Ansible 面试题

# inventory 连接配置示例
[webservers]
web1 ansible_host=192.168.1.10 ansible_user=deploy ansible_ssh_private_key_file=/path/to/key
web2 ansible_host=192.168.1.11 ansible_connection=winrm ansible_winrm_transport=credssp

# INI 格式示例
[web]
web1 ansible_host=10.0.0.1
web2 ansible_host=10.0.0.2

[db]
db1 ansible_host=10.0.0.10

[all:vars]
ansible_user=admin
ansible_ssh_private_key_file=/home/admin/.ssh/id_rsa

# YAML 格式示例
all:
  children:
    web:
      hosts:
        web1:
          ansible_host: 10.0.0.1
    db:
      hosts:
        db1:
          ansible_host: 10.0.0.10
  vars:
    ansible_user: admin

# aws_ec2.yml 动态 inventory 插件配置
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
filters:
  tag:Environment: production
hostnames:
  - ip-address
keyed_groups:
  - prefix: tag
    key: tags.Name

- name: Deploy web application
  hosts: webservers
  become: yes
  vars:
    app_port: 8080
  tasks:
    - name: Install Nginx
      ansible.builtin.yum:
        name: nginx
        state: present
    - name: Deploy config file
      ansible.builtin.template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
      notify: restart nginx
  handlers:
    - name: restart nginx
      ansible.builtin.systemd:
        name: nginx
        state: restarted

- name: Check disk usage
  ansible.builtin.shell: df -h /
  register: disk_result

- name: Show disk info
  ansible.builtin.debug:
    msg: "XQOPEN disk_result.stdout_lines XQCLOSE"

# ansible.cfg
[defaults]
gathering = smart
fact_caching = jsonfile
fact_caching_connection = /tmp/ansible_facts
fact_caching_timeout = 3600

# nginx.conf.j2
server {
    listen XQOPEN http_port | default(80) XQCLOSE;
    server_name XQOPEN server_name XQCLOSE;

    location / {
        proxy_pass http://XQOPEN upstream_host XQCLOSE:XQOPEN upstream_port XQCLOSE;
        {% if enable_cache %}
        proxy_cache my_cache;
        proxy_cache_valid 200 1h;
        {% endif %}
    }
}

- name: Render and deploy template
  ansible.builtin.template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
    owner: root
    group: root
    mode: '0644'
  notify: reload nginx

roles/
  common/
    defaults/     # 默认变量（最低优先级）
      main.yml
    vars/         # 内部变量（高优先级）
      main.yml
    tasks/        # 主任务列表
      main.yml
    handlers/     # 通知处理器
      main.yml
    templates/    # Jinja2 模板文件
    files/        # 静态文件
    meta/         # 依赖关系和元数据
      main.yml

# playbook.yml
- hosts: webservers
  roles:
    - role: nginx
      vars:
        http_port: 8080
    - role: common

# 安装角色
ansible-galaxy role install geerlingguy.nginx

# 创建角色骨架
ansible-galaxy role init my_custom_role

# requirements.yml 管理依赖
ansible-galaxy role install -r requirements.yml

# requirements.yml
roles:
  - src: geerlingguy.nginx
    version: 3.1.0
  - src: https://github.com/user/repo.git
    name: custom_role
    version: v1.2

# meta/main.yml
dependencies:
  - role: common
  - role: geerlingguy.docker

- name: Install Apache on RedHat
  ansible.builtin.yum:
    name: httpd
    state: present
  when: ansible_os_family == "RedHat"

- name: Install Apache on Debian
  ansible.builtin.apt:
    name: apache2
    state: present
  when: ansible_os_family == "Debian"

- name: Restart service on configuration change
  ansible.builtin.systemd:
    name: myapp
    state: restarted
  when:
    - config_changed
    - ansible_distribution_version is version('7', '>=')

# 列表循环
- name: Create multiple users
  ansible.builtin.user:
    name: "XQOPEN item XQCLOSE"
    state: present
  loop:
    - alice
    - bob
    - charlie

# 字典循环
- name: Configure services
  ansible.builtin.template:
    src: "XQOPEN item.key XQCLOSE.conf.j2"
    dest: "/etc/XQOPEN item.key XQCLOSE/XQOPEN item.key XQCLOSE.conf"
  loop: "XQOPEN lookup('dict', services) XQCLOSE"
  vars:
    services:
      nginx: { port: 80 }
      redis: { port: 6379 }

