ANSIBLE ROLE(系统自带角色)

botang

1. 安装随机自带的role（管理红帽自身常用功能的最佳解决方案）：

1. [root@classroom yum.repos.d]# yum list "*role*"
   
2. Updating Subscription Management repositories.
   
3. Unable to read consumer identity
   
4. This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
   
5. 上次元数据过期检查：0:13:35 前，执行于 2020年08月17日 星期一 20时36分26秒。
   
6. 已安装的软件包
   
7. rhel-system-roles.noarch                                                       1.0-5.el8                                                     @AppStream
   
8. 可安装的软件包
   
9. policycoreutils-newrole.x86_64                                                 2.8-16.1.el8                                                  BaseOS

复制代码

装到哪里：
[root@classroom yum.repos.d]# rpm -ql rhel-system-roles.noarch
/usr/share/ansible
/usr/share/ansible/roles
/usr/share/ansible/roles/linux-system-roles.kdump
/usr/share/ansible/roles/linux-system-roles.network
/usr/share/ansible/roles/linux-system-roles.postfix
/usr/share/ansible/roles/linux-system-roles.selinux
/usr/share/ansible/roles/linux-system-roles.timesync
/usr/share/ansible/roles/rhel-system-roles.kdump
/usr/share/ansible/roles/rhel-system-roles.kdump/COPYING
/usr/share/ansible/roles/rhel-system-roles.kdump/README.html
/usr/share/ansible/roles/rhel-system-roles.kdump/README.md
/usr/share/ansible/roles/rhel-system-roles.kdump/defaults
/usr/share/ansible/roles/rhel-system-roles.kdump/defaults/main.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/handlers
/usr/share/ansible/roles/rhel-system-roles.kdump/handlers/main.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/meta
/usr/share/ansible/roles/rhel-system-roles.kdump/meta/main.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/semaphore
/usr/share/ansible/roles/rhel-system-roles.kdump/tasks
/usr/share/ansible/roles/rhel-system-roles.kdump/tasks/main.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/tasks/ssh.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/templates
/usr/share/ansible/roles/rhel-system-roles.kdump/templates/kdump.conf.j2
/usr/share/ansible/roles/rhel-system-roles.kdump/templates/kdump.j2
/usr/share/ansible/roles/rhel-system-roles.kdump/tests
/usr/share/ansible/roles/rhel-system-roles.kdump/tests/roles
/usr/share/ansible/roles/rhel-system-roles.kdump/tests/roles/kdump
/usr/share/ansible/roles/rhel-system-roles.kdump/tests/tests_default.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/tests/tests_ssh.yml
/usr/share/ansible/roles/rhel-system-roles.kdump/vars
/usr/share/ansible/roles/rhel-system-roles.kdump/vars/main.yml
/usr/share/ansible/roles/rhel-system-roles.network
/usr/share/ansible/roles/rhel-system-roles.network/.travis.yml
/usr/share/ansible/roles/rhel-system-roles.network/LICENSE
/usr/share/ansible/roles/rhel-system-roles.network/README.html
/usr/share/ansible/roles/rhel-system-roles.network/README.md
/usr/share/ansible/roles/rhel-system-roles.network/defaults
/usr/share/ansible/roles/rhel-system-roles.network/defaults/main.yml
/usr/share/ansible/roles/rhel-system-roles.network/library
/usr/share/ansible/roles/rhel-system-roles.network/library/network_connections.py
/usr/share/ansible/roles/rhel-system-roles.network/meta
/usr/share/ansible/roles/rhel-system-roles.network/meta/main.yml
/usr/share/ansible/roles/rhel-system-roles.network/module_utils
/usr/share/ansible/roles/rhel-system-roles.network/module_utils/network_lsr
/usr/share/ansible/roles/rhel-system-roles.network/module_utils/network_lsr/__init__.py
/usr/share/ansible/roles/rhel-system-roles.network/module_utils/network_lsr/argument_validator.py
/usr/share/ansible/roles/rhel-system-roles.network/module_utils/network_lsr/utils.py
/usr/share/ansible/roles/rhel-system-roles.network/pylintrc
/usr/share/ansible/roles/rhel-system-roles.network/tasks
/usr/share/ansible/roles/rhel-system-roles.network/tasks/main.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests
/usr/share/ansible/roles/rhel-system-roles.network/tests/ansible_module_network_connections.py
/usr/share/ansible/roles/rhel-system-roles.network/tests/covstats
/usr/share/ansible/roles/rhel-system-roles.network/tests/down-profile.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/ensure_non_running_provider.py
/usr/share/ansible/roles/rhel-system-roles.network/tests/get-coverage.sh
/usr/share/ansible/roles/rhel-system-roles.network/tests/get-coverage.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/get-total-coverage.sh
/usr/share/ansible/roles/rhel-system-roles.network/tests/helpers
/usr/share/ansible/roles/rhel-system-roles.network/tests/helpers/ethtool
/usr/share/ansible/roles/rhel-system-roles.network/tests/merge-coverage.sh
/usr/share/ansible/roles/rhel-system-roles.network/tests/remove-profile.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network/defaults
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network/library
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network/meta
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network/module_utils
/usr/share/ansible/roles/rhel-system-roles.network/tests/roles/linux-system-roles.network/tasks
/usr/share/ansible/roles/rhel-system-roles.network/tests/run-tasks.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/assert-device_absent.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/assert-device_present.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/assert-profile_absent.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/assert-profile_present.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/create-and-remove-interface.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/manage-test-interface.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tasks/show-interfaces.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/test_network_connections.py
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_bridge.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_bridge_other_provider.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_default.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_default_other_provider.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_ethernet.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_ethernet_other_provider.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_helpers-and-asserts.yml
/usr/share/ansible/roles/rhel-system-roles.network/tests/tests_unit.yml
/usr/share/ansible/roles/rhel-system-roles.network/tox.ini
/usr/share/ansible/roles/rhel-system-roles.postfix
/usr/share/ansible/roles/rhel-system-roles.postfix/COPYING
