RHCE 9版本考试要求
01.安装和配置 Ansible
安装和配置 Ansible
按照下?所述，在控制节点 control上安装和配置 Ansible：
解题方法：
[虚拟机：foundation]
# 使用greg用户远程登陆到control
[kiosk@foundation0 -]$ ssh greg@control
[虚拟机：172.25.250.254|control]
# 安装ansible
[greg@control ~]$ sudo yum -y install ansible-core ansible-navigator
# 创建文件夹
[greg@control ~]$ mkdir -p /home/greg/ansible/roles
# 切换工作目录
[greg@control ~]$ cd /home/greg/ansible
# 生成ansible.cfg配置?件
[greg@control ansible]$ ansible-config init --disabled > /home/greg/ansible/ansible.cfg
# 创建集合存储?录
[greg@control ansible]$ mkdir /home/greg/ansible/mycollection
# 编辑配置?件
[greg@control ansible]$ vim ansible.cfg
[defaults]
inventory = /home/greg/ansible/inventory
remote_user = greg
host_key_checking = False
roles_path = /home/greg/ansible/roles:/usr/share/ansible/roles
collections_path=./mycollection/:.ansible/collections:/usr/share/ansible/collections
[privilege_escalation]
become=True
# 确认生效的配置文件(必做操作)
[greg@control ansible]$ ansible --version
[greg@control ansible]$ ansible-galaxy list
# 创建 inventory 主机清单
[greg@control ansible]$ vim /home/greg/ansible/inventory
[dev]
node1
[test]
node2
[prod]
node3
node4
[balancers]
node5
[webservers:children]
prod
# 验证： 如果可以ping通所有节点，证明配置?件、账户、清单都没有问题。(必做操作)
[greg@control ansible]$ ansible-inventory --graph
[greg@control ansible]$ ansible all -m ping
#验证：此命令可以验证podman的登录、执行环境下载正确，查看集合。(必做操作，不做后影响后续题
目使用doc以及跑剧本)
[greg@control ansible]$ podman login utility.lab.example.com -u admin -p redhat
[greg@control ansible]$ ansible-navigator images
[greg@control ansible]$ ansible-navigator collections02.配置您的系统以使?默认存储库
配置您的系统以使用默认存储库
作为系统管理员，您需要在受管节点上安装软件。
请按照正?所述，创建?个名为/home/greg/ansible/yum_repo.yml ，在各个受管节点上安装 yum 存储库
存储库1：
存储库2：
解题方法：
[虚拟机：172.25.250.254|control]
# 确认各个受管节点all
[greg@control ansible]$ ansible-inventory --graph
# 查模块名称
[greg@control ansible]$ ansible-doc -l | grep yum
# 查模块?法。==/EX==，在?册中搜索 EXAMPLE 示例
[greg@control ansible]$ ansible-doc yum_repository
# 设置vim编辑器的缩进格式
[greg@control ansible]$ echo set nu ts=2 et cuc sw=2 autoindent > ~/.vimrc
# 编辑剧本
[greg@control ansible]$ vim /home/greg/ansible/yum_repo.yml
---
- name: create repository
hosts: all
tasks:
- name: add BaseOS repo
yum_repository:
name: EX294_BASE
description: "EX294 base software"
baseurl: http://content/rhel9.0/x86_64/dvd/BaseOS
gpgcheck: yes
gpgkey: http://content/rhel9.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
enabled: yes
- name: add AppStream repo
yum_repository:
name: EX294_STREAM
description: "EX294 stream software"
baseurl: http://content/rhel9.0/x86_64/dvd/AppStream
gpgcheck: yes
gpgkey: http://content/rhel9.0/x86_64/dvd/RPM-GPG-KEY-redhat-release
enabled: yes
# 运行剧本 (Ansible新的剧本运行方式，必须做第一题的44-47行命令)
[greg@control ansible]$ ansible-navigator run yum_repo.yml -m stdout
# 验证两个仓库（BaseOS, AppStream, 必做操作）
# 验证：验证所有节点，若软件安装完毕，证明配置成功。
[greg@control ansible]$ ansible all -a 'yum repoinfo'
[greg@control ansible]$ ansible all -a 'yum -y install ftp'
[greg@control ansible]$ ansible all -a 'rpm -q ftp'03.安装软件包
