
}
[student@master ansible]$ ansible node4 -m yum -a 'name=httpd state=removed'
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Removed: httpd-2.4.53-7.el9.x86_64"
    ]
}

卸载 软件httpd:

state=absent也能够卸载软件
[student@master ansible]$ ansible node4 -m yum -a 'name=httpd state=removed'
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "",
    "rc": 0,
    "results": [
        "Removed: httpd-2.4.53-7.el9.x86_64"
    ]
}

(七)服务管理模块:service

启动、停止、重启服务,并设置开机自启/禁用。

参数 功能说明
name 必选,服务名(如 name=httpd,需与系统服务名一致)
state 服务运行状态: - started(启动服务) - stopped(停止服务) - restarted(重启服务) - reloaded(重载配置)
enabled 是否开机自启:yes(启用)、no(禁用)、masked(屏蔽服务)
daemon_reload 重新加载 systemd 配置(如服务文件修改后,daemon_reload=yes

设置node1启动 httpd 服务,并设置开机自启:

[student@master ansible]$ ansible node1 -m service -a 'name=httpd state=started enabled=yes'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "enabled": true,
    "name": "httpd",
    "state": "started",
    "status": {
        "AccessSELinuxContext": "system_u:object_r:httpd_unit_file_t:s0",
        "ActiveEnterTimestampMonotonic": "0",
        "ActiveExitTimestampMonotonic": "0",
        ********省略*********
        "UnitFileState": "disabled",
        "UtmpMode": "init",
        "Wants": "httpd-init.service",
        "WatchdogSignal": "6",
        "WatchdogTimestampMonotonic": "0",
        "WatchdogUSec": "infinity"
    }
}

重启 httpd 服务;

[student@master ansible]$ ansible node1 -m service -a 'name=httpd state=restarted'node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "name": "httpd",
    "state": "started",
    "status": {
        "AccessSELinuxContext": "system_u:object_r:httpd_unit_file_t:s0",
        "ActiveEnterTimestamp": "Wed 2025-08-27 12:31:39 CST",
        "ActiveEnterTimestampMonotonic": "6241006629",
        "ActiveExitTimestampMonotonic": "0",
           *******省略*******
                   "WatchdogSignal": "6",
        "WatchdogTimestampMonotonic": "0",
        "WatchdogUSec": "0"
    }
}

(八)文件拉取模块:fetch

从远程主机拉取文件到本地(仅支持文件,不支持目录;本地存储以主机名分目录)。

参数 功能说明
src 必选,远程文件路径(如 src=/etc/fstab,必须是文件,不能是目录)
dest 必选,本地存储路径(如 dest=/tmp/,拉取后默认生成 dest/主机名/src路径 结构)
flat 是否取消 “主机名目录” 层级:yes(直接存为 dest/文件名,如 dest=/tmp/fstab)、no(默认)
validate_checksum 校验文件完整性:yes(默认)、no

拉取所有远程主机的 /etc/fstab 到本地 /tmp(本地路径:/tmp/<主机名>/etc/fstab):

[student@master ansible]$ ansible all -m fetch -a 'src=/etc/fstab dest=/tmp/'
node4 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/node4/etc/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}
node1 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/node1/etc/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}
node3 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/node3/etc/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}
node2 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/node2/etc/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}
node5 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/node5/etc/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}

[student@master ansible]$ ls /tmp/
node1
node2
node3
node4
node5
[student@master etc]$ ls
fstab
[student@master etc]$ pwd
/tmp/node1/etc

拉取 node1/etc/fstab 到本地 /tmp/fstab(不创建主机名目录):

[student@master ansible]$ ansible node1 -m fetch -a 'src=/etc/fstab dest=/tmp/ flat=yes'
node1 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/fstab",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}

[student@master ansible]$ ls /tmp/
fstab
node1
node2
node3
node4
node5

拉取所有node2的 /etc/fstab 到本地,文件名含主机名(如 /tmp/fstab-node1):

[student@master ansible]$ ansible node2 -m fetch -a 'src=/etc/fstab dest=/tmp/fstab-{{inventory_hostname}} flat=yes'
node2 | CHANGED => {
    "changed": true,
    "checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "dest": "/tmp/fstab-node2",
    "md5sum": "4ab05d98a2058dd0703b9e57993802e8",
    "remote_checksum": "741593a3c559105fd9a9af53e25a3684ce00a57e",
    "remote_md5sum": null
}
[student@master ansible]$ ls /tmp/
fstab
fstab-node2
node1
node2
node3
node4
node5