# 带索引的循环
- name: List items with index
  ansible.builtin.debug:
    msg: "Index XQOPEN ansible_loop.index XQCLOSE: XQOPEN item XQCLOSE"
  loop: "XQOPEN ['a', 'b', 'c'] XQCLOSE"

- name: Database deployment block
  block:
    - name: Create database
      community.mysql.mysql_db:
        name: myapp
        state: present

    - name: Create database user
      community.mysql.mysql_user:
        name: myapp_user
        password: "XQOPEN db_password XQCLOSE"
        priv: "myapp.*:ALL"

    - name: Import initial schema
      community.mysql.mysql_db:
        name: myapp
        state: import
        target: /tmp/schema.sql

  rescue:
    - name: Rollback - remove database on failure
      community.mysql.mysql_db:
        name: myapp
        state: absent

    - name: Notify failure
      ansible.builtin.debug:
        msg: "Database deployment failed, rollback executed"

  always:
    - name: Cleanup temp files
      ansible.builtin.file:
        path: /tmp/schema.sql
        state: absent

- name: Full application setup
  hosts: all

  tasks:
    - name: Install dependencies
      ansible.builtin.yum:
        name: "XQOPEN item XQCLOSE"
        state: present
      loop:
        - git
        - curl
      tags:
        - packages
        - dependencies

    - name: Configure firewall
      ansible.builtin.firewalld:
        port: "XQOPEN item XQCLOSE/tcp"
        permanent: yes
        state: enabled
      loop:
        - 80
        - 443
      tags:
        - firewall
        - security

    - name: Deploy application
      ansible.builtin.copy:
        src: app.tar.gz
        dest: /opt/
      tags:
        - deploy

# 仅执行 firewall 标签任务
ansible-playbook site.yml --tags firewall

# 跳过 packages 标签任务
ansible-playbook site.yml --skip-tags packages

# 列出所有标签
ansible-playbook site.yml --list-tags

# serial 策略配置
- name: Rolling update
  hosts: webservers
  serial:
    - 1      # 第一批 1 台
    - 2      # 第二批 2 台
    - 5      # 第三批 5 台
    - 100%   # 剩余全部
  tasks:
    - name: Update application
      ansible.builtin.service:
        name: myapp
        state: restarted

# 加密文件
ansible-vault encrypt credentials.yml

# 解密文件
ansible-vault decrypt credentials.yml

# 查看加密内容
ansible-vault view credentials.yml

# 编辑加密文件
ansible-vault edit credentials.yml

# 修改密码
ansible-vault rekey credentials.yml

# playbook.yml
- hosts: all
  vars_files:
    - credentials.yml
  tasks:
    - name: Create database user
      community.mysql.mysql_user:
        password: "XQOPEN db_master_password XQCLOSE"

# 交互式输入
ansible-playbook site.yml --ask-vault-pass

# 密码文件
ansible-playbook site.yml --vault-password-file /path/to/vault_pass

# 多 Vault ID 管理不同环境
ansible-vault encrypt --vault-id prod@prompt prod_secrets.yml
ansible-playbook site.yml --vault-id prod@/path/to/prod_pass

# callback_plugins/custom_notifier.py
from ansible.plugins.callback import CallbackBase

class CallbackModule(CallbackBase):
    CALLBACK_VERSION = 2.0
    CALLBACK_TYPE = 'notification'
    CALLBACK_NAME = 'custom_notifier'

    def v2_playbook_on_task_start(self, task, is_conditional):
        self._display.display(f"Starting task: {task.name}")

    def v2_runner_on_ok(self, result):
        self._display.display(f"Task succeeded: {result.task_name}")

    def v2_runner_on_failed(self, result, ignore_errors=False):
        self._display.display(f"Task failed: {result.task_name}")
        # 发送告警到外部系统

# aws_ec2.yml
plugin: amazon.aws.aws_ec2
regions:
  - ap-northeast-1
  - us-west-2
filters:
  instance-state-name: running
hostnames:
  - dns-name
  - private-dns-name
compose:
  ansible_host: private_ip_address
keyed_groups:
  - key: tags.Role
    prefix: role
  - key: placement.region
    prefix: region

