前言
本文主要介紹在如何使用Ansible管理Windows客戶端胖烛，Ansible官方提供了一個(gè)很方便的安裝腳本宽档，對(duì)于外網(wǎng)用戶來說安裝真的很輕松讲岁，可惜我遇到的問題是如何在內(nèi)網(wǎng)部署主之，有相同煩惱的小伙伴不妨參考下
輕輕松松使用Ansible管理Windows客戶端
更新歷史
2018年05月21日 - 初稿
閱讀原文 - https://wsgzao.github.io/post/ansible-windows/
擴(kuò)展閱讀
Ansible Windows Guides - http://docs.ansible.com/ansible/latest/user_guide/windows.html
Ansible Windows Support
Ansible在2.3版本之前對(duì)于Windows支持的并不算很友好颂鸿，從2.4版本開始已經(jīng)可以使用原生模塊實(shí)現(xiàn)很多需求
Because Windows is a non-POSIX-compliant operating system, there are differences between how Ansible interacts with them and the way Windows works. These guides will highlight some of the differences between Linux/Unix hosts and hosts running Windows.
- Ansible’s supported Windows versions generally match those under current and extended support from Microsoft. Supported desktop OSs include Windows 7, 8.1, and 10, and supported server OSs are Windows Server 2008, 2008 R2, 2012, 2012 R2, and - 2016.
- Ansible requires PowerShell 3.0 or newer and at least .NET 4.0 to be installed on the Windows host.
- A WinRM listener should be created and activated. More details for this can be found below.
Ansible does not support managing Windows XP or Server 2003 hosts. The supported operating system versions are:
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows 7
Windows 8.1
Windows 10
- 在官方文檔中已經(jīng)提到了在Windows中使用Ansible的最要前提促绵，WinRM
- WinRM依賴Powershell 3.0以上版本的支持，牽扯出PowerShell 2.0 to PowerShell 3.0/5.0的問題
- 而Powershell升級(jí)則帶來.Net Framework是否跟隨升級(jí)至4.6.2/4.7.2的選擇
- 關(guān)于WinRM的參數(shù)配置可以參考下面的鏈接Setting up a Windows Host
https://github.com/ansible/ansible/blob/devel/examples/scripts/upgrade_to_ps3.ps1
https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
Setting up a Windows Host
http://docs.ansible.com/ansible/latest/user_guide/windows_setup.html
.NET Framework 4.7.2/4.6.2
https://www.microsoft.com/net/download/dotnet-framework-runtime
Powershell 3.0
https://www.microsoft.com/en-us/download/details.aspx?id=34595
Powershell 5.1
https://www.microsoft.com/en-us/download/details.aspx?id=54616
我個(gè)人目前的建議是Win7/2008升級(jí)至Powershell 3.0，.Net Framework升級(jí)至4.6.2败晴，其他情況需要可以參考官方文檔后做決定
Ansible Windows Guides - http://docs.ansible.com/ansible/latest/user_guide/windows.html
客戶端
1.客戶端配置windows主機(jī),以管理員身份打開powershell, 并查看當(dāng)前ps版本
get-host
2.系統(tǒng)自帶的powershell版本是2.0浓冒，需要更新至powershell 3 以上版本
https://www.microsoft.com/net/download/dotnet-framework-runtime
https://www.microsoft.com/en-us/download/details.aspx?id=34595
3.安裝完重啟服務(wù)器查看powershell版本
.NET Framework 4.6以上版本無法建立到信任根頒發(fā)機(jī)構(gòu)的證書鏈
原因：系統(tǒng)缺少信任 Microsoft Root Certificate Authority 2011 根證書
下載：MicrosoftRootCertificateAuthority2011.cer
http://go.microsoft.com/fwlink/?LinkID=747875&clcid=0x409
運(yùn)行 certmgr.msc
導(dǎo)入證書到“受信任的根證書頒發(fā)機(jī)構(gòu)”
# 配置winrm
mkdir C:\temp
cd C:\temp
# 下載ConfigureRemotingForAnsible.ps1
https://raw.githubusercontent.com/ansible/ansible/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
# 開啟WinRM服務(wù)
powershell -ExecutionPolicy RemoteSigned .\ConfigureRemotingForAnsible.ps1 -SkipNetworkProfileCheck
服務(wù)端
# 服務(wù)端使用pip安裝pywinrm
pip install pywinrm
# 功能測(cè)試，配置ansible控制機(jī)
vi /etc/ansible/hosts
[windows]
192.168.67.139
[windows:vars]
ansible_user=Administrator
ansible_password=Admin123
ansible_port=5986
ansible_connection=winrm
ansible_winrm_server_cert_validation=ignore
# 要注意的是端口方面ssl即https方式的使用5986尖坤，http使用5985
# 測(cè)試ping通信
ansible windows -m win_ping
# 查看ip地址
ansible windows -m win_command -a "ipconfig"
網(wǎng)盤下載
Windows作為客戶端所需的軟件包我上傳到百度網(wǎng)盤稳懒，.Net Framework安裝失敗提示證書錯(cuò)誤記得手動(dòng)導(dǎo)入MicrosoftRootCertificateAuthority2011.cer
https://pan.baidu.com/s/1JNV2pXjwUn14ojAtdEH_Sg
安裝 .Net Framework 4.6.2（NDP462-KB3151800-x86-x64-AllOS-ENU.exe）
升級(jí) Windows 7 SP1 和 Windows 2008 R2 SP1 的 PowerShell版本從2.0至3.0（Windows6.1-KB2506143-x64.msu）
-
執(zhí)行.\ConfigureRemotingForAnsible.ps1腳本開啟WinRM遠(yuǎn)程管理服務(wù)
powershell -ExecutionPolicy RemoteSigned .\ConfigureRemotingForAnsible.ps1 -SkipNetworkProfileCheck