(九)防火墙配置模块:firewalld

管理 firewalld 防火墙规则(端口、服务、富规则)。

参数 功能说明
service 允许的服务名(如 service=http,需 firewalld 预定义服务)
port 允许的端口(如 port=80/tcp,格式 端口/协议
rich_rule 富规则(复杂规则,如 rich_rule="rule family=ipv4 source address=192.168.122.0/24 service name=http accept"
zone 防火墙区域(如 zone=public,默认 public)
state 规则状态:enabled(启用规则)、disabled(禁用规则)
permanent 是否永久生效:yes(重启 firewalld 后保留)、no(临时生效,默认)
immediate 是否立即加载规则(配合 permanent=yes 使用,immediate=yes 实现 “永久 + 即时生效”)

所有主机允许 http 服务流量(永久生效,立即加载):

[student@master ansible]$ ansible all -m firewalld -a 'service=http permanent=yes state=enabled immediate=yes'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed service http to enabled"
}
node3 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed service http to enabled"
}
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed service http to enabled"
}
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed service http to enabled"
}
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed service http to enabled"
}

允许 192.168.122.0/24 网段访问 http 服务(永久生效):

[student@master ansible]$ ansible all -m firewalld -a 'zone=public rich_rule="rule family=ipv4 source address=192.168.122.0/24 service name=http accept" permanent=yes state=enabled immediate=yes'
node2 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed rich_rule rule family=ipv4 source address=192.168.122.0/24 service name=http accept to enabled"
}
node3 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed rich_rule rule family=ipv4 source address=192.168.122.0/24 service name=http accept to enabled"
}
node4 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed rich_rule rule family=ipv4 source address=192.168.122.0/24 service name=http accept to enabled"
}
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed rich_rule rule family=ipv4 source address=192.168.122.0/24 service name=http accept to enabled"
}
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "Permanent and Non-Permanent(immediate) operation, Changed rich_rule rule family=ipv4 source address=192.168.122.0/24 service name=http accept to enabled"
}

(十)文件内容替换模块:replace

参数 功能说明
path 必选,目标文件路径(如 path=/aaa/file11
regexp 必选,匹配内容的正则表达式(如 regexp="aa" 匹配所有 “aa”)
replace 必选,替换后的内容(如 replace="zz" 将 “aa” 替换为 “zz”)
backup 是否备份原文件:yes(备份为 path.xxx~)、no(默认)
before 仅替换 “指定行之前” 的内容(如 before="abc" 替换 abc 之前的匹配项)
after 仅替换 “指定行之后” 的内容(如 after="abc" 替换 abc 之后的匹配项)

通过正则表达式替换文件中的字符串(支持备份)。

创建一个文件:

[student@master ansible]$ ansible node1 -m shell -a 'echo aa bb abc aa asd qwe aa > /aaa/file11'
node1 | CHANGED | rc=0 >>

[student@master ansible]$ ansible node1 -m shell -a 'cat /aaa/file11'
node1 | CHANGED | rc=0 >>
aa bb abc aa asd qwe aa

将node1中 /aaa/file11 中的 aa 替换为 zz:

[student@master ansible]$ ansible node1 -m replace -a 'path=/aaa/file11 regexp="aa" replace="zz"'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": "3 replacements made",
    "rc": 0
}

[student@master ansible]$ ansible node1 -m shell -a 'cat /aaa/file11'
node1 | CHANGED | rc=0 >>
zz bb abc zz asd qwe zz

替换字符串并备份原文件(备份文件后缀为 .bak):

[student@master ansible]$ ansible node1 -m replace -a 'path=/aaa/file11 regexp="zz" replace="kk" backup=yes'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "backup_file": "/aaa/file11.16916.2025-08-27@12:58:34~",
    "changed": true,
    "msg": "3 replacements made",
    "rc": 0
}
[student@master ansible]$ ansible node1 -m shell -a 'cat /aaa/file11'
node1 | CHANGED | rc=0 >>
kk bb abc kk asd qwe kk
[student@master ansible]$ ansible node1 -m shell -a 'ls /aaa/'
node1 | CHANGED | rc=0 >>
file11
file11.16916.2025-08-27@12:58:34~
[student@master ansible]$ ansible node1 -m shell -a 'cat /aaa/file11.16916.2025-08-27@12:58:34~'
node1 | CHANGED | rc=0 >>
zz bb abc zz asd qwe zz

(十一)磁盘分区模块:parted

管理磁盘分区(新建、删除分区)。

参数 功能说明
device 必选,磁盘设备路径(如 device=/dev/vdb
number 必选,分区编号(如 number=1 表示第一个分区)
state 分区状态:present(创建分区)、absent(删除分区)
part_type 分区类型:primary(主分区)、extended(扩展分区)、logical(逻辑分区)
part_start 分区起始点
part_end 分区结束点

node5/dev/vdb 上新建扩展分区(编号 1,起始 1GiB,结束 20GiB):