# gcp_compute.yml
plugin: google.cloud.gcp_compute
projects:
  - my-project-id
auth_kind: serviceaccount
service_account_file: /path/to/sa-key.json
hostnames:
  - name
groups:
  - "XQOPEN gcp_labels | selectattr('key', 'equalto', 'env') | map(attribute='value') | first XQCLOSE"

# openstack.yml
plugin: openstack.cloud.openstack
available_now: true
expand_hostvars: true
fail_on_errors: true

# 安装
pip install ansible-lint

# 执行检查
ansible-lint playbook.yml

# 检查整个 Role
ansible-lint roles/my_role/

exclude_paths:
  - .cache/
  - .github/
skip_list:
  - yaml[line-length]
warn_list:
  - command-instead-of-module
mock_modules:
  - custom_module

#!/usr/bin/python
# -*- coding: utf-8 -*-

from ansible.module_utils.basic import AnsibleModule

DOCUMENTATION = r'''
module: my_deploy
short_description: Deploy application package
description:
  - Deploy specified version of application to remote host
options:
  version:
    description: Application version to deploy
    required: true
    type: str
  environment:
    description: Target environment
    choices: ['staging', 'production']
    default: staging
    type: str
'''

EXAMPLES = r'''
- name: Deploy app
  my_deploy:
    version: v2.1.0
    environment: production
'''

RETURN = r'''
deploy_path:
  description: Path where application is deployed
  returned: always
  type: str
'''

def run_module():
    module_args = dict(
        version=dict(type='str', required=True),
        environment=dict(type='str', default='staging',
                         choices=['staging', 'production']),
    )

    result = dict(
        changed=False,
        deploy_path='',
        message=''
    )

    module = AnsibleModule(
        argument_spec=module_args,
        supports_check_mode=True
    )

    version = module.params['version']
    env = module.params['environment']

    # 业务逻辑实现
    deploy_path = f"/opt/app/{env}/{version}"

    if module.check_mode:
        module.exit_json(changed=True)

    # 实际部署操作
    result['changed'] = True
    result['deploy_path'] = deploy_path
    result['message'] = f"Deployed version {version} to {env}"

    module.exit_json(**result)

def main():
    run_module()

if __name__ == '__main__':
    main()

# inventory 配置网络设备
[switches]
core-sw01 ansible_host=10.0.1.1
access-sw01 ansible_host=10.0.1.2

[switches:vars]
ansible_connection=ansible.netcommon.network_cli
ansible_network_os=cisco.ios.ios
ansible_user=admin
ansible_ssh_private_key_file=/path/to/ssh_key

- name: Configure VLAN
  hosts: switches
  gather_facts: no

  tasks:
    - name: Ensure VLAN 100 exists
      cisco.ios.ios_vlan:
        vlan_id: 100
        name: web_vlan
        state: present

    - name: Configure interface
      cisco.ios.ios_interface:
        name: GigabitEthernet0/1
        description: Web Server Connection
        mode: access
        access_vlan: 100

    - name: Backup running config
      cisco.ios.ios_config:
        backup: yes
        backup_options:
          dirname: /backup/network
          filename: "XQOPEN inventory_hostname XQCLOSE_XQOPEN ansible_date_time.date XQCLOSE.cfg"

# 在 Windows 主机上执行
Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "*"
New-SelfSignedCertificate -DnsName "$env:computername" -CertStoreLocation Cert:\LocalMachine\My
winrm set winrm/config/service/auth '@{Basic="true"}'
winrm set winrm/config/service '@{AllowUnencrypted="true"}'

# 单台 Windows 主机
win-server1:
  ansible_host: 192.168.1.50
  ansible_connection: winrm
  ansible_winrm_transport: credssp
  ansible_winrm_server_cert_validation: ignore
  ansible_user: Administrator
  ansible_password: "XQOPEN vault_win_password XQCLOSE"

- name: Install Windows Feature
  ansible.windows.win_feature:
    name: Web-Server
    state: present

- name: Create Windows User
  ansible.windows.win_user:
    name: svc_account
    password: "XQOPEN vault_svc_password XQCLOSE"
    groups:
      - Administrators

- name: Execute PowerShell Script
  ansible.windows.win_shell: |
    Get-Service | Where-Object {$_.Status -eq "Running"}    
  register: running_services

