一、环境配置

1.安装docker容器

• 配置docker，安装源

• 安装

• 开启

2.部署harbor

• 建立仓库自签名证书

[root@podman ~]# openssl req -newkey  rsa:4096 \
> -nodes -sha256 -keyout /data/certs/zk.org.key \
> -addext "subjectAltName = DNS:reg.zk.org" \
> -x509 -days 365 -out /data/certs/zk.org.crt

• 部署

可以创建新的项目

3.ansible主机搭建podman

• 在harbor仓库中下放证书到目标主机

• 在目标主机中更新证书授信

• 登录到harbor仓库

4.向仓库中导入资源

#在做资源导入时在harbor中建立ansible、rhel两个共有项目

• 将镜像资源包导入系统

[root@reg source]# docker load  -i ee-supported-rhel8-latest.tar
[root@reg source]# docker load  -i mariadb.tar
[root@reg source]# docker load  -i nginx-latest.tar.gz

• 将镜像上传至harbor仓库

push前先要把资源名字tag成自己harbor仓库的格式

[root@reg ~]# docker tag reg.timinglee.org/ansible/ee-supported-rhel8:latest reg.zk.org/rhel/ee-supported-rhel8:latest
[root@reg ~]# docker push reg.zk.org/rhel/ee-supported-rhel8:latest

[root@reg ~]# docker tag nginx:latest reg.zk.org/rhel/nginx:latest
[root@reg ~]# docker push reg.zk.org/rhel/nginx:latest

[root@reg ~]# docker tag registry.redhat.io/rhel9/mariadb-105:latest reg.zk.org/rhel/mariadb-105:latest
[root@reg ~]# docker push reg.zk.org/rhel/mariadb-105:latest

[root@reg ~]# docker tag reg.timinglee.org/ansible/ee-supported-rhel8:latest reg.zk.org/ansible/ee-supported-rhel8:latest
[root@reg ~]# docker push reg.zk.org/ansible/ee-supported-rhel8:latest

5.镜像管理（在servera中建立podman相关使用资源）

[root@servera ~]# useradd zk
[root@servera ~]# echo 123 | passwd --stdin zk
[root@servera ~]# vim /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
172.25.254.10   servera
172.25.254.20   serverb
172.25.254.200  reg.zk.org
172.25.254.100  ansible

[root@servera ~]# cd /etc/containers/
[root@servera containers]# ls
certs.d  oci  policy.json  registries.conf  registries.conf.d  registries.d  storage.conf  systemd

清理下子配置文件：
[root@servera containers]# cd registries.conf.d
[root@servera registries.conf.d]# mkdir  bak
[root@servera registries.conf.d]# mv * bak/
[root@servera registries.conf.d]# cd ..

优先从reg.zk.org拉取资源：
[root@servera containers]# vim registries.conf
unqualified-search-registries = ["reg.zk.org", "registry.access.redhat.com", "registry.redhat.io", "docker.io"]

可以看到改完立刻修改了：
[root@servera containers]# podman info
。。。
registries:
  search:
  - reg.zk.org
  - registry.access.redhat.com
  - registry.redhat.io
  - docker.io
。。。

• 利用给定的镜像构建文件构建镜像

[zk@servera ~]$ vim container
FROM reg.zk.org/rhel/nginx:latest
RUN  echo zkzkzk > /usr/share/nginx/html/index.html

6.容器管理

这种运行方式会占用bash

• podman run 参数

-d  后台运行  -p 映射宿主机端口 -v 挂载宿主机目录到容器中 -e 指定环境变量

• 容器的开启与关闭

• 删除容器

podman rm -f 强制删除容器，无论容器运行与否

7.容器开机启动

当zk用户退出登录，其运行的后台程序仍然正常运行不会关闭

8.ansible

• 配置ansible源

[ansible-automation-platform-2.2-for-rhel-9-x86_64-rpms]
name = ansible-automation-platform-2.2-for-rhel-9-x86_64-rpms
baseurl = file:///ansible/ansible-automation-platform-2.2-for-rhel-9-x86_64-rpms
gpgcheck = 0

[rhel-9-for-x86_64-appstream-rpms]
name = rhel-9-for-x86_64-appstream-rpms
baseurl = file:///ansible/rhel-9-for-x86_64-appstream-rpms
gpgcheck = 0

[rhel-9-for-x86_64-baseos-rpms]
name = rhel-9-for-x86_64-baseos-rpms
baseurl = file:///ansible/rhel-9-for-x86_64-baseos-rpms
gpgcheck = 0

• 安装ansible环境到控制节点

---
ansible-navigator:
  ansible:
    config:
      path: ./ansible.cfg
  color:
    osc4: true
  execution-environment:
    image: reg.zk.org/ansible/ee-supported-rhel8:latest
      #pull:
      #policy: never
  playbook-artifact:
    enable: false

• 配置受控主机清单

[all]
servera
serverb

查看清单：

• 设置被控主机

查模板：

免密认证：

[devops@ansible ansible]$ ssh-keygen -f ~/.ssh/id_rsa -P ""  #生成key
[devops@ansible ansible]$ ssh-copy-id -i ~/.ssh/id_rsa.pub devops@localhost  #复制key
[devops@ansible ansible]$ ansible all -m file -a 'path=~/.ssh owner=devops group=devops mode=700 state=directory' -k  #建立key目录
[devops@ansible ansible]$ ansible all -m copy -a 'src=~/.ssh/authorized_keys dest=/home/devops/.ssh/authorized_keys owner=devops group=devops mode=600' -k  #复制key到目标主机

• 建立ansible的配置文件

[defaults]
remote_user=devops
host_key_checking=False
inventory=~/ansible/inventory

[privilege_escalation]
become=True
become_ask_pass=False
become_method=sudo
become_user=root