/usr/share/ansible/roles/rhel-system-roles.postfix/README.html
/usr/share/ansible/roles/rhel-system-roles.postfix/README.md
/usr/share/ansible/roles/rhel-system-roles.postfix/defaults
/usr/share/ansible/roles/rhel-system-roles.postfix/defaults/main.yml
/usr/share/ansible/roles/rhel-system-roles.postfix/handlers
/usr/share/ansible/roles/rhel-system-roles.postfix/handlers/main.yml
/usr/share/ansible/roles/rhel-system-roles.postfix/meta
/usr/share/ansible/roles/rhel-system-roles.postfix/meta/main.yml
/usr/share/ansible/roles/rhel-system-roles.postfix/tasks
/usr/share/ansible/roles/rhel-system-roles.postfix/tasks/main.yml
/usr/share/ansible/roles/rhel-system-roles.selinux
/usr/share/ansible/roles/rhel-system-roles.selinux/COPYING
/usr/share/ansible/roles/rhel-system-roles.selinux/README.html
/usr/share/ansible/roles/rhel-system-roles.selinux/README.md
/usr/share/ansible/roles/rhel-system-roles.selinux/library
/usr/share/ansible/roles/rhel-system-roles.selinux/library/selogin.py
/usr/share/ansible/roles/rhel-system-roles.selinux/meta
/usr/share/ansible/roles/rhel-system-roles.selinux/meta/main.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/semaphore
/usr/share/ansible/roles/rhel-system-roles.selinux/tasks
/usr/share/ansible/roles/rhel-system-roles.selinux/tasks/main.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/roles
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/roles/selinux
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/selinux.config
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/selinux_apply_reboot.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/selinux_config_restore.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/selinux_config_save.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/selinux_test_transitions.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/set_selinux_variables.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_all_purge.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_all_transitions.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_boolean.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_fcontext.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_login.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_port.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/tests/tests_selinux_disabled.yml
/usr/share/ansible/roles/rhel-system-roles.selinux/vars
/usr/share/ansible/roles/rhel-system-roles.selinux/vars/main.yml
/usr/share/ansible/roles/rhel-system-roles.timesync
/usr/share/ansible/roles/rhel-system-roles.timesync/COPYING
/usr/share/ansible/roles/rhel-system-roles.timesync/README.html
/usr/share/ansible/roles/rhel-system-roles.timesync/README.md
/usr/share/ansible/roles/rhel-system-roles.timesync/defaults
/usr/share/ansible/roles/rhel-system-roles.timesync/defaults/main.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/handlers
/usr/share/ansible/roles/rhel-system-roles.timesync/handlers/main.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/library
/usr/share/ansible/roles/rhel-system-roles.timesync/library/timesync_provider.sh
/usr/share/ansible/roles/rhel-system-roles.timesync/meta
/usr/share/ansible/roles/rhel-system-roles.timesync/meta/main.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/semaphore
/usr/share/ansible/roles/rhel-system-roles.timesync/tasks
/usr/share/ansible/roles/rhel-system-roles.timesync/tasks/main.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/templates
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/chrony.conf.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/chronyd.sysconfig.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/ntp.conf.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/ntpd.sysconfig.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/phc2sys.sysconfig.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/ptp4l.conf.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/ptp4l.sysconfig.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/templates/timemaster.conf.j2
/usr/share/ansible/roles/rhel-system-roles.timesync/tests
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/roles
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/roles/timesync
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_default.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_provider1.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_provider2.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_provider3.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_provider4.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_provider5.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ntp_ptp.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ptp_multi.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/tests/tests_ptp_single.yml
/usr/share/ansible/roles/rhel-system-roles.timesync/vars
/usr/share/ansible/roles/rhel-system-roles.timesync/vars/main.yml
/usr/share/doc/rhel-system-roles/kdump/COPYING
/usr/share/doc/rhel-system-roles/kdump/README.html
/usr/share/doc/rhel-system-roles/kdump/README.md
/usr/share/doc/rhel-system-roles/network/LICENSE
/usr/share/doc/rhel-system-roles/network/README.html
/usr/share/doc/rhel-system-roles/network/README.md
/usr/share/doc/rhel-system-roles/network/example-bond-with-vlan-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-bridge-with-vlan-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-down-profile-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-eth-simple-auto-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-eth-with-vlan-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-infiniband-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-inventory
/usr/share/doc/rhel-system-roles/network/example-macvlan-playbook.yml
/usr/share/doc/rhel-system-roles/network/example-remove-profile-playbook.yml
/usr/share/doc/rhel-system-roles/postfix/COPYING
/usr/share/doc/rhel-system-roles/postfix/README.html
/usr/share/doc/rhel-system-roles/postfix/README.md
/usr/share/doc/rhel-system-roles/selinux/COPYING
/usr/share/doc/rhel-system-roles/selinux/README.html
/usr/share/doc/rhel-system-roles/selinux/README.md
/usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml
/usr/share/doc/rhel-system-roles/timesync/COPYING
/usr/share/doc/rhel-system-roles/timesync/README.html
/usr/share/doc/rhel-system-roles/timesync/README.md
/usr/share/doc/rhel-system-roles/timesync/example-timesync-playbook.yml
/usr/share/doc/rhel-system-roles/timesync/example-timesync-pool-playbook.yml