- name: Docker container management
  hosts: docker_hosts
  tasks:
    - name: Pull image
      community.docker.docker_image:
        name: nginx
        tag: latest
        source: pull

    - name: Ensure container is running
      community.docker.docker_container:
        name: web_server
        image: nginx:latest
        state: started
        restart_policy: always
        ports:
          - "80:80"
          - "443:443"
        volumes:
          - /data/www:/usr/share/nginx/html:ro
        env:
          NGINX_HOST: example.com
        networks:
          - name: web_network

    - name: Build image from Dockerfile
      community.docker.docker_image:
        name: myapp:XQOPEN version XQCLOSE
        build:
          path: /opt/myapp
          dockerfile: Dockerfile.prod
        source: build
        state: present

- name: Deploy stack with compose
  community.docker.docker_compose_v2:
    project_name: myapp
    definition:
      version: '3'
      services:
        app:
          image: myapp:latest
          ports:
            - "3000:3000"
        db:
          image: postgres:15
          environment:
            POSTGRES_PASSWORD: "XQOPEN db_password XQCLOSE"
    state: present

- name: Kubernetes resource management
  hosts: localhost
  tasks:
    - name: Create Namespace
      kubernetes.core.k8s:
        name: myapp
        api_version: v1
        kind: Namespace
        state: present

    - name: Deploy application
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: apps/v1
          kind: Deployment
          metadata:
            name: web
            namespace: myapp
          spec:
            replicas: 3
            selector:
              matchLabels:
                app: web
            template:
              metadata:
                labels:
                  app: web
              spec:
                containers:
                  - name: web
                    image: nginx:latest
                    ports:
                      - containerPort: 80

    - name: Create Service
      kubernetes.core.k8s:
        state: present
        definition:
          apiVersion: v1
          kind: Service
          metadata:
            name: web-svc
            namespace: myapp
          spec:
            selector:
              app: web
            ports:
              - port: 80
                targetPort: 80
            type: ClusterIP

# kubeconfig 认证
- name: Use kubeconfig
  kubernetes.core.k8s:
    kubeconfig: /home/admin/.kube/config
    context: prod-cluster
    ...

# inline token 认证
- name: Use token
  kubernetes.core.k8s:
    host: https://k8s-api.example.com:6443
    api_key: "XQOPEN vault_k8s_token XQCLOSE"
    validate_certs: yes
    ...

- name: Deploy via Helm
  kubernetes.core.helm:
    name: my-release
    chart_ref: stable/nginx-ingress
    release_namespace: ingress
    values:
      controller:
        replicaCount: 3

# ansible.cfg 优化配置
[ssh_connection]
pipelining = True
ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ControlPath=~/.ssh/ansible-%r@%h:%p
control_path = %(directory)s/%%C

[defaults]
gathering = smart
fact_caching = jsonfile
fact_caching_connection = /tmp/ansible_facts
fact_caching_timeout = 3600
forks = 20

# 忽略错误
- name: Ignore non-critical failure
  ansible.builtin.command: /opt/app/health_check.sh
  ignore_errors: yes

# 强制失败
- name: Force fail if critical condition not met
  ansible.builtin.fail:
    msg: "Critical service not running"
  when: service_status.rc != 0

# 自定义变更判定
- name: Execute migration
  ansible.builtin.shell: /opt/app/migrate.sh
  register: migrate_result
  changed_when: "'migration applied' in migrate_result.stdout"
  failed_when:
    - migrate_result.rc != 0
    - "'already up to date' not in migrate_result.stderr"

- name: Application upgrade with rollback
  block:
    - name: Backup current version
      ansible.builtin.archive:
        path: /opt/app/current
        dest: /opt/backup/app_XQOPEN ansible_date_time.epoch XQCLOSE.tar.gz

    - name: Deploy new version
      ansible.builtin.copy:
        src: "app_vXQOPEN new_version XQCLOSE.tar.gz"
        dest: /opt/app/
      notify: restart app

    - name: Verify deployment
      ansible.builtin.uri:
        url: http://localhost:8080/health
        status_code: 200
      register: health

  rescue:
    - name: Rollback - restore previous version
      ansible.builtin.unarchive:
        src: /opt/backup/app_XQOPEN backup_timestamp XQCLOSE.tar.gz
        dest: /opt/app/
        remote_src: yes
    - name: Notify rollback
      ansible.builtin.shell: |
        /usr/local/bin/alert.sh "Rollback executed for XQOPEN inventory_hostname XQCLOSE"        