安装软件包
创建?个名为 /home/greg/ansible/packages.yml 的 playbook :
解题方法：
[虚拟机：172.25.250.254|control]
[greg@control ansible]$ ansible-doc -l | grep yum
[greg@control ansible]$ ansible-doc yum
[greg@control ansible]$ vim /home/greg/ansible/packages.yml
---
- name: install1
hosts: dev,test,prod
tasks:
- name: install packages
ansible.builtin.yum:
name: php,mariadb
state: present
- name: install2
hosts: dev
tasks:
- name: install group
ansible.builtin.yum:
name: "@RPM Development Tools"
state: present
- name: upgrade all packages
ansible.builtin.yum:
name: "*"
state: latest
# 验证：通过查看软件安装情况，确认题目正确。(必做操作)
[greg@control ansible]$ ansible-navigator run packages.yml -m stdout
[greg@control ansible]$ ansible dev,test,prod -a 'rpm -q php mariadb'
[greg@control ansible]$ ansible dev -a 'yum grouplist'
...
Installed Groups:
RPM Development Tools
[greg@control ansible]$ ansible dev -a 'yum update'
...
Nothing to do.04.使用 RHEL 系统角色
使? RHEL 系统??
安装 RHEL 系统??软件包，并创建符合以下条件的 playbook
/home/greg/ansible/selinux.yml ：
解题方法：
[虚拟机：172.25.250.254|control]
# 安装rhel-system-roles
[greg@control ansible]$ sudo yum -y install rhel-system-roles
[greg@control ansible]$ ansible-galaxy list
# 指定roles的位置
[greg@control ansible]$ vim ansible.cfg
...
# additional paths to search for roles in, `colon` separated
roles_path = /home/greg/ansible/roles:/usr/share/ansible/roles
# 查看角色
[greg@control ansible]$ ansible-galaxy list
# 复制现有实例文件，拿来使用
[greg@control ansible]$ cp /usr/share/doc/rhel-system-roles/selinux/exampleselinux-playbook.yml /home/greg/ansible/selinux.yml
[greg@control ansible]$ vim /home/greg/ansible/selinux.yml
删除操作 :23,30d :9,19d
---
- hosts: all
vars:
selinux_policy: targeted
selinux_state: enforcing
# prepare prerequisites which are used in this playbook
tasks:
- name: execute the role and catch errors
block:
- include_role:
name: rhel-system-roles.selinux
rescue:
# Fail if failed for a different reason than selinux_reboot_required.
- name: handle errors
fail:
msg: "role failed"
when: not selinux_reboot_required
- name: restart managed host
shell: sleep 2 && shutdown -r now "Ansible updates triggered"
async: 1
poll: 0
ignore_errors: true
- name: wait for managed host to come back
wait_for_connection:
delay: 10
timeout: 300
- name: reapply the role
include_role:
name: rhel-system-roles.selinux
# 使用rpm包安装的角色，还是用ansible-playbook执行
# 使用集合安装的角色，要用ansible-navigator执行
[greg@control ansible]$ ansible-playbook selinux.yml
# 验证：结果应为所有节点状态为Enforcing，
# 且配置?件/etc/selinux/config内为SELINUX=enforcing(必做操作)
[greg@control ansible]$ ansible all -m shell -a 'grep ^SELINUX=/etc/selinux/config; getenforce'
node2 | CHANGED | rc=0 >>
SELINUX=enforcing
Enforcing
node4 | CHANGED | rc=0 >>
SELINUX=enforcing
Enforcing
node5 | CHANGED | rc=0 >>
SELINUX=enforcing
Enforcing
node3 | CHANGED | rc=0 >>
SELINUX=enforcing
Enforcing
node1 | CHANGED | rc=0 >>
SELINUX=enforcing
Enforcing05.配置conllection
配置 conllection
解题方法：
[虚拟机：172.25.250.254|control]
