Automatic operation and maintenance sharp weapon ansible Foundation

One 、ansible Introduction and installation

1、 Introduce

Ansible It's a IT Automation tools . It can configure the system 、 Deploy software 、 Choreograph more complex IT Mission , Such as continuous deployment or rolling updates with zero downtime .

Ansible use Python To write , Although there are many configuration management solutions available on the market （ for example Salt、Puppet、Chef etc. ), But they have their own advantages and disadvantages , and Ansible It is characterized by its simplicity . Give Way Ansible One thing that distinguishes the mainstream configuration management system is , It doesn't require you to install your own components on each node you want to configure . Another advantage provided at the same time , If necessary , You can control your entire infrastructure in more than one place .

2、 working principle

1. stay ANSIBLE In the management system , There is " The management node " and “ Managed nodes ” Two kinds of ⻆ color .

2. Managed nodes are often referred to as " assets "

3. On the management node ,Ansible take AdHoc or PlayBook Convert to Python Script . And pass SSH Will these Python The script is passed to the managed server . Execute... Successively on the managed server , And return the results to the management node in real time .

3、 How to install

3.1 precondition

The management node

• Ensure existence OpenSSH Make sure Python edition >= 2.6 Ensure installation ansible Qianfeng cloud computing College

Managed nodes

• Ensure existence OpenSSH Make sure Python edition >= 2.4 // if 2.4 edition , Make sure that... Is installed python-samplesjson Expansion does not require installation ansible

3.2 install ansible

[[email protected] ~]# yum -y install epel-release
[[email protected] ~]# yum -y install ansible

• View version

[[email protected] ~]# ansible --version
ansible 2.9.27
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.5 (default, Nov 16 2020, 22:23:17) [GCC 4.8.5 20150623 (Red Hat 4.8.5-44)]

Two 、 The management node and the managed node are established SSH Trust relationship

The management node （ansible） Create key pair in

[[email protected] ~]# ssh-keygen -t rsa

Transfer the local public key to the managed node

Each managed node needs to be managed in the delivery process ( Here is 192.168.75.130) Username ( Here is root) And password

[[email protected] ~]# ssh-copy-id [email protected]

verification , It means success if you can login without secret

[[email protected] ~]# ssh [email protected]
Last login: Wed Jun  8 23:35:41 2022 from 192.168.75.1
[[email protected] ~]# exit
logout
Connection to 192.168.75.130 closed.

3、 ... and 、 Quick start

1、 Asset information

#  The management node :192.168.75.129  Host name  ansible

#  Managed nodes ( assets ):
192.168.75.130
192.168.75.131 
#  And the nodes between the management node and the managed node have been connected  SSH  Trust relationship .

2、 Experiment 1

On the management node , Test network connectivity with all managed nodes .

[[email protected] ~]# ansible all -i 192.168.75.130,192.168.75.131 -m ping
192.168.75.130 | SUCCESS => {
    
    "ansible_facts": {
    
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}
192.168.75.131 | UNREACHABLE! => {
    
    "changed": false,
    "msg": "Failed to connect to the host via ssh: ssh: connect to host 192.168.75.131 port 22: No route to host",
    "unreachable": true
}

Be careful -i The parameter is followed by a list (List). Therefore, when it is a managed node , We must add an English comma after it (,), Tell yes List, If you don't add a comma, you will report an error

[[email protected] ~]# ansible all -i 192.168.75.130 -m ping
[WARNING]: Unable to parse /root/192.168.75.130 as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not
match 'all'
[[email protected] ~]# ansible all -i 192.168.75.130, -m ping
192.168.75.130 | SUCCESS => {
    
    "ansible_facts": {
    
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "ping": "pong"
}

3、 Experiment two

On the management node , Make sure the documents /tmp/nginx.conf Publish to all managed nodes

[[email protected] ~]# ansible all -i 192.168.75.130, -m copy -a "src=/tmp/nignx.conf dest=/tmp/nignx.conf"
192.168.75.130 | CHANGED => {
    
    "ansible_facts": {
    
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": true,
    "checksum": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "dest": "/tmp/nignx.conf",
    "gid": 0,
    "group": "root",
    "md5sum": "d41d8cd98f00b204e9800998ecf8427e",
    "mode": "0644",
    "owner": "root",
    "size": 0,
    "src": "/root/.ansible/tmp/ansible-tmp-1654703293.11-3498-29305731972284/source",
    "state": "file",
    "uid": 0
}

