By

前言

本文主要介绍在如何使用 Ansible 管理 Windows 客户端，Ansible 官方提供了一个很方便的安装脚本，对于外网用户来说安装真的很轻松，可惜我遇到的问题是如何在内网部署，有相同烦恼的小伙伴不妨参考下

轻轻松松使用 Ansible 管理 Windows 客户端

更新历史

2018 年 11 月 27 日 - 更新 macOS 使用 ansible 管理 windows
2018 年 05 月 21 日 - 初稿

阅读原文 - https://liaojiaxin158.github.io/post/ansible-windows/

扩展阅读

Ansible Windows Guides - http://docs.ansible.com/ansible/latest/user_guide/windows.html

Ansible Windows Support

Ansible 在 2.3 版本之前对于 Windows 支持的并不算很友好，从 2.4 版本开始已经可以使用原生模块实现很多需求

Because Windows is a non-POSIX-compliant operating system, there are differences between how Ansible interacts with them and the way Windows works. These guides will highlight some of the differences between Linux/Unix hosts and hosts running Windows.

  • Ansible’s supported Windows versions generally match those under current and extended support from Microsoft. Supported desktop OSs include Windows 7, 8.1, and 10, and supported server OSs are Windows Server 2008, 2008 R2, 2012, 2012 R2, and - 2016.
  • Ansible requires PowerShell 3.0 or newer and at least .NET 4.0 to be installed on the Windows host.
  • A WinRM listener should be created and activated. More details for this can be found below.

image

Ansible does not support managing Windows XP or Server 2003 hosts. The supported operating system versions are:

Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows 7
Windows 8.1
Windows 10

  1. 在官方文档中已经提到了在 Windows 中使用 Ansible 的最要前提，WinRM
  2. WinRM 依赖 Powershell 3.0 以上版本的支持，牵扯出 PowerShell 2.0 to PowerShell 3.0/5.0 的问题
  3. 而 Powershell 升级则带来. Net Framework 是否跟随升级至 4.6.2/4.7.2 的选择
  4. 关于 WinRM 的参数配置可以参考下面的链接 Setting up a Windows Host

https://github.com/ansible/ansible/blob/devel/examples/scripts/upgrade_to_ps3.ps1
https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1

Setting up a Windows Host
http://docs.ansible.com/ansible/latest/user_guide/windows_setup.html

.NET Framework 4.7.2/4.6.2
https://www.microsoft.com/net/download/dotnet-framework-runtime

Powershell 3.0
https://www.microsoft.com/en-us/download/details.aspx?id=34595

Powershell 5.1
https://www.microsoft.com/en-us/download/details.aspx?id=54616

我个人目前的建议是 Win7/2008 升级至 Powershell 3.0，.Net Framework 升级至 4.6.2，其他情况需要可以参考官方文档后做决定

Ansible Windows Guides - http://docs.ansible.com/ansible/latest/user_guide/windows.html

客户端

  1. 客户端配置 windows 主机, 以管理员身份打开 powershell, 并查看当前 ps 版本
    get-host
  2. 系统自带的 powershell 版本是 2.0，需要更新至 powershell 3 以上版本
    https://www.microsoft.com/net/download/dotnet-framework-runtime
    https://www.microsoft.com/en-us/download/details.aspx?id=34595
  3. 安装完重启服务器查看 powershell 版本

.NET Framework 4.6 以上版本无法建立到信任根颁发机构的证书链
原因：系统缺少信任 Microsoft Root Certificate Authority 2011 根证书
下载：MicrosoftRootCertificateAuthority2011.cer
http://go.microsoft.com/fwlink/?LinkID=747875&clcid=0x409
运行 certmgr.msc
导入证书到 “受信任的根证书颁发机构”

image

1
2
3
4
5
6
7
# 配置 winrm
mkdir C:\temp
cd C:\temp
# 下载 ConfigureRemotingForAnsible.ps1
https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
# 开启 WinRM 服务 
powershell -ExecutionPolicy RemoteSigned .\ConfigureRemotingForAnsible.ps1 -SkipNetworkProfileCheck

服务端

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# 服务端使用 pip 安装 pywinrm
pip install pywinrm