[greg@control ansible]$ vim requirements.yml
---
collections:
- name: http://classroom/materials/redhat-insights-1.0.7.tar.gz
- name: http://classroom/materials/community-general-5.5.0.tar.gz
- name: http://classroom/materials/redhat-rhel_system_roles-1.19.3.tar.gz
[greg@control ansible]$ ansible-galaxy collection install -r requirements.yml -p /home/greg/ansible/mycollection
# 验证(必做)
[greg@control ansible]$ ansible-navigator collections
[greg@control ansible]$ ansible-navigator doc community.general.filesystem -m stdout06.使用 Ansible Galaxy 安装角色
使? Ansible Galaxy 安装角色
使? Ansible Galaxy 和要求?件 /home/greg/ansible/roles/requirements.yml 。从以下 URL 下载角色并安装到 /home/greg/ansible/roles ：
解题方法：
[虚拟机：172.25.250.254|control]
[greg@control ansible]$ vim /home/greg/ansible/roles/requirements.yml
---
- src: http://classroom/materials/haproxy.tar
name: balancer
- src: http://classroom/materials/phpinfo.tar
name: phpinfo
[greg@control ansible]$ ansible-galaxy install -r /home/greg/ansible/roles/requirements.yml
#验证：查看到两个??即可。(必做操作)
[greg@control ansible]$ ansible-galaxy list
# /home/greg/ansible/roles
...
- balancer, (unknown version)
- phpinfo, (unknown version)
...07.创建和使用角色
创建和使用角色
根据下列要求，在 /home/greg/ansible/roles 中创建名为 apache 的??：
创建?个名为 /home/greg/ansible/apache.yml 的 playbook：
解题方法：
[虚拟机：172.25.250.254|control]
[greg@control ansible]$ ansible-galaxy role init --init-path /home/greg/ansible/roles apache
[greg@control ansible]$ ansible-galaxy list
[greg@control ansible]$ vim roles/apache/tasks/main.yml
---
- name: Install Apache
ansible.builtin.yum:
name: httpd
state: latest
- name: Start httpd
ansible.builtin.systemd:
name: httpd
state: started
enabled: yes
- name: Start firewalld
ansible.builtin.systemd:
name: firewalld
state: started
enabled: yes
- name: Start apache
ansible.posix.firewalld:
# 注意防火墙中Apache服务名不是httpd
service: http
permanent: yes
state: enabled
immediate: yes
- template:
# path = roles/apache/templates/
src: index.html.j2
dest: /var/www/html/index.html
[greg@control ansible]$ vim roles/apache/templates/index.html.j2
Welcome to {{ ansible_nodename }} on {{ ansible_default_ipv4.address }}
[greg@control ansible]$ vim /home/greg/ansible/apache.yml
---
- name: webservers role
hosts: webservers
roles:
- apache
[greg@control ansible]$ ansible-navigator run apache.yml -m stdout
[greg@control ansible]$ ansible webservers --list-hosts
hosts (2):
node3
node4
[虚拟机：foundation]
# 验证(必做操作)
#验证：通过访问node3、4返回网页结果（可用命令行或浏览器），判断角色是否执行正常。
[kiosk@foundation0 -]$ curl http://node3
Welcome to node3.lab.example.com on 172.25.250.11
[kiosk@foundation0 -]$ curl http://node4
Welcome to node4.lab.example.com on 172.25.250.1208.从 Ansible Galaxy 使用角色
从 Ansible Galaxy 使用角色
根据下列要求，创建?个名为 /home/greg/ansible/roles.yml 的 playbook ：
解题方法：
[greg@control ansible]$ vim /home/greg/ansible/roles.yml
---
- name: Use role phpinfo
hosts: webservers
roles:
- phpinfo
- name: Use role balancer
hosts: balancers
roles:
- balancer