[[email protected] ~]# ll /tmp/nignx.conf
-rw-r--r-- 1 root root 0 Jun  8 23:48 /tmp/nignx.conf
[[email protected] ~]#

Explanation of option parameters

• all stay ansible in , Call it pattern , Match . I usually call it asset selector . Is matching assets (-i Parameter assignment ) Part of . there all Is to match all specified assets . It will be described in detail in the assets section below .
• -i Appoint Ansible The assets of the , That is, the managed server .
• -m Specify the module to run , Like here ping Module and copy modular
• -a Specify the parameters of the module , Here is the module ping No parameters specified . modular copy It specifies src and dest Parameters .

Four 、ansible assets

Ansible Assets are divided into static assets and dynamic assets , Dynamic assets will be explained in detail in the later high-level section .

1、 Static assets

As its name suggests, it is a text file , A format similar to INI The file of . By default ,Ansible Your asset file is located at /ect/ansible/hosts.pip The installation may not have this file , Just create one .

1.1 Custom assets

This file can be customized , Then use the corresponding parameters to specify .

Here is an example of a custom static asset , Then explain its meaning in detail .

[[email protected] ~]# cat /etc/ansible/hosts
# This is the default ansible 'hosts' file.
#
# It should live in /etc/ansible/hosts
#
# - Comments begin with the '#' character
# - Blank lines are ignored
# - Groups of hosts are delimited by [header] elements
# - You can enter hostnames or ip addresses
# - A hostname/ip can be a member of multiple groups

# Ex 1: Ungrouped hosts, specify before any group headers.

## green.example.com
## blue.example.com
## 192.168.100.1
## 192.168.100.10

1. Ansible In the asset file , We can use IP The form of address or host name exists .
2. Ansible If the assets are continuous , have access to [stat:end] To express .
3. Servers can be defined into groups according to business scenarios , such as dbdb_servers and web_servers
4. There can be inheritance relationships between groups , such as dbdb_servers and web_servers Simultaneous inheritance alldb_servers Group

1.2 How to use custom assets

adopt -i You can specify the location of user-defined assets with parameters ( It could be all the way , It could be a relative path ).

[[email protected] ~]# ansible all -i hosts

1.3 How to validate custom assets

If the asset we just defined is hosts

• List all assets

[[email protected] ~]# pwd;ll hosts
/root
-rw-r--r-- 1 root root 15 Jun  9 00:02 hosts
[[email protected] ~]# ansible all -i hosts --list-hosts
  hosts (1):
    192.168.75.130

• List the selected assets

For example, here are web_servers

[[email protected] ~]# ansible webserver -i hosts --list-hosts
  hosts (1):
    192.168.75.131

2.、 Asset selector

Sometimes the operator wants to operate on only a part of the server in the asset , Not all servers in the asset . You can use Ansible Asset selector for PATTERN. Now learn how to use asset selector , More flexible choice of servers you want to operate .

2.1 Basic grammar

ansible PATTERN -i inventory -m module -a argument

Choose one or more servers

[[email protected] ~]# ansible 192.168.75.131 -i hosts --list-hosts
  hosts (1):
    192.168.75.131
[[email protected] ~]# ansible 192.168.75.131,192.168.75.130 -i hosts --list-hosts
  hosts (2):
    192.168.75.131
    192.168.75.130
[[email protected] ~]#

Select a set of servers

[[email protected] ~]# ansible webserver -i hosts --list-hosts
  hosts (1):
    192.168.75.131

Use * matching

[[email protected] ~]# ansible 192.168.75.* -i hosts --list-hosts
  hosts (2):
    192.168.75.131
    192.168.75.130

Use logical matching

• webserver and db Union , All hosts in both groups

[[email protected] ~]# ansible 'webserver:db' -i hosts --list-hosts
  hosts (2):
    192.168.75.131
    192.168.192.111

• webserver and db Intersection , The two groups share hosts

[[email protected] ~]# ansible 'webserver:&db' -i hosts --list-hosts
  hosts (1):
    192.168.75.131

• exclude , stay webserver in , But not in db in

[email protected] ~]# ansible 'webserver:!db' -i hosts --list-hosts
[WARNING]: No hosts matched, nothing to do
  hosts (0):

5、 ... and 、Ansible Ad-Hoc command

Ad-hoc What are the orders ？ It's relative to writing Ansible playbook It's similar to typing in on the command line shell Command and write shell The relationship between scripts .