-----
ansible.cfg:

1. with a maximum timeout of 10 seconds. This
   
2. # option lets you increase or decrease that
   
3. # timeout to something more suitable for the
   
4. # environment.
   
5. # gather_timeout = 10
   
6. 
   
7. # Ansible facts are available inside the ansible_facts.* dictionary
   
8. # namespace. This setting maintains the behaviour which was the default prior
   
9. # to 2.5, duplicating these variables into the main namespace, each with a
   
10. # prefix of 'ansible_'.
    
11. # This variable is set to True by default for backwards compatibility. It
    
12. # will be changed to a default of 'False' in a future release.
    
13. # ansible_facts.
    
14. # inject_facts_as_vars = True
    
15. 
    
16. # additional paths to search for roles in, colon separated
    
17. roles_path    = ./roles:/usr/share/ansible/roles:/etc/ansible/roles
    

复制代码

1. ---
   
2. - name: Time Synchronization Play
   
3.   hosts: srvgroup
   
4.   roles:
   
5.     - rhel-system-roles.timesync
   

复制代码

1. ---
   
2. - name: Time Synchronization Play
   
3.   hosts: srvgroup
   
4.   vars:
   
5.     timesync_ntp_provider: chrony
   
6.     timesync_ntp_servers:
   
7.       - hostname: classroom.example.com
   
8.         iburst: yes
   
9.     v_timezone: America/Toronto
   
10. 
    
