寫在前面
- 使用過濾器檢查、驗(yàn)證和操作包含網(wǎng)絡(luò)信息的變量
- 理解不足小伙伴幫忙指正
傍晚時(shí)分，你坐在屋檐下，看著天慢慢地黑下去，心里寂寞而凄涼，感到自己的生命被剝奪了。當(dāng)時(shí)我是個(gè)年輕人，但我害怕這樣生活下去，衰老下去。在我看來，這是比死亡更可怕的事。--------王小波
收集和處理網(wǎng)絡(luò)信息
標(biāo)準(zhǔn) setup 模塊可在多個(gè) play 開頭自動(dòng)收集事實(shí)，從每個(gè)受管主機(jī)上收集大量與網(wǎng)絡(luò)相關(guān)的信息。
常用的網(wǎng)絡(luò)事實(shí)：
- ansible_facts[‘dns’][‘nameservers’]
- ansible_facts[‘domain’]
- ansible_facts[‘a(chǎn)ll_ipv4_addresses’]
- ansible_facts[‘a(chǎn)ll_ipv6_addresses’]
- ansible_facts[‘fqdn’]
- ansible_facts[‘hostname’]
查看所有清單主機(jī)的完全限定名
---
- name: net_work
hosts: all
tasks:
- name: print
debug:
msg: "{{ ansible_facts['fqdn'] }}"
$
執(zhí)行測(cè)試
$ ansible-playbook network.yaml
.........
TASK [print] ***************************************************************************************************************
ok: [servera] => {
"msg": "servera.lab.example.com"
}
ok: [serverb] => {
"msg": "serverb.lab.example.com"
}
ok: [serverc] => {
"msg": "serverc.lab.example.com"
}
ok: [serverd] => {
"msg": "serverd.lab.example.com"
}
ok: [servere] => {
"msg": "servere.lab.example.com"
}
ok: [serverf] => {
"msg": "serverf.lab.example.com"
}
網(wǎng)絡(luò)信息過濾器
ipaddr 過濾器可用于處理和驗(yàn)證網(wǎng)絡(luò)相關(guān)的事實(shí)：
- 檢查IP地址的語(yǔ)法
- 轉(zhuǎn)換VLSN子網(wǎng)掩碼為CIDR子網(wǎng)
- 執(zhí)行子網(wǎng)數(shù)學(xué)運(yùn)算
- 在網(wǎng)絡(luò)范圍內(nèi)找到下一個(gè)可用地址
使用要求：RHEL8系統(tǒng)使用ipaddr過濾器需要安裝 python3-netaddr 軟件包，該包提供Python模塊netaddr。
[student@workstation laomalS sudo yum install -y python3-netaddr
ipaddr 過濾器提供了操作和驗(yàn)證與網(wǎng)絡(luò)相關(guān)的事實(shí)功能。
可以用于檢查 IP 地址的語(yǔ)法，從 VLSN 子網(wǎng)掩碼轉(zhuǎn)換為 CIDR 子網(wǎng)前綴表示法，執(zhí)行子網(wǎng)計(jì)算，查找網(wǎng)絡(luò)范圍內(nèi)的下一個(gè)可用地址等。
在最簡(jiǎn)單的形式中，不帶參數(shù)的 ipaddr 過濾器接受單個(gè)值。如果值是 IP 地址，則過濾器返回 IP 地址，如果不是IP 地址，則過濾器將返回 False。
- 如果該值為有效的P地址，則過濾器將返回地址。
- 如果該值不是有效的IP地址，則過濾器返回False。
$ ansible servera -m debug -a 'msg={{ "175.25.250.50" | ipaddr}}'
servera | SUCCESS => {
"msg": "175.25.250.50"
}
$ ansible servera -m debug -a 'msg={{ "175.25.250.50/24" | ipaddr}}'
servera | SUCCESS => {
"msg": "175.25.250.50/24"
}
$ ansible servera -m debug -a 'msg={{ "175.25.250.500/24" | ipaddr}}'
servera | SUCCESS => {
"msg": false
}
ipaddr過濾器接受參數(shù)值：
- 如果該值包涵有效的IP地址，則返回有效的IP地址。
- 如果所有項(xiàng)目均無效，則返回一個(gè)空列表。
$ ansible servera -m debug -a 'msg={{ "175.25.250.50/24" | ipaddr("netmask")}}'
servera | SUCCESS => {
"msg": "255.255.255.0"
}
$
- ipaddr 過濾器接受以下選項(xiàng)：