- hosts: webservers
  max_fail_percentage: 25
  any_errors_fatal: true

ansible-infra/
  inventories/
    development/host_vars/  # 环境级变量分离
    production/host_vars/
    staging/group_vars/
  playbooks/
    site.yml
    deploy.yml
    backup.yml
  roles/         # 从 Galaxy 安装或自建
  library/       # 自定义 Module
  filter_plugins/
  ansible.cfg
  requirements.yml
  .ansible-lint

# GitLab CI 示例 .gitlab-ci.yml
stages:
  - lint
  - syntax-check
  - dry-run
  - deploy

ansible-lint:
  stage: lint
  script:
    - ansible-lint playbooks/*.yml

syntax-check:
  stage: syntax-check
  script:
    - ansible-playbook --syntax-check playbooks/deploy.yml -i inventories/staging/

dry-run:
  stage: dry-run
  script:
    - ansible-playbook playbooks/deploy.yml -i inventories/staging/ --check --diff
  environment: staging
  only:
    - merge_requests

deploy-production:
  stage: deploy
  script:
    - ansible-playbook playbooks/deploy.yml -i inventories/production/ --vault-password-file $VAULT_PASS_FILE
  environment: production
  when: manual
  only:
    - main

Terraform 创建基础设施（云资源/VPC/集群）
    |
    v
Ansible 配置操作系统与中间件（软件安装/配置/部署）
    |
    v
Terraform 更新基础设施时保留 Ansible 配置结果

- name: Drift detection report
  hosts: all
  tasks:
    - name: Capture current package state
      ansible.builtin.package_facts:
        manager: auto

    - name: Validate required packages
      ansible.builtin.assert:
        that:
          - "'nginx' in ansible_facts.packages"
          - "'openssl' in ansible_facts.packages"
        fail_msg: "Package drift detected on XQOPEN inventory_hostname XQCLOSE"
        success_msg: "Package state compliant"
      register: drift_check
      ignore_errors: yes

    - name: Log drift findings
      ansible.builtin.copy:
        content: |
          Host: XQOPEN inventory_hostname XQCLOSE
          Time: XQOPEN ansible_date_time.iso8601 XQCLOSE
          Drift: XQOPEN drift_check.failed XQCLOSE          
        dest: "/var/log/drift/XQOPEN inventory_hostname XQCLOSE.log"
      delegate_to: localhost

# 采集所有主机 Facts
ansible all -m setup --tree /tmp/facts/

# 生成 CMDB HTML 报告
ansible-cmdb /tmp/facts/ > cmdb.html

- hosts: all
  become: yes
  become_user: root
  become_method: sudo
  become_flags: '-H -S'
  tasks:
    - name: Install package
      ansible.builtin.yum:
        name: httpd
        state: present

- name: Run as application user
  ansible.builtin.command: /opt/app/control.sh status
  become: yes
  become_user: appuser
  become_method: su

# 使用 --ask-become-pass 交互式输入 sudo 密码
ansible-playbook site.yml --ask-become-pass

# 在 inventory 中配置(不推荐明文)
ansible_become_password: "XQOPEN vault_sudo_password XQCLOSE"

- name: Read sensitive data from Vault
  ansible.builtin.debug:
    msg: "XQOPEN lookup('hashi_vault', 'secret/data/myapp:token', url='https://vault.example.com') XQCLOSE"

- name: Use CSV data as variable source
  ansible.builtin.debug:
    msg: "XQOPEN lookup('csvfile', 'web1 file=hosts.csv delimiter=, col=1') XQCLOSE"

- name: Generate random password and store
  ansible.builtin.debug:
    msg: "XQOPEN lookup('password', '/tmp/passwords/{{ inventory_hostname XQCLOSE chars=ascii_letters,digits') }}"

# Python API 调用示例
import ansible_runner

r = ansible_runner.run(
    private_data_dir='/tmp/runner_project',
    playbook='deploy.yml',
    inventory='inventories/production',
    extravars={'version': 'v2.1.0'},
    verbosity=2
)

print(f"Status: {r.status}")
print(f"Return Code: {r.rc}")
for event in r.events:
    print(f"Event: {event['event']} - {event.get('stdout', '')}")