11.   roles:
    
12.     - rhel-system-roles.timesync
    
13. 
    
14.   tasks:
    
15.   - name: Set Timezone
    
16.     timezone:
    
17.       name: "{{ v_timezone }}"
    

复制代码

1. ---
   
2. - hosts: srvgroup
   
3.   vars:
   
4.     selinux_policy: targeted
   
5.     selinux_state: enforcing
   
6.     selinux_booleans:
   
7.       - { name: 'samba_enable_home_dirs', state: 'on' }
   
8.       - { name: 'ssh_sysadm_login', state: 'on', persistent: 'yes' }
   
9.     selinux_fcontexts:
   
10.       - { target: '/tmp/test_dir(/.*)?', setype: 'user_home_dir_t', ftype: 'd' }
    
11.     selinux_restore_dirs:
    
12.       - /tmp/test_dir
    
13.     selinux_ports:
    
14.       - { ports: '22100', proto: 'tcp', setype: 'ssh_port_t', state: 'present' }
    
15.     selinux_logins:
    
16.       - { login: 'sar-user', seuser: 'staff_u', serange: 's0-s0:c0.c1023', state: 'present' }
    
17. 
    
18.   # prepare prerequisites which are used in this playbook
    
19.   tasks:
    
20.     - name: Creates directory
    
21.       file:
    
22.         path: /tmp/test_dir
    
23.         state: directory
    
24.     - name: Add a Linux System Roles SELinux User
    
25.       user:
    
26.         comment: Linux System Roles SELinux User
    
27.         name: sar-user
    
28.     - name: execute the role and catch errors
    
29.       block:
    
30.         - include_role:
    
31.             name: rhel-system-roles.selinux
    
32.       rescue:
    
33.         # Fail if failed for a different reason than selinux_reboot_required.
    
34.         - name: handle errors
    
35.           fail:
    
36.             msg: "role failed"
    
37.           when: not selinux_reboot_required
    
38. 
    
39.         - name: restart managed host
    
40.           shell: sleep 2 && shutdown -r now "Ansible updates triggered"
    
41.           async: 1
    
42.           poll: 0
    
43.           ignore_errors: true
    
44. 
    
45.         - name: wait for managed host to come back
    
46.           wait_for_connection:
    
47.             delay: 10
    
48.             timeout: 300
    
49. 
    
50.         - name: reapply the role
    
51.           include_role:
    
52.             name: rhel-system-roles.selinux
    

复制代码

简化：

1. ---
   
2. - name: Selinux Role
   
3.   hosts: srvgroup
   
4.   tasks:
   
5. 
   
6.   - name: execute the role and catch errors
   
7.     block:
   
8.     - include_role:
   
9.         name: rhel-system-roles.selinux
   
10. 
    
11.     rescue:
    
12.     # Fail if failed for a different reason than selinux_reboot_required.
    
13.     - name: handle errors
    
14.       fail:
    
15.         when: not selinux_reboot_required
    
16. 
    
17.     - name: Restart the Machines
    
18.       reboot:
    
19. 
    
20.     - name: reapply the role
    
21.       include_role:
    
22.         name: rhel-system-roles.selinux
    

复制代码

1. ---
   
2. - name: SELinux Testing
   
3.   hosts: server3.example.com
   
4.   tasks:
   
5.   - name: SELinux State
   
6.     selinux:
   
7.       policy: targeted
   
8.       state: enforcing
   
9. 
   
10.   - name: SEbool
    
11.     seboolean:
    
12.       name: httpd_enable_homedirs
    
13.       state: yes
    
14.       persistent: yes
    
15. 
    
16.   - name: Create File
    
17.     copy:
    
18.       content: "Hello World"
    
19.       dest: /srv/helloworld.txt
    
20. 
    
21.   - name: test
    
22.     sefcontext:
    
23.       target: /srv/helloworld.txt
    
24.       setype: samba_share_t
    
25.       state: present
    
26. 
    
27.   - name: Apply new SELinux file context to filesystem
    
28.     command: restorecon -irv /srv/helloworld.txt
    
29. 
    
30.   - name: Set Port
    
31.     seport:
    
32.       ports: 8888
    
33.       proto: tcp
    
34.       setype: http_port_t
    
35.       state: present
    

复制代码