- address：驗(yàn)證輸入值是否為有效的 IP 地址，如果輸入中包含網(wǎng)絡(luò)前綴，其會(huì)被剝離。
- net：驗(yàn)證輸入值是否為網(wǎng)絡(luò)范圍，并以 CIDR 格式返回。
- host：確保 IP 地址符合等效的 CIDR 前綴格式。
- prefix：驗(yàn)證輸入主機(jī)是否滿足主機(jī)/前綴或 CIDR 格式，并返回前綴。
- host/prefix：驗(yàn)證輸入是否為網(wǎng)絡(luò)/前綴格式。
- public 或 private：驗(yàn)證輸入 IP 地址或網(wǎng)絡(luò)范圍是否由 IANA 分別預(yù)留為公共或私有的范圍內(nèi)。
- size：將輸入網(wǎng)絡(luò)范圍轉(zhuǎn)換為該范圍內(nèi)的 IP 地址數(shù)。
- n：任何整數(shù)。將網(wǎng)絡(luò)范圍轉(zhuǎn)換為該范圍內(nèi)的第 N 個(gè)元素。負(fù)數(shù)返回從最后一個(gè)數(shù)的第 n 個(gè)元素。
- network、netmask、broadcast：驗(yàn)證輸入主機(jī)是否滿足主機(jī)/前綴或CIDR格式，并將其分別轉(zhuǎn)換為網(wǎng)絡(luò)地址、子網(wǎng)掩碼或廣播地址。
- subnet：驗(yàn)證輸入主機(jī)是否滿足主機(jī)/前綴或 CIDR 格式，并返回包含該主機(jī)的子網(wǎng)。
- ipv4 ipv6：驗(yàn)證輸入是否有效的網(wǎng)絡(luò)范圍，并將它們分別轉(zhuǎn)換為 ipv4 和 ipv6 格式。
$ ansible servera -m debug -a 'msg={{ "175.25.250.50/24" | ipaddr("ipv6")}}'
servera | SUCCESS => {
"msg": "::ffff:175.25.250.50/120"
}
$ ansible servera -m debug -a 'msg={{ "175.25.250.50/24" | ipaddr("subnet")}}'
servera | SUCCESS => {
"msg": "175.25.250.0/24"
}
$ ansible servera -m debug -a 'msg={{ "175.25.250.50/24" | ipaddr("size")}}'
servera | SUCCESS => {
"msg": "256"
}
使用插件收集網(wǎng)絡(luò)信息
查找 DNS 信息
dig 命令針對(duì) DNS 服務(wù)進(jìn)行查詢，并返回生成的記錄。dig 需要在控制節(jié)點(diǎn)上安裝 python3-dns 軟件包。
$ ansible servera -m debug -a 'msg={{ lookup("dig","servera.lab.example.com")}}'
servera | SUCCESS => {
"msg": "172.25.250.10"
}
$ ansible servera -m debug -a 'msg={{ lookup("dig","example.com")}}'
servera | SUCCESS => {
"msg": "172.25.254.254"
}
$ ansible servera -m debug -a 'msg={{ lookup("dig","com")}}'
servera | SUCCESS => {
"msg": "NXDOMAIN"
}
dig 查找 DNS 服務(wù)器中是否存在提供 FQDN 的 A 記錄：文章來源：http://www.zghlxwxcb.cn/news/detail-617750.html
$ ansible servera -m debug -a 'msg={{ lookup("dig","example.com", "qtype=A")}}'
servera | SUCCESS => {
"msg": "10 classroom.example.com."
}
$ ansible servera -m debug -a 'msg={{ lookup("dig","example.com", "@")}}'
servera | SUCCESS => {
"msg": "172.25.254.254"
}
一個(gè) Demo
[student@workstation netfilters]$ cat ./tasks/main.yml
# Complete each task by setting the fact as the expected value.
# Replace ellipsis by the appropriate filter usage.
# All task but the last one should be using the 'ipaddr' filter.
# Use the lookup filter with the `dig` command for the last task
# Tasks make use of th gathered fact 'default_ipv4', and its keys 'address', 'network' and 'netmask'
- name: Task 1- Verify the 'ansible_default_ipv4.addresss' provided address is correctly formatted.