Can be used to execute some temporary commands . If we type in some commands to finish something faster , There is no need to save these executed commands , Such an order is called ad-hoc command .

Ansible Provide two ways to complete the task , One is ad-hoc command , First, write Ansible playbook.

The former can solve some simple tasks , The latter solves more complex tasks , Such as configuration management or deployment .

1、 Command format

ansible pattern [-i inventory] -m module -a argument

• pattern Asset selector
• -i Specify the location of the asset manifest file
• -m Specify this time Ansible ad-hoc Module to execute . It can be classified as SHELL The command .
• -a Parameters of the module . It can be likened to SHELL Command parameters in

2、 Module type

Ansible There are three types of modules ： Core module (core module)、 Add on modules (extra module) And user-defined module (consume module).

The core module is made up of Ansible Provided by the official team of . Add ons are provided by various communities . for example : OPENSTACK Community 、DOCKER Community, etc . When the core module and add-on module can't meet your needs , You can customize the module .

By default , In the installation Ansible When , Core modules and add-on modules have been installed without user intervention .

3、 Online help

ansible Core modules and add-on modules , The quantity is 3000+ . Such a large number of modules , For any contact Ansible People can't remember it completely 、 Master the use of . Therefore, it can be used smoothly Ansible Help document for , It is very necessary for us .Ansible Help document for , Commands provided by itself ansible-doc Realization .
Common help parameters

• List all core modules and add-on modules

[[email protected] ~]# ansible-doc -l
fortios_router_community_list                                 Configure community lists i...
azure_rm_devtestlab_info                                      Get Azure DevTest Lab facts
ecs_taskdefinition                                            register a task definition

• Query the usage of a module

[[email protected] ~]# ansible-doc yum

• Query the usage of a module , Relatively simple information

[[email protected] ~]# ansible-doc -s yum

4、 Common modules

4.1、command & shell modular

Both modules execute commands on the remote server . but command The module is ad-hoc Default module for , In execution ad-hoc If you do not specify the name of the module, this module will be used by default .

Don't specify -i hosts It is used by default /etc/ansible/hosts Asset information inside

[[email protected] ~]# ansible all -i hosts -a "echo ansible"
192.168.75.130 | CHANGED | rc=0 >>
ansible
[[email protected] ~]# ansible all -i hosts -m shell -a "echo ansible"
192.168.75.130 | CHANGED | rc=0 >>
ansible
[[email protected] ~]#

The difference between the two modules

• shell The module can perform SHELL Built in commands and features （ Such as pipe symbol ）.
• command Module cannot execute SHELL Built in commands and features

[[email protected] ~]# ansible all -i hosts -m shell -a "echo 'hello'|grep -o 'e'"
192.168.75.130 | CHANGED | rc=0 >>
e
[[email protected] ~]# ansible all -i hosts -a "echo 'ansible'|grep -o 'e'"
192.168.75.130 | CHANGED | rc=0 >>
ansible|grep -o e
[[email protected] ~]#

4.2、script modular

Pass the script on the management node to the managed node ( remote server ) Go ahead and execute .

[[email protected] ~]# vim test.sh
[[email protected] ~]# cat test.sh
touch /tmp/testfile` Insert a code chip here `
[[email protected] ~]# ansible all -i hosts -m script -a "test.sh"
192.168.75.130 | CHANGED => {
    
    "changed": true,
    "rc": 0,
    "stderr": "Shared connection to 192.168.75.130 closed.\r\n",
    "stderr_lines": [
        "Shared connection to 192.168.75.130 closed."
    ],
    "stdout": "",
    "stdout_lines": []
}
[[email protected] ~]# ansible all -i hosts -m shell -a "ls -l /tmp/testfile"
192.168.75.130 | CHANGED | rc=0 >>
-rw-r--r-- 1 root root 0 Jun  9 22:18 /tmp/testfile
[[email protected] ~]#

4.3、copy modular

copy The module is mainly used to copy files between the management node and the managed node ⻉.