Status: successful
Return Code: 0
Event: playbook_on_start - 
Event: runner_on_ok - ok: [web1]
Event: runner_on_ok - ok: [web2]
Event: playbook_on_stats - 

- name: Rolling update with load balancer management
  hosts: webservers
  serial: 1

  tasks:
    - name: Remove server from LB pool
      ansible.builtin.shell: |
        curl -X POST -d '{"server":"XQOPEN inventory_hostname XQCLOSE","action":"disable"}' \
          http://lb-api.example.com/pool        
      delegate_to: localhost
      when: lb_enabled

    - name: Drain existing connections
      ansible.builtin.command: /opt/app/drain.sh
      become: yes

    - name: Update application
      ansible.builtin.copy:
        src: "/packages/app_XQOPEN version XQCLOSE.tar.gz"
        dest: /opt/app/
      notify: restart app

    - name: Add server back to LB pool
      ansible.builtin.uri:
        url: "http://lb-api.example.com/pool"
        method: POST
        body_format: json
        body:
          server: "XQOPEN inventory_hostname XQCLOSE"
          action: enable
      delegate_to: localhost

- name: Check all hosts for a process
  hosts: all
  tasks:
    - name: Store hostname where service runs
      ansible.builtin.shell: pgrep -x myservice && echo "XQOPEN inventory_hostname XQCLOSE"
      register: service_host

    - name: Show only the active host
      ansible.builtin.debug:
        msg: "Service is running on XQOPEN hostvars[item]['inventory_hostname'] XQCLOSE"
      loop: "XQOPEN groups['all'] XQCLOSE"
      when: hostvars[item].service_host.stdout == item
      run_once: true

- name: Certificate management
  hosts: all
  tasks:
    - name: Generate self-signed certificate
      community.crypto.x509_certificate:
        path: /etc/ssl/certs/server.crt
        privatekey_path: /etc/ssl/private/server.key
        provider: selfsigned
        subject:
          CN: "XQOPEN inventory_hostname XQCLOSE"
          O: MyOrganization
        force: false

    - name: Generate CSR
      community.crypto.x509_certificate:
        path: /etc/ssl/certs/server.csr
        privatekey_path: /etc/ssl/private/server.key
        provider: ownca
        ownca_path: /etc/ssl/ca/ca.crt
        ownca_privatekey_path: /etc/ssl/ca/ca.key
        subject:
          CN: "XQOPEN inventory_hostname XQCLOSE"

    - name: ACME certificate request (Let's Encrypt)
      community.crypto.acme_certificate:
        account_key_src: /etc/ssl/acme/account.key
        src: /etc/ssl/certs/server.csr
        cert: /etc/ssl/certs/server.crt
        challenge: http-01
        acme_directory: https://acme-v02.api.letsencrypt.org/directory
        terms_agreed: yes
      delegate_to: localhost

- name: Auto-renew Let's Encrypt certificates
  hosts: all
  vars:
    cert_domains:
      - example.com
      - www.example.com
  tasks:
    - name: Check certificate expiry
      community.crypto.x509_certificate_info:
        path: /etc/ssl/certs/server.crt
      register: cert_info

    - name: Renew if expiring within 30 days
      community.crypto.acme_certificate_renewal:
        src: /etc/ssl/certs/server.crt
      when:
        - cert_info.not_after is defined
        - cert_info.not_after < (ansible_date_time.epoch | int + 2592000)

    - name: Reload web server on renewal
      ansible.builtin.systemd:
        name: nginx
        state: reloaded
      when: cert_info.not_after is defined

管理平面分层
  Control Node (Ansible Runner)
      |
  +----+----+
  |         |
  Relay    Relay
  (IDC-A)  (IDC-B)
  |         |
  hosts     hosts

# ansible.cfg 规模化调优
[defaults]
forks = 50                    # 并行进程数，根据 Control Node CPU 核心调整
host_key_checking = False     # 跳过 SSH 主机密钥检查
timeout = 30                  # SSH 连接超时
gathering = smart             # 智能 Fact 采集
fact_caching = redis          # Redis 缓存 Facts
fact_caching_connection = localhost:6379:0
internal_poll_interval = 0.1  # 轮询间隔