set_fact:
server_address: "{{ ansible_facts.default_ipv4.address | ipaddr }}"
- name: Task 2- Check 'server_address' value
assert:
that: "server_address == ansible_facts.default_ipv4.address"
fail_msg: "'server_address' must be {{ ansible_facts.default_ipv4.address }}, but is {{ server_address }}"
- name: Task 3- Obtain the DNS name associated to the server IP address (reverse DNS)
set_fact:
address_dns: "{{ server_address | ipaddr('revdns') }}"
- name: Task 4- Check 'address_dns' value
assert:
that: "address_dns == '10.250.25.172.in-addr.arpa.'"
fail_msg: "'address_dns' must be '10.250.25.172.in-addr.arpa.', but is {{ address_dns }}"
- name: Task 5- Obtain server's network/netmask
set_fact:
net_mask: "{{ ansible_facts.default_ipv4.network }}/{{ ansible_facts.default_ipv4.netmask }}"
- name: Task 6- Check 'net_mask' value
assert:
that: "net_mask == '172.25.250.0/255.255.255.0'"
fail_msg: "'net_mask' must be '172.25.250.0/255.255.255.0', but is {{ net_mask }}"
- name: Task 7- Transform the network/netmask to the CIDR format
set_fact:
cidr: "{{ net_mask | ipaddr('net') }}"
- name: Task 8- Check 'cidr' value
assert:
that: "cidr == '172.25.250.0/24'"
fail_msg: "'cidr' must be '172.25.250.0/24', but is {{ cidr }}"
- name: Task 9- Verify the server address actualy belong to the network/mask
set_fact:
address_in_range: "{{ server_address | ipaddr(net_mask) }}"
- name: Task 10- Check 'address_in_range' value
assert:
that: "address_in_range == server_address"
fail_msg: "'address_in_range' must be {{ server_address }}, but is {{ address_in_range }}"
- name: Task 11- Obtain the broadcast address associated to the CIDR
set_fact:
broadcast: "{{ cidr | ipaddr('broadcast') }}"
- name: Task 12- Check 'broadcast' value
assert:
that: "broadcast == '172.25.250.255'"
fail_msg: "'broadcast' must be '172.25.250.255', but is {{ broadcast }}"
- name: Task 13- DIG for the MX record of the domain 'example.com'
set_fact:
dig_record: "{{ lookup( 'dig', 'example.com.', 'qtype=MX') }}"
- name: Task 14- Check 'dig_record' value
assert:
that: "dig_record == '10 classroom.example.com.'"
fail_msg: "'dig_record' must be '10 classroom.example.com.', but is '{{ dig_record }}'"
[student@workstation data-netfilters]$ ansible-playbook site.yml
PLAY [Tasks for netfilter guided exercise] *****************************************************************************
TASK [Gathering Facts] *************************************************************************************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 1- Verify the 'ansible_default_ipv4.addresss' provided address is correctly formatted.] ********
ok: [servera.lab.example.com]
TASK [netfilters : Task 2- Check 'server_address' value] ***************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 3- Obtain the DNS name associated to the server IP address (reverse DNS)] **********************
ok: [servera.lab.example.com]
TASK [netfilters : Task 4- Check 'address_dns' value] ******************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 5- Obtain server's network/netmask] ************************************************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 6- Check 'net_mask' value] *********************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 7- Transform the network/netmask to the CIDR format] *******************************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 8- Check 'cidr' value] *************************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 9- Verify the server address actualy belong to the network/mask] *******************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 10- Check 'address_in_range' value] ************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 11- Obtain the broadcast address associated to the CIDR] ***************************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 12- Check 'broadcast' value] *******************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
TASK [netfilters : Task 13- DIG for the MX record of the domain 'example.com'] *****************************************
ok: [servera.lab.example.com]
TASK [netfilters : Task 14- Check 'dig_record' value] ******************************************************************
ok: [servera.lab.example.com] => {
"changed": false,
"msg": "All assertions passed"
}
PLAY RECAP *************************************************************************************************************
servera.lab.example.com : ok=15 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[student@workstation data-netfilters]$ cat site.yml
- name: Tasks for netfilter guided exercise
hosts: servera.lab.example.com
roles:
- role: netfilters
[student@workstation data-netfilters]$
博文參考
《DO447》文章來源地址http://www.zghlxwxcb.cn/news/detail-617750.html
到了這里，關(guān)于Ansible最佳實(shí)踐之Playbook使用過濾器處理網(wǎng)絡(luò)地址的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