Common parameters :

• src Designated copy ⻉ The source address of the file

• dest Designated copy ⻉ Destination address of the file

• backup Torture ⻉ Before document , If the original target file changes , Backup the target file

• woner Specify a new copy ⻉ Owner of file

• group Specify a new copy ⻉ All groups of files

• mode Specify a new copy ⻉ File permissions

• copy On the management node hosts To the managed node

[[email protected] ~]# ansible all -i hosts -m copy -a "src=hosts dest=/tmp/hosts"
[[email protected] ~]# ansible all -i hosts -m shell -a "ls -l /tmp/hosts"

• copy front , Back up the original file on the managed node

[[email protected] ~]# ansible all -i hosts -m copy -a "src=hosts dest=/tmp/hosts backup=yes"

• copy Set users and user groups for files at the same time

[[email protected] ~]# ansible all -i hosts -m copy -a "src=hosts dest=/tmp/hosts owner=nobody group=nobody"

• copy Set the permissions of the file at the same time

[[email protected] ~]# ansible all -i hosts -m copy -a "src=hosts dest=/tmp/hosts mode=0755"

4.4、yum_repository

add to YUM Warehouse

Common parameters

• name Warehouse name , It is the name in brackets in the first line of the warehouse file , Required parameters .
• description Warehouse description information , Required parameters when adding
• baseurl yum The repository “repodata” The directory where the directory is located URL, Required parameters when adding . It can also be multiple URL A list of .
• file The file name of the warehouse file saved to the managed node , It doesn't contain .repo. The default is name Value .
• state preset Confirm to add warehouse file , absent Confirm to delete the warehouse file .
• gpgcheck Whether to check GPG yes|no, No default , Use /etc/yum.conf Configuration in .

add to epel Source

[[email protected] ~]# ansible all -i hosts -m yum_repository -a "name=epel baseurl=https://download.fedoraproject.org/pub/epel/$releasever/$basearch/ description='epel repo'"

Delete epel Source

[[email protected] ~]# ansible all -i hosts -m yum_repository -a "name=epel state=absent"

4.5、yum modular

Equate to Linux Upper YUM command , On the remote server RPM Package management .
Common parameters :

• name Package name to install , Multiple software packages are marked with English commas (,) separate
• state Install the currently specified software 、 Remove operation (present installedlatest absent removed) Supported parameters
  • present Confirm that it has been installed , But don't upgrade
  • installed Confirm that it has been installed
  • latest Ensure installation , And upgrade to the latest
  • absent and removed Confirm that has been removed

Install a package

[[email protected] ~]# ansible all -i hosts -m yum -a "name=httpd state=present|latest|installed"

Remove a package

[[email protected] ~]# ansible all -i hosts -m yum -a "name=httpd state=absent|removed"

Install a package group

[[email protected] ~]# ansible all -i hosts -m yum -a "name='@Development tools' state=present" 

4.6、systemd modular

Centos6 Previous versions were used service modular . Please use ansible-doc service Command to view help information by yourself . Manage on remote nodes systemd service , Is the systemd Services managed . Common parameters ：

• daemon_reload Reload the systemd, Scan for new or changed units
• enabled Whether it starts up automatically yes|no
• name Will options , The service name , such as httpd vsftpd
• state Start the current service , stop it 、 restart 、 Reload and other operations (started,stopped,restarted,reloaded)

Reload systemd

[[email protected] ~]# ansible all -i hosts -m systemd -a "daemon_reload=yes"

start-up nginx

[[email protected] ~]# ansible all -i hosts -m systemd -a "name=nginx state=started"

close nginx

[[email protected] ~]# ansible all -i hosts -m systemd -a "name=nginx state=stopped"

restart nginx

[[email protected] ~]# ansible all -i hosts -m systemd -a "name=nginx state=restarted"

Reload nginx

[[email protected] ~]# ansible all -i hosts -m systemd -a "name=nginx state=reloaded"

nginx Boot from boot

[[email protected] ~]# ansible all -i hosts -m systemd -a "name=nginx enabled=yes"

4.7、group modular

On the managed node , Manage groups . Common parameters :

• name Group name , necessary
• system System group or not , yes/no , The default is no
• state Delete or create ,present/absent , The default is present

establish db Group

[[email protected] ~]# ansible all -i hosts -m group -a "name=db"