[student@master ansible]$ ansible node5 -m parted -a 'device=/dev/vdb number=1 part_type=extended part_start=1GiB part_end=20GiB state=present'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "disk": {
        "dev": "/dev/vdb",
        "logical_block": 512,
        "model": "Virtio Block Device",
        "physical_block": 512,
        "size": 52428800.0,
        "table": "msdos",
        "unit": "kib"
    },
    "partitions": [
        {
            "begin": 1048576.0,
            "end": 20971520.0,
            "flags": [
                "lba"
            ],
            "fstype": "",
            "name": "",
            "num": 1,
            "size": 19922944.0,
            "unit": "kib"
        }
    ],
    "script": "unit KiB mklabel msdos mkpart extended 1GiB 20GiB"
}
[student@master ansible]$ ansible node5 -m shell -a 'lsblk /dev/vdb'
node5 | CHANGED | rc=0 >>
NAME   MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
vdb    252:16   0  50G  0 disk 
└─vdb1 252:17   0   1K  0 part 

在扩展分区内新建逻辑分区(编号 ,起始 1.1GiB,结束 10GiB):

[student@master ansible]$ ansible node5 -m parted -a 'device=/dev/vdb number=5 part_type=logical part_start=1.1GiB part_end=10GiB state=present'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "disk": {
        "dev": "/dev/vdb",
        "logical_block": 512,
        "model": "Virtio Block Device",
        "physical_block": 512,
        "size": 52428800.0,
        "table": "msdos",
        "unit": "kib"
    },
    "partitions": [
        {
            "begin": 1048576.0,
            "end": 20971520.0,
            "flags": [
                "lba"
            ],
            "fstype": "",
            "name": "",
            "num": 1,
            "size": 19922944.0,
            "unit": "kib"
        },
        {
            "begin": 1153434.0,
            "end": 10485760.0,
            "flags": [],
            "fstype": "",
            "name": "",
            "num": 5,
            "size": 9332327.0,
            "unit": "kib"
        }
    ],
    "script": "unit KiB mkpart logical 1.1GiB 10GiB"
}

(十二)文件系统模块:filesystem

为分区创建文件系统如 XFS、EXT4(格式化为XFS.EXT4类型)。

参数 功能说明
dev 必选,分区设备路径(如 dev=/dev/vdb5
fstype 必选,文件系统类型(如 fstype=xfsfstype=ext4
force 强制创建(覆盖已有文件系统,force=yes,谨慎使用)
opts 创建文件系统的额外参数(如 opts="-m 5" 给 EXT4 预留 5% 空间)

node5/dev/sda5 分区创建 XFS 文件系统:

[student@master ansible]$ ansible node5 -m filesystem -a 'fstype=xfs dev=/dev/vdb5'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true
}

(十三)挂载模块:mount

管理文件系统挂载(临时挂载、写入 /etc/fstab 永久挂载)。

参数 功能说明
path/name 必选,挂载点路径(如 path=/fs,需先创建目录)
src 必选,挂载源(设备路径如 src=/dev/vdb5,或 UUID 如 src="UUID=xxx"
fstype 必选,文件系统类型(如 fstype=xfs,需与分区格式一致)
state 挂载状态: - mounted(挂载并写入 /etc/fstab 永久生效) - present(仅写入 /etc/fstab,不立即挂载) - unmounted(卸载,保留 /etc/fstab) - absent(卸载并删除 /etc/fstab 配置)
opts 挂载选项(如 opts=defaults,默认 defaults

node1 上创建挂载点 /fs

查看 /dev/vda5 的 UUID:

[student@master ansible]$ ansible node5 -m shell -a 'blkid /dev/vdb5'
node5 | CHANGED | rc=0 >>
/dev/vdb5: UUID="7facb414-b6a8-403d-9b28-22f3ebb5c9e5" TYPE="xfs" PARTUUID="ebc69adf-05"

/dev/vda5 永久挂载到 /fs(写入 /etc/fstab):

[student@master ansible]$ ansible node5 -m mount -a 'path=/fs src="UUID=7facb414-b6a8-403d-9b28-22f3ebb5c9e5"  fstype=xfs state=absent'
node5 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "backup_file": "",
    "boot": "yes",
    "changed": false,
    "dump": "0",
    "fstab": "/etc/fstab",
    "fstype": "xfs",
    "name": "/fs",
    "opts": "defaults",
    "passno": "0",
    "src": "UUID=7facb414-b6a8-403d-9b28-22f3ebb5c9e5"
}

(十四)LVM 卷组模块:lvg

创建、删除 LVM 卷组。

参数 功能说明
vg 必选,卷组名(如 vg=vg0
pvs 必选,组成卷组的物理卷(如 pvs=/dev/vdb5,多个物理卷用逗号分隔)
state 卷组状态:present(创建卷组)、absent(删除卷组)
pesize PE(物理扩展块)大小(如 pesize=16M,默认 4M,需是 2 的幂)
force 强制创建(如覆盖已有卷组,force=yes,谨慎使用)

node5 上创建卷组 vg0,使用 /dev/vda5 分区,PE 大小 16M:

[student@master ansible]$ ansible node5 -m lvg -a 'vg=vg0 pesize=16M pvs=/dev/vdb5'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true
}

(十五)LVM 逻辑卷模块:lvol

创建、扩容 LVM 逻辑卷。

参数 功能说明
lv 必选,逻辑卷名(如 lv=lv0
vg 必选,逻辑卷所属的卷组(如 vg=vg0
size 逻辑卷大小(如 size=1000Msize=+500M 表示扩容 500M)
state 逻辑卷状态:present(创建 / 保留)、absent(删除)
resizefs 扩容时是否自动扩展文件系统:yes(需文件系统支持,如 XFS/EXT4)、no(默认)

在卷组 vg0 上创建 1000M 的逻辑卷 lv0:

[student@master ansible]$ ansible node5 -m lvol -a 'lv=lv0 size=1000M vg=vg0'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "msg": ""
}

在线扩容 lv0 到 1600M(自动扩展文件系统);

# 为逻辑卷 lv0 格式化为 XFS 文件系统(加 -b 提权)
[student@master ansible]$ ansible node5  -m filesystem -a 'fstype=xfs dev=/dev/vg0/lv0'
node5 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true
}

# 扩容到 1600M
[student@master ansible]$ ansible node5 -m lvol -a 'lv=lv0 size=1600M vg=vg0 resizefs=yes'
node5 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": false, 
    "lv": "lv0",
    "size": 1600.0,
    "vg": "vg0"
}

(十六)计划任务模块:cron

管理远程主机的 crontab 计划任务。

参数 功能说明
name 必选,任务名称(用于标识和删除任务,如 name="shuchu"
job 必选,计划任务执行的命令(如 job="/bin/echo I AM RHCE"
user 执行任务的用户(如 user=root,默认当前用户)
state 任务状态:present(创建任务)、absent(删除任务)
minute/hour/day/month/weekday cron 时间字段: - minute=0(分钟,0-59) - hour=14(小时,0-23) - day=*(日,1-31) - month=*(月,1-12) - weekday=*(周,0-6,0 = 周日)
special_time 特殊时间(替代上述时间字段):reboot(重启时)、daily(每天)等

node1 上添加计划任务:每天 14:00 以 root 执行 /bin/echo I AM RHCE

[student@master ansible]$ ansible node1 -m cron -a 'name="shuchu" job="/bin/echo I AM RHCE" user=root minute=0 hour=14 state=present'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "envs": [],
    "jobs": [
        "shuchu"
    ]
}

删除上述计划任务;

[student@master ansible]$ ansible node1 -m cron -a 'name="shuchu" state=absent
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "envs": [],
    "jobs": []
}

(十七)文件下载模块:get_url

从 HTTP/HTTPS/FTP 下载文件到远程主机。

参数 功能说明
url 必选,下载源地址(如 url=http://ansible.example.com/file2
dest 必选,远程主机目标路径(如 dest=/tmp/file2
owner/group/mode copy 模块,设置下载后文件的所有者、所属组、权限
force 是否强制重新下载(即使目标文件已存在):yesno(默认,校验 MD5 一致则不下载)
validate_certs HTTPS 下载时是否校验证书:yes(默认)、no(忽略证书错误)
timeout 下载超时时间(如 timeout=30,单位秒,默认 10 秒)

node1 上下载文件(如远程 http://ansilbe.example.com/file2/tmp/):

[student@master ansible]$ ansible node1 -m get_url -a 'url=http://ansible.example.com/file2 dest=/tmp/file2'
node1 | CHANGED => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python3"
    },
    "changed": true,
    "checksum_dest": null,
    "checksum_src": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "dest": "/tmp/file2",
    "elapsed": 0,
    "gid": 0,
    "group": "root",
    "md5sum": "d41d8cd98f00b204e9800998ecf8427e",
    "mode": "0644",
    "msg": "OK (0 bytes)",
    "owner": "root",
    "secontext": "unconfined_u:object_r:user_home_t:s0",
    "size": 0,
    "src": "/home/student/.ansible/tmp/ansible-tmp-1756305253.1840584-1389-107803694225127/tmpyo819el6",
    "state": "file",
    "status_code": 200,
    "uid": 0,
    "url": "http://ansible.example.com/file2"
}
需求 命令
node1 上下载文件(如远程 http://example.com/file.tar.gz/tmp/ ansible node1 -m get_url -a 'url=http://example.com/file.tar.gz dest=/tmp/file.tar.gz'
强制覆盖已存在的文件 ansible node1 -m get_url -a 'url=http://example.com/file.tar.gz dest=/tmp/file.tar.gz force=yes'

网站公告

今日签到

点亮在社区的每一天
去签到