[greg@control ansible]$ ansible-navigator run roles.yml -m stdout09.创建和使用逻辑卷
创建和使用逻辑卷
创建?个名为 /home/greg/ansible/lv.yml 的 playbook ，它将在 所有受管节点 上运行以执行下列任务：
解题方法：
[greg@control ansible]$ ansible-navigator doc community.general.lvol -m stdout
[greg@control ansible]$ ansible-navigator doc community.general.filesystem -m stdout
[greg@control ansible]$ ansible-doc debug
[greg@control ansible]$ ansible-doc stat
[greg@control ansible]$ vim /home/greg/ansible/lv.yml
---
- name: Create LVM
hosts: all
tasks:
- block:
- name: lv 1500M
community.general.lvol:
vg: research
lv: data
size: 1500
- name: Create ext4
community.general.filesystem:
fstype: ext4
dev: /dev/research/data
rescue:
- name: Could not create lvm
ansible.builtin.debug:
msg: Could not create logical volume of that size
- name: lv 800M
community.general.lvol:
vg: research
lv: data
size: 800
- name: Create ext4
community.general.filesystem:
fstype: ext4
dev: /dev/research/data
when: ansible_lvm.vgs.research is defined
- debug:
msg: Volume group done not exist
when: ansible_lvm.vgs.research is not defined
[greg@control ansible]$ ansible-navigator run /home/greg/ansible/lv.yml -m stdout
# 观察ansible剧本执?过程，是否符合题意，结合blkid命令查询(必做操作)
[greg@control ansible]$ ansible all -m shell -a 'lvs'
[greg@control ansible]$ ansible all -m shell -a 'blkid /dev/research/data'10.生成主机文件
生成主机文件
该 playbook 运?后， dev 主机组中主机上的?件 /etc/myhosts 应针对每个受管主机包含??内容：
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.250.9 node1.lab.example.com node1
172.25.250.10 node2.lab.example.com node2
172.25.250.11 node3.lab.example.com node3
172.25.250.12 node4.lab.example.com node4
172.25.250.13 node5.lab.example.com node5注：清单主机名称的显示顺序不重要。
解题方法：
[greg@control ansible]$ ansible dev -m debug -a 'var=groups'
[greg@control ansible]$ ansible dev -m debug -a "var=groups['all']"
[greg@control ansible]$ wget http://classroom/materials/hosts.j2
[greg@control ansible]$ vim hosts.j2
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
{% for i in groups['all'] %}
{{ hostvars[i].ansible_facts.default_ipv4.address }} {{ hostvars[i].ansible_fact
{% endfor %}
[greg@control ansible]$ vim hosts.yml
---
- name: gen host file
hosts: all
tasks:
- name: Template a file to /etc/myhosts
template:
src: /home/greg/ansible/hosts.j2
dest: /etc/myhosts
when: inventory_hostname in groups.dev
[greg@control ansible]$ ansible-navigator run hosts.yml -m stdout
# 验证(必做操作)
[greg@control ansible]$ ansible dev -m shell -a 'cat /etc/myhosts'11.修改文件内容
修改文件内容
按照下?所述，创建?个名为 /home/greg/ansible/issue.yml 的 playbook ：
解题方法：
[greg@control ansible]$ ansible dev -m debug -a 'var=inventory_hostname'
[greg@control ansible]$ ansible dev -m debug -a 'var=groups'
[greg@control ansible]$ ansible dev -m debug -a 'var=groups.dev'
[greg@control ansible]$ ansible-doc copy
[greg@control ansible]$ ansible-doc stat
[greg@control ansible]$ vim /home/greg/ansible/issue.yml
---
- name: modify file
hosts: all
tasks:
- name: Content 1
ansible.builtin.copy:
content: 'Development'