4.8、user modular

It is used to manage users on the managed node . Common parameters ：

• name Required parameters , Specify user name
• password Set the user's password , What is accepted here is an encrypted value , Because it will be saved directly to shadow, No password is set by default
• update_password If the password set is different from the original password , The password will be updated . stay 1.3 Is added to
• home Home directory of the specified user
• shell Set the user's shell
• comment User description information
• create_home When creating users , Whether to create its home directory . Created by default , If you don't create , Set to no.2.5 Used before version createhome
• group Set user's primary group groups Add users to multiple other groups , Multiple are separated by commas . By default, users will be deleted from other groups they have joined .
• append yes|no and groups In combination with ,yes when , Users will not be deleted from other groups they have joined
• system Set to yes when , A system account will be created
• expires Set expiration time for users , The value is timestamp , Will be converted to days later , Put it in shadow Of the 8 In a field
• generate_ssh_key Set to yes The key will be generated for the user , This will not overwrite the original key
• ssh_key_type Specify the user's key type , Default rsa, The specific type depends on the managed node
• state Delete or add users , present To add ,absent To delete ; The default value is present
• remove When and state=absent Use it together , Delete a user and its associated directory , Like home directory , Mailbox Directory . The optional value is : yes/no

Create user and set password , Sir, it's an encrypted password , perform ansible Command create user foo And set the password

[[email protected] ~]# pass=$(echo "123456" |openssl passwd -1 -stdin)
[[email protected] ~]# ansible all -i hosts -m user -a "name=foo password=${pass}"

Create user yangge, And create a key pair for it , And the key type is :ecdsa

[[email protected] ~]# ansible all -i hosts -m user -a "name=yangge generate_ssh_key=yes ssh_key_ty
pe=ecdsa"

For creation tom, And set its validity period to 2020 year 4 month 15 Japan , Join group db_admin in , Do not change the user's original group .

[[email protected] ~]# ansible all -i hosts -m user -a "name=tom expires=$(date +%s -d 20220609) groups=db append=yes"

date Command specification

//  Calculation 3 What time is it after hours # date +%T -d '3 hours'
//  Before any date  N  God , after  N  The specific date of the day 
# date +%F -d "20190910 1 day"
# date +%F -d "20190910 -1 day"
//  Calculate the number of days between two dates ,  For example, calculate the number of days before your birthday 
# d1=$(date +%s -d 20180728)
# d2=$(date +%s -d 20180726)# echo $(((d1-d2)/86400))

4.9、file modular

file The module is mainly used for file operation on remote host

Common parameters

• owner The definition file / The owner of the catalog
• group The definition file / The genus group of the catalogue
• mode The definition file / Directory permissions
• path Will options , The definition file / Path to directory
• recurse Recursively set file properties , Only valid for directories
• src link ( soft / hard ) The source file path of the file , Applies only to state=link The situation of
• dest The path to the linked file , Applies only to state=link The situation of
• state
  • directory If the directory does not exist , Create directory
  • file file does not exist , Will not be created , If it exists, the information of the file is returned , It is often used to check whether the file exists .
  • link Create soft link
  • hard Create a hard link
  • touch If the file doesn't exist , A new file will be created , If the file or directory already exists , Update its last modification time
  • absent Delete directory 、 File or unlink file

//  Create a file 
# ansible all -i hosts -m file -a"path=/tmp/foo.conf state=touch"
//  Change the file owner and permissions 
# ansible all -i hosts -m file -a"path=/tmp/foo.conf owner=nobody group=nobodymode=0644"
//  Create a soft connection 
# ansible all -i hosts -m file -a "src=/tmp/foo.confdest=/tmp/link.conf state=link"
//  Create a directory 
# ansible all -i hosts -m file -a "path=/tmp/testdirstate=directory"
//  Cancel a connection 
# ansible all -i hosts -m file -a"path=/tmp/link.conf state=absent"
//  Delete a file 
# ansible all -i hosts -m file -a"path=/tmp/foo.conf state=absent"

4.10、cron modular

Manage remote nodes CRON service . Equate to Linux The planned task in . Be careful ： Use Ansible Create a scheduled task , You cannot use local crontab -e To edit , otherwise Ansible This scheduled task cannot be operated again .

