構成管理ツールのAnsibleです。今回はCentOS7でシンプルなLAMP環境を作ってみました。
インターン生が以前シェルスクリプトでLAMP+WordPress環境を構築する課題を行ってくれましたが、やっていることは同じです。ただ、Ansibleを使うと一度行った処理はスルーしてくれるのと、より環境構築することに最適化されて洗練されています。
また、前回行ったVagrantですが、Vagrantで最小限のBOXファイルを共有・配布して、AnsibleのPlaybookで構築して貰うのが具合が良いかと思います。
目次
Ansible…インフラをコード化するメリット
- Playbookから構築したものであれば、再現性の保証がある。
手順書は大切ですが、手動での構築では、手順書の内容と実環境が同一でない場合がある。 - 同一構成をいくらでも複製できる。
- 記述がシンプルで簡単で導入しやすい。
- 一度実行したものはスルーして未実行の操作だけ実行してくれる。便利！冪等性。シェルスクリプトでも判定できないことはないけれど、判定の為のテストコードが多くなり見通しが悪くしんどい。
- エージェントレス。クライアントに余計なモジュールを入れなくて良い。
- 当然、パブリッククラウドの構成管理にも使えます。
手順書より信用度が高いし、使いまわしがしやすい。
環境
- VirtualBox 5.1.28
https://www.virtualbox.org/ - Ansible 2.3.2.0
- LANネットワーク:192.168.10.0/24
参考リンク
- Ansibleドキュメント
http://docs.ansible.com/ansible/latest/ - 汎用BOX配布元 VagrantCloud
VagrantCloud
BOXを取得しよう
たくさん用意されています。ちょっと気まぐれにフレームワークで遊んだりする時楽です。
お弁当からVagrantのBoxファイルを取得することにします。
Vagrrant initしよう
bento/centos-7.2をダウンロード、vagrantfileの作成
|
1 2 3 4 5 6 |
C:\Users\root\Desktop\Vagrant\Ansible_test>vagrant init bento/centos-7.2 A `Vagrantfile` has been placed in this directory. You are now ready to `vagrant up` your first virtual environment! Please read the comments in the Vagrantfile as well as documentation on `vagrantup.com` for more information on using Vagrant. |
Vagrantfile
Vagrantfileを下記に書き換えます。
こんな風に構成したいと思います。
- Ansibleサーバ：192.168.10.50
- WEBサーバ：192.168.10.51
- DBサーバ：192.168.10.52
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
# -*- mode: ruby -*- # vi: set ft=ruby : Vagrant.configure(2) do |config| config.vm.define "host" do |node| node.vm.box = "bento/centos-7.2" node.vm.hostname = "host" node.vm.network "public_network", ip: "192.168.10.50" end config.vm.define "web" do |node| node.vm.box = "bento/centos-7.2" node.vm.hostname = "web" node.vm.network "public_network", ip: "192.168.10.51" end config.vm.define "db" do |node| node.vm.box = "bento/centos-7.2" node.vm.hostname = "db" node.vm.network "public_network", ip: "192.168.10.52" end end |
Vagrant up
Vagrantfileから仮想サーバを構成します。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 |
C:\Users\root\Desktop\Vagrant\Ansible_test>vagrant up Bringing machine 'host' up with 'virtualbox' provider... Bringing machine 'web' up with 'virtualbox' provider... Bringing machine 'db' up with 'virtualbox' provider... ==> host: Importing base box 'bento/centos-7.2'... ==> host: Matching MAC address for NAT networking... ==> host: Checking if box 'bento/centos-7.2' is up to date... ==> host: Setting the name of the VM: Ansible_test_host_1507558583327_45816 ==> host: Clearing any previously set network interfaces... ==> host: Preparing network interfaces based on configuration... host: Adapter 1: nat host: Adapter 2: bridged ==> host: Forwarding ports... host: 22 (guest) => 2222 (host) (adapter 1) ==> host: Booting VM... ==> host: Waiting for machine to boot. This may take a few minutes... host: SSH address: 127.0.0.1:2222 host: SSH username: vagrant host: SSH auth method: private key host: Warning: Connection reset. Retrying... host: Warning: Remote connection disconnect. Retrying... host: Warning: Connection aborted. Retrying... host: Warning: Remote connection disconnect. Retrying... host: Warning: Connection aborted. Retrying... host: Warning: Remote connection disconnect. Retrying... host: Warning: Connection aborted. Retrying... host: Warning: Remote connection disconnect. Retrying... host: Warning: Connection aborted. Retrying... host: Warning: Remote connection disconnect. Retrying... host: Warning: Connection aborted. Retrying... host: Warning: Connection reset. Retrying... host: Warning: Connection aborted. Retrying... host: host: Vagrant insecure key detected. Vagrant will automatically replace host: this with a newly generated keypair for better security. host: host: Inserting generated public key within guest... host: Removing insecure key from the guest if it's present... host: Key inserted! Disconnecting and reconnecting using new SSH key... ==> host: Machine booted and ready! ==> host: Checking for guest additions in VM... ==> host: Setting hostname... ==> host: Configuring and enabling network interfaces... host: SSH address: 127.0.0.1:2222 host: SSH username: vagrant host: SSH auth method: private key ==> host: Mounting shared folders... host: /vagrant => C:/Users/root/Desktop/Vagrant/Ansible_test ==> web: Importing base box 'bento/centos-7.2'... ==> web: Matching MAC address for NAT networking... ==> web: Checking if box 'bento/centos-7.2' is up to date... ==> web: Setting the name of the VM: Ansible_test_web_1507558660591_30182 ==> web: Fixed port collision for 22 => 2222. Now on port 2200. ==> web: Clearing any previously set network interfaces... ==> web: Preparing network interfaces based on configuration... web: Adapter 1: nat web: Adapter 2: bridged ==> web: Forwarding ports... web: 22 (guest) => 2200 (host) (adapter 1) ==> web: Booting VM... ==> web: Waiting for machine to boot. This may take a few minutes... web: SSH address: 127.0.0.1:2200 web: SSH username: vagrant web: SSH auth method: private key web: Warning: Connection reset. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Remote connection disconnect. Retrying... web: Warning: Connection aborted. Retrying... web: Warning: Connection reset. Retrying... web: Warning: Connection aborted. Retrying... web: web: Vagrant insecure key detected. Vagrant will automatically replace web: this with a newly generated keypair for better security. web: web: Inserting generated public key within guest... web: Removing insecure key from the guest if it's present... web: Key inserted! Disconnecting and reconnecting using new SSH key... ==> web: Machine booted and ready! ==> web: Checking for guest additions in VM... ==> web: Setting hostname... ==> web: Configuring and enabling network interfaces... web: SSH address: 127.0.0.1:2200 web: SSH username: vagrant web: SSH auth method: private key ==> web: Mounting shared folders... web: /vagrant => C:/Users/root/Desktop/Vagrant/Ansible_test ==> db: Importing base box 'bento/centos-7.2'... ==> db: Matching MAC address for NAT networking... ==> db: Checking if box 'bento/centos-7.2' is up to date... ==> db: Setting the name of the VM: Ansible_test_db_1507558737449_12722 ==> db: Fixed port collision for 22 => 2222. Now on port 2201. ==> db: Clearing any previously set network interfaces... ==> db: Preparing network interfaces based on configuration... db: Adapter 1: nat db: Adapter 2: bridged ==> db: Forwarding ports... db: 22 (guest) => 2201 (host) (adapter 1) ==> db: Booting VM... ==> db: Waiting for machine to boot. This may take a few minutes... db: SSH address: 127.0.0.1:2201 db: SSH username: vagrant db: SSH auth method: private key db: Warning: Connection reset. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Connection reset. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Connection reset. Retrying... db: Warning: Connection aborted. Retrying... db: Warning: Remote connection disconnect. Retrying... db: Warning: Connection aborted. Retrying... db: db: Vagrant insecure key detected. Vagrant will automatically replace db: this with a newly generated keypair for better security. db: db: Inserting generated public key within guest... db: Removing insecure key from the guest if it's present... db: Key inserted! Disconnecting and reconnecting using new SSH key... ==> db: Machine booted and ready! ==> db: Checking for guest additions in VM... ==> db: Setting hostname... ==> db: Configuring and enabling network interfaces... db: SSH address: 127.0.0.1:2201 db: SSH username: vagrant db: SSH auth method: private key ==> db: Mounting shared folders... db: /vagrant => C:/Users/root/Desktop/Vagrant/Ansible_test |
AnsibleサーバにAnsibleを導入しよう
|
1 2 3 4 5 6 7 |
C:\Users\root\Desktop\Vagrant\Ansible_test>vagrant ssh host [vagrant@host ~]$ [vagrant@host ~]$ sudo yum install epel-release [vagrant@host ~]$ sudo yum install ansible |
“the python mysqldb module is required”対策
|
1 |
[vagrant@host ~]$ sudo yum install MySQL-python |
ここからは、TeratermでhostであるAnsibleサーバにログインし、web, dbホストを操作します。
- 192.168.10.50:22
- ユーザ：vagrant
- パスワード：vagrant
接続先ホストの設定
|
1 2 3 4 5 6 7 |
[vagrant@host ~]$ vi .ssh/config Host web HostName 192.168.10.51 Host db HostName 192.168.10.52 |
|
1 |
[vagrant@host ~]$ chmod 600 .ssh/config |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