dest: /etc/issue
when: inventory_hostname in groups.dev
- name: Content 2
ansible.builtin.copy:
content: 'Test'
dest: /etc/issue
when: inventory_hostname in groups.test
- name: Content 3
ansible.builtin.copy:
content: 'Production'
dest: /etc/issue
when: inventory_hostname in groups.prod
[greg@control ansible]$ ansible-navigator run issue.yml -m stdout
# 验证(必做操作)
[greg@control ansible]$ ansible dev -a 'cat /etc/issue'
[greg@control ansible]$ ansible test -a 'cat /etc/issue'
[greg@control ansible]$ ansible prod -a 'cat /etc/issue'12.创建 Web 内容目录
创建 Web 内容目录
按照下方所述，创建?个名为 /home/greg/ansible/webcontent.yml 的 playbook ：
解题方法：
[greg@control ansible]$ ansible-doc file
[greg@control ansible]$ ansible-doc copy
[greg@control ansible]$ ansible dev -a 'ls -ldZ /var/www/html'
-rw-r--r--. 1 root root system_u:object_r:`httpd_sys_content_t`:s0 11 Apr 14 07:11 /var/www/html
[greg@control ansible]$ vim /home/greg/ansible/webcontent.yml
---
- name: Create Web Directory
hosts: dev
roles:
- apache
tasks:
- name: Create directory
ansible.builtin.file:
path: /webdev
state: directory
group: webdev
mode: '2775'
- name: Create link
ansible.builtin.file:
src: /webdev
dest: /var/www/html/webdev
state: link
- name: Copy content
ansible.builtin.copy:
content: 'Development'
dest: /webdev/index.html
setype: httpd_sys_content_t
[greg@control ansible]$ ansible-navigator run webcontent.yml -m stdout13.生成硬件报告
生成硬件报告
创建?个名为 /home/greg/ansible/hwreport.yml 的 playbook ，它将在所有受管节点上?成含有以下 信息的输出?件 /root/hwreport.txt ：
您的 playbook 应当：
解题方法：
[greg@control ansible]$ ansible all -m setup | grep mem
[greg@control ansible]$ ansible all -m setup | grep bios
[greg@control ansible]$ ansible all -m setup -a 'filter=*device*'
[greg@control ansible]$ curl http://materials/hwreport.empty
[greg@control ansible]$ vim /home/greg/ansible/hwreport.yml
---
- name: Hardware report
hosts: all
tasks:
- name: Download hwreport
ansible.builtin.get_url:
url: http://materials/hwreport.empty
dest: /root/hwreport.txt
- name: Report 1
ansible.builtin.lineinfile:
path: /root/hwreport.txt
regexp: '^HOST='
line: HOST={{ inventory_hostname }}
- name: Report 2
ansible.builtin.lineinfile:
path: /root/hwreport.txt
regexp: '^MEMORY='
line: MEMORY={{ ansible_memtotal_mb }}
- name: Report 3
ansible.builtin.lineinfile:
path: /root/hwreport.txt
regexp: '^BIOS='
line: BIOS={{ ansible_bios_version }}
- name: Report 4
ansible.builtin.lineinfile:
path: /root/hwreport.txt
regexp: '^DISK_SIZE_VDA='
line: DISK_SIZE_VDA={{ ansible_devices.vda.size }}
- name: Report 5
ansible.builtin.lineinfile:
path: /root/hwreport.txt
regexp: '^DISK_SIZE_VDB='
line: DISK_SIZE_VDB={{ ansible_devices.vdb.size | default('NONE', true) }}
# 验证： 收集到的报告应和各个主机的事实对?结果?致即可，请自行核对。(必做操作)
[greg@control ansible]$ ansible-navigator run hwreport.yml -m stdout
[greg@control ansible]$ ansible all -a 'cat /root/hwreport.txt'14.创建密码库
创建密码库
按照下方所述，创建?个 Ansible 库来存储用户密码：
解题方法：
[greg@control ansible]$ vim ansible.cfg
...