Common parameters :

• name To specify a cron job Name . Be sure to designate , Easy to delete in the future .
• minute Designated minutes , It can be set to (0-59, *, /2 etc. ) Format . The default is , Every minute .
• hour Designated hours , It can be set to (0-23, *, */2 etc. ) Format . The default is * , That is, every hour .
• day Specified day , It can be set to (1-31, *, */2 etc. ) Format . The default is * , Every day .
• month Specify the month , It can be set to (1-12, *, /2 etc. ) Format . The default is , That is, every week .
• weekday Designated week , It can be set to (0-6 for Sunday-Saturday, * etc. ) Format . The default is *, That is, every week .
• job Specify what to do , You can usually write a script , Or a paragraph .
• state Specify this job The state of , It can be new (present) Or delete (absent). The default is new (present)

//  Create a new one  CRON JOB  Mission 
# ansible all -i hosts -m cron -a "name='create newjob' minute='0' job='ls -alh > /dev/null'"
//  Delete one  CRON JOB  Mission , deleted , Be sure to specify correctly job  Of name Parameters , So as not to delete .
# ansible all -i hosts -m cron -a "name='create newjob' state=absent"

4.11、debug modular

debug The module is mainly used for debugging , The usual function is to print out the value of a variable . Common parameters :

• var Print a specified variable value directly
• msg Print a string that can be formatted

The variable is introduced here , We just need to understand debug Use the template .

# ansible all -i hosts -m debug -a "var=role" -e"role=web"
# ansible all -i hosts -m debug -a "msg='role is{
    {role}} '" -e "role=web"

4.12、 template modular

template The module uses Jinjia2 Format as document template , You can replace variables in the document . Document to .j2 ending . Common parameters :

• src Appoint Ansible The file path of the control side
• dest Appoint Ansible File path of the controlled end
• owner Specify the owner of the file
• group Specify the group to which the file belongs
• mode Specify the permissions for the file
• backup Create a backup file containing timestamp information , In this way, if you wrongly destroy the original file in some way , You can restore it to its original state .yes/no

1.  Build a  template  file ,  be known as  hello_world.j2
# cat hello_world.j2Hello {
    {var}} !
2.  Carry out orders , And set variables  var  The value of is  world
# ansible all -i hosts -m template -a"src=hello_world.j2 dest=/tmp/hello_world.world" -e"var=world"
3.  Verify on the controlled host 
# cat /tmp/hello_world.worldHello world !

4.13、lineinfile modular

On the managed node , Modify and delete a line of content in the target file by regular matching .

If all matched multiple lines are processed uniformly in one file , Please refer to replace modular .

If you want to add a file at one time / to update / Delete multiple lines of content , Reference resources blockinfile modular

Common parameters

• path The target file path of the managed node , must .
• state Optional value absent Delete |present Replace ( The default value is ).
• regexp Find the regular expression in each line of the file . about state=present , Only the last line found is replaced .
• line To insert... In a file / Replaced line . need state=present.
• create When the file does not exist , Do you want to create a file and add content .yes/noExample

Delete a content in the controlled node file

# ansible 
all -i hosts -m lineinfile -a"path=/etc/sudoers regexp='^%wheel' state=absent"

Replace a line

# ansible all -i hosts -m lineinfile -a"path=/etc/selinux/config regexp='^SELINUX='line='SELINUX=disabled' state=present"

4.14、blockinfile modular

Add multiple lines to the target file / to update / Delete operation , Common parameters

• path Destination file path
• block The content of the block being manipulated in the file
• state How to deal with block content ,absent Delete , present add to / to update （ The default value is ）

To file /etc/ssh/sshd_config Add a few lines at the end of , The added content is attention ：

Match User ansible-agentPasswordAuthentication no

ansible all -i hosts -m blockinfile -a"path=/etc/ssh/sshd_config block='Match Useransible-agent\nPasswordAuthentication no'"

Be careful ：\n It's a newline .

Update the previous content

ansible dbservers -i hosts -m blockinfile -a"path=/etc/ssh/sshd_config block='Match Useransible-agent\nPasswordAuthentication yes'"

Delete several consecutive lines in the file

ansible dbservers -i hosts -m blockinfile -a"path=/etc/ssh/sshd_config block='Match Useransible-agent\nPasswordAuthentication yes'state=absent"