[ssh_connection]
pipelining = True
ssh_args = -o ControlMaster=auto -o ControlPersist=120s -o ControlPath=~/.ssh/ansible-%r@%h:%p

# 受管节点定期执行
ansible-pull -U https://git.example.com/ansible-config.git \
  -i inventories/production \
  playbooks/site.yml \
  --accept-host-key

all:
  children:
    linux_servers:
      hosts:
        web1: {}
        web2: {}
      vars:
        ansible_connection: ssh
        ansible_user: admin
        ansible_python_interpreter: /usr/bin/python3

    windows_servers:
      hosts:
        win1:
          ansible_host: 10.0.0.100
      vars:
        ansible_connection: winrm
        ansible_winrm_transport: credssp
        ansible_shell_type: powershell

- name: Patch all servers
  hosts: all
  strategy: free

  tasks:
    - name: Update packages (Linux)
      ansible.builtin.yum:
        name: '*'
        state: latest
      when: ansible_system == "Linux"

    - name: Install Windows updates
      ansible.windows.win_updates:
        category_names:
          - SecurityUpdates
          - CriticalUpdates
        state: installed
      when: ansible_system == "Win32NT"
      register: update_result

    - name: Reboot Windows if required
      ansible.windows.win_reboot:
      when:
        - ansible_system == "Win32NT"
        - update_result.reboot_required

# 动态包含 - 根据条件加载不同任务文件
- name: Include platform-specific tasks
  ansible.builtin.include_tasks: "XQOPEN ansible_os_family XQCLOSE.yml"
  when: ansible_os_family == "RedHat"

# 静态导入 - 解析时展开
- name: Import common setup tasks
  ansible.builtin.import_tasks: setup.yml
  tags:
    - setup

# Import Playbook
- name: Import another playbook
  ansible.builtin.import_playbook: webserver.yml

- name: Filter plugin demonstrations
  hosts: localhost
  vars:
    ip_list:
      - "192.168.1.10"
      - "10.0.0.1"
      - "172.16.0.1"
    raw_data: '{"name": "test", "value": 42}'

  tasks:
    - name: JSON parse and combine
      ansible.builtin.debug:
        msg:
          parsed: "XQOPEN raw_data | from_json XQCLOSE"
          merged: "XQOPEN [{'extra':'info'}] | combine({'key':'value'}) XQCLOSE"

    - name: IP address calculations
      ansible.builtin.debug:
        msg:
          in_subnet: "XQOPEN '192.168.1.15' in ip_list XQCLOSE"
          network: "XQOPEN '192.168.1.0/24' | ansible.utils.network_in_use(ip_list) XQCLOSE"

    - name: Data manipulation
      ansible.builtin.debug:
        msg:
          unique: "XQOPEN [1, 2, 2, 3] | unique XQCLOSE"
          flattened: "XQOPEN [[1, 2], [3]] | flatten XQCLOSE"
          dict_to_list: "XQOPEN {'a':1, 'b':2} | dict2items XQCLOSE"

# filter_plugins/my_filters.py
class FilterModule(object):
    def filters(self):
        return {
            'to_upper_version': self.to_upper_version,
        }

    def to_upper_version(self, version):
        parts = version.split('-')
        if len(parts) > 1:
            return f"{parts[0]}-{parts[1].upper()}"
        return version.upper()

# ansible.cfg
[defaults]
log_path = /var/log/ansible/ansible.log

# callback_plugins/audit_log.py
import json
import datetime

class CallbackModule(CallbackBase):
    CALLBACK_VERSION = 2.0
    CALLBACK_TYPE = 'aggregate'
    CALLBACK_NAME = 'audit_log'

    def __init__(self):
        super().__init__()
        self.audit_events = []

    def v2_runner_on_ok(self, result):
        event = {
            'timestamp': datetime.datetime.utcnow().isoformat(),
            'host': result._host.name,
            'task': result.task_name,
            'status': 'ok',
            'changed': result.is_changed(),
        }
        self.audit_events.append(event)

    def v2_playbook_on_stats(self, stats):
        with open(f"/var/log/ansible/audit_{int(time.time())}.json", 'w') as f:
            json.dump(self.audit_events, f, indent=2)