vault_password_file = /home/greg/ansible/secret.txt
[greg@control ansible]$ echo whenyouwishuponastar > /home/greg/ansible/secret.txt
[greg@control ansible]$ ansible-vault create /home/greg/ansible/locker.yml
---
pw_developer: Imadev
pw_manager: Imamgr
[greg@control ansible]$ ansible-vault view /home/greg/ansible/locker.yml
---
pw_developer: Imadev
pw_manager: Imamgr
#验证：根据推荐指令验证到文件内容被加密，且可以通过配置?件secret.txt?件?动解密即可。
(必做操作)
[greg@control ansible]$ cat /home/greg/ansible/locker.yml
$ANSIBLE_VAULT;1.1;AES256
3863666662376132653636383666306664633665636166366465323533396130663431393932663
1
3038366162383733643633383935663431376163646639350a39343666356636663130306465393
3
6337303063633334336262313065363336363033646164626236323964333535346665353464313
5
6162383733353561640a38333362313764656566663636306434336134653739663365323430626
3
3332613836613538343064376365393166373865663339393334346661623533363138343137313
5
66616130376332376138373134313837316665373061393234315.创建?户帐户
创建用户帐户
解题方法：
[greg@control ansible]$ wget http://classroom/materials/user_list.yml
[greg@control ansible]$ cat user_list.yml
[greg@control ansible]$ vim /home/greg/ansible/users.yml
---
- name: Create User1
hosts: dev,test
vars_files:
- /home/greg/ansible/locker.yml
- /home/greg/ansible/user_list.yml
tasks:
- name: Add group1
group:
name: devops
state: present
- name: Add user1
user:
name: "{{ item.name }}"
groups: devops
password: "{{ pw_developer | password_hash('sha512') }}"
password_expire_max: "{{ item.password_expire_max }}"
loop: "{{ users }}"
when: item.job == 'developer'
- name: Create User2
hosts: prod
vars_files:
- /home/greg/ansible/locker.yml
- /home/greg/ansible/user_list.yml
tasks:
- name: Add group2
group:
name: opsmgr
state: present
- name: Add user2
user:
name: "{{ item.name }}"
groups: opsmgr
password: "{{ pw_manager | password_hash('sha512') }}"
password_expire_max: "{{ item.password_expire_max }}"
loop: "{{ users }}"
when: item.job == 'manager'
[greg@control ansible]$ ansible-navigator run users.yml -m stdout
# 验证： 确保 dev，test 上有bob、fred 且与题目要求?致(必做操作)
# 确保 pord(node3 node4) 上有 sally 且与题目要求?致(必做操作)
[greg@control ansible]$ ansible dev,test -m shell -a 'id bob; id sally; id fred'
[greg@control ansible]$ ansible prod -m shell -a 'id fred; id bob; id sally'
[greg@control ansible]$ ssh bob@172.25.250.9
bob@172.25.250.9\'s password: `Imadev`
<Ctrl-D>
[greg@control ansible]$ ssh sally@172.25.250.12
sally@172.25.250.12\'s password: `Imamgr`
<Ctrl-D>16.更新 Ansible 库的密钥
更新 Ansible 库的密钥
按照下?所述，更新现有 Ansible 库的密钥：
解题方法：
[greg@control ansible]$ wget http://classroom/materials/salaries.yml
[greg@control ansible]$ ansible-vault rekey --ask-vault-pass salaries.yml
Vault password: `insecure8sure`
New Vault password: `bbs2you9527`
Confirm New Vault password: `bbs2you9527`
Rekey successful
[greg@control ansible]$ ansible-vault view salaries.yml
Vault password: `bbs2you9527`
haha
# 验证： ?新密码验证是否可以解密查看内容。(必做操作)
[greg@control ansible]$ ansible-vault view --ask-vault-pass salaries.yml
Vault password: `bbs2you9527`
haha17.配置 cron 作业
配置 cron 作业
创建?个名为 /home/greg/ansible/cron.yml 的 playbook :
解题方法：
[greg@control ansible]$ ansible-doc -l | grep cron
[greg@control ansible]$ ansible-doc cron
[greg@control ansible]$ vim /home/greg/ansible/cron.yml
---
- name: cron
hosts: test
tasks:
- name: cron job
cron:
name: "cron job1"
minute: "*/2"
job: 'logger "EX200 in progress"'
user: natasha
[greg@control ansible]$ ansible-navigator run cron.yml -m stdout
# 验证：通过crontab -l -u natasha命令验证任务是否存在并正确。(必做操作)
[greg@control ansible]$ ansible test -a 'crontab -l -u natasha'
node2 | CHANGED | rc=0 >>
#Ansible: check dirs
*/2 * * * * logger "EX200 in progress"