# 功能测试，配置 ansible 控制机 
vi /etc/ansible/hosts

[windows]
192.168.67.139
[windows:vars]
ansible_user=Administrator
ansible_password=Admin123
ansible_port=5986
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore  

# 要注意的是端口方面 ssl 即 https 方式的使用 5986，http 使用 5985

# 测试 ping 通信 
ansible windows -m win_ping 
# 查看 ip 地址 
ansible windows -m win_command -a "ipconfig"

网盘下载

Windows 作为客户端所需的软件包我上传到百度网盘，.Net Framework 安装失败提示证书错误记得手动导入 MicrosoftRootCertificateAuthority2011.cer

https://pan.baidu.com/s/1JNV2pXjwUn14ojAtdEH_Sg

  1. 安装 .Net Framework 4.6.2（NDP462-KB3151800-x86-x64-AllOS-ENU.exe）
  2. 升级 Windows 7 SP1 和 Windows 2008 R2 SP1 的 PowerShell 版本从 2.0 至 3.0（Windows6.1-KB2506143-x64.msu）

  3. 执行.\ConfigureRemotingForAnsible.ps1 脚本开启 WinRM 远程管理服务

    powershell -ExecutionPolicy RemoteSigned .\ConfigureRemotingForAnsible.ps1 -SkipNetworkProfileCheck

macOS 配置

macOS 使用 ansible 管理 windows 里有一个小坑

Ansible Error – “NSPlaceholderDate initialize may have been in progress in another thread when fork() was called”

If you have came across the same error as I did (error below) then solving this might be easier than you think

1
2
3
4
5
objc[6763]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called.
objc[6763]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.

# run this export
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

You just need to run the following ( https://github.com/ansible/ansible/issues/31869 )

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# download the script
(New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1', './ConfigureRemotingForAnsible.ps1')

# execute the script
./ConfigureRemotingForAnsible.ps1

# macOS ansible
python3 -m venv ansible
pip install ansible pywinrm

# config win_hosts file
vi win_hosts

[windows:vars]
ansible_user=ox
ansible_password=ox
ansible_port=5986
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore

[windows]
192.168.56.101

# run test
ansible -i win_hosts windows -m win_ping -vvv

ansible 2.7.0
  config file = /Users/wangao/Documents/git/wangao/ansible/ansible.cfg
  configured module search path = [u'/Users/wangao/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.15 (default, Jul 23 2018, 21:27:06) [GCC 4.2.1 Compatible Apple LLVM 9.1.0 (clang-902.0.39.2)]
Using /Users/wangao/Documents/git/wangao/ansible/ansible.cfg as config file
Parsed /Users/wangao/Documents/git/wangao/ansible/win_hosts inventory source with ini plugin
META: ran handlers
Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/windows/win_ping.ps1
<192.168.56.101> ESTABLISH WINRM CONNECTION FOR USER: ox on PORT 5986 TO 192.168.56.101
objc[63337]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called.
objc[63337]: +[__NSPlaceholderDate initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.

# Fixed this on High Sierra and Mojave.
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

ansible -i win_hosts windows -m win_ping -vvv

ansible 2.7.0
  config file = /Users/wangao/Documents/git/wangao/ansible/ansible.cfg
  configured module search path = [u'/Users/wangao/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.15 (default, Jul 23 2018, 21:27:06) [GCC 4.2.1 Compatible Apple LLVM 9.1.0 (clang-902.0.39.2)]
Using /Users/wangao/Documents/git/wangao/ansible/ansible.cfg as config file
Parsed /Users/wangao/Documents/git/wangao/ansible/win_hosts inventory source with ini plugin
META: ran handlers
Using module file /usr/local/lib/python2.7/site-packages/ansible/modules/windows/win_ping.ps1
<192.168.56.101> ESTABLISH WINRM CONNECTION FOR USER: ox on PORT 5986 TO 192.168.56.101
EXEC (via pipeline wrapper)
192.168.56.101 | SUCCESS => {
    "changed": false,
    "ping": "pong"
}
文章目录
  1. 1. 前言
  2. 2. 更新历史
  3. 3. Ansible Windows Support
  4. 4. 客户端
  5. 5. 服务端
  6. 6. 网盘下载
  7. 7. macOS 配置