[vagrant@host ~]$ ssh-keygen -t rsa -b 4096 Generating public/private rsa key pair. Enter file in which to save the key (/home/vagrant/.ssh/id_rsa): Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/vagrant/.ssh/id_rsa. Your public key has been saved in /home/vagrant/.ssh/id_rsa.pub. The key fingerprint is: d7:64:6e:b5:a4:1a:9d:7a:6d:5b:6e:38:53:26:65:01 vagrant@host The key's randomart image is: +--[ RSA 4096]----+ | E. | | . | | o o .| | * = .o| | S o B .o | | . = .. o| | o . o=.| | . .++.| | .+.| +-----------------+ |
公開鍵を渡します。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 |
[vagrant@host ~]$ ssh-copy-id web The authenticity of host '192.168.10.51 (192.168.10.51)' can't be established. ECDSA key fingerprint is fa:c7:04:e6:3a:97:9d:f2:23:b9:ed:53:09:1b:b8:72. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys vagrant@192.168.10.51's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'web'" and check to make sure that only the key(s) you wanted were added. [vagrant@host ~]$ ssh-copy-id db The authenticity of host '192.168.10.52 (192.168.10.52)' can't be established. ECDSA key fingerprint is fa:c7:04:e6:3a:97:9d:f2:23:b9:ed:53:09:1b:b8:72. Are you sure you want to continue connecting (yes/no)? yes /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys vagrant@192.168.10.52's password: Number of key(s) added: 1 Now try logging into the machine, with: "ssh 'db'" and check to make sure that only the key(s) you wanted were added. |
sshでログインできるか確認
|
1 2 3 4 5 6 7 8 9 10 |
[vagrant@host ~]$ ssh web [vagrant@web ~]$ exit logout Connection to 192.168.10.51 closed. [vagrant@host ~]$ ssh db [vagrant@db ~]$ exit logout Connection to 192.168.10.52 closed. |
|
1 2 3 4 5 6 7 8 9 10 |
[vagrant@host ~]$ ansible all -i hosts -m ping 192.168.10.52 | SUCCESS => { "changed": false, "ping": "pong" } 192.168.10.51 | SUCCESS => { "changed": false, "ping": "pong" } |
コンフィグの作成
|
1 2 3 4 |
[vagrant@host ~]$ vi ansible.cfg [defaults] hostfile = ./hosts |
疎通確認
|
1 2 3 4 5 6 7 8 9 10 |
$ ansible all -m ping 192.168.10.51 | SUCCESS => { "changed": false, "ping": "pong" } 192.168.10.52 | SUCCESS => { "changed": false, "ping": "pong" } |
playbook.ymlの作成
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 |
[vagrant@host ~]$ vi playbook.yml --- - hosts: all sudo: yes tasks: - name: Yum update yum: name=* state=latest - hosts: web sudo: yes tasks: - name: Firewalldの状態チェック command: systemctl is-active firewalld register: firewalld_result changed_when: False ignore_errors: True - name: Firewalldの起動, 自動起動設定 service: name=firewalld state=started enabled=yes - name: Firewalld設定 80許可 firewalld: permanent=True port=80/tcp state=enabled immediate=true - name: Firewalld設定 443許可 firewalld: permanent=True port=443/tcp state=enabled immediate=true - name: PHPをインストール yum: name="{{item}}" state=latest with_items: - php - php-mysql - php-mbstring - php-gd - php-devel - php-xml - name: PHPのタイムゾーン設定 ini_file: > dest=/etc/php.ini section=Date option=date.timezone value='"Asia/Tokyo"' - name: Apacheのインストール yum: name=httpd state=latest - name: start Apacheの起動, 自動起動設定 service: name=httpd state=started enabled=yes handlers: - name: Firewalldの設定反映 読み込み service: name=firewalld state=restarted - hosts: db sudo: yes vars: - mysql_root_password: rootpassword tasks: - name: MariaDB インストール yum: name={{item}} state=latest with_items: - MySQL-python - mariadb - mariadb-libs - mariadb-server - mariadb-devel - name: MySQL起動, 自動起動 service: name=mariadb state=started enabled=yes - name: DBの作成 mysql_db: name=wpdb state=present - name: DBユーザの作成 localhost, 192.168.10.0/24のみ mysql_user: name=wpdbuser password=wpdbpassword host={{ item }} priv=wpdb.*:ALL state=present with_items: - localhost - 192.168.10.% - name: ローカル接続制限無効化 replace: > dest=/etc/my.cnf regexp='^bind-address' replace='#bind-address' - name: MySQL再起動, 自動起動 service: name=mariadb state=restarted enabled=yes - name: Firewalldの起動, 自動起動設定 service: name=firewalld state=started enabled=yes - name: Firewalld設定 3306許可 192.168.10.0/24のみDBへの接続許可 firewalld: permanent=True port=3306/tcp source=192.168.10.0/24 state=enabled immediate=true - name: Firewalldの再起動, 自動起動設定 service: name=firewalld state=restarted enabled=yes |
構文確認
|
1 |
[vagrant@host ~]$ ansible-playbook playbook.yml --syntax-check |
構文の確認をしてくれます。
ドライラン
|
1 |
[vagrant@host ~]$ ansible-playbook playbook.yml --check |
実行はするけれど、反映はさせない便利なテストモードです。
実行
|
1 |
[vagrant@host ~]$ ansible-playbook playbook.yml |
ざざっと問題なくいけば完了です。気持ちいい！！(۶•̀ᴗ•́)۶
色々メリットがあるので、インフラのコード化を検討されてはどうでしょうか。
お疲れ様です。
