Week 03: 变量优先级与 Jinja2 渲染引擎

# group_vars/all.yml
user_profile:
  name: admin
  shell: /bin/bash

# host_vars/web01.yml
user_profile:
  shell: /bin/zsh

# Play 级别变量
- hosts: web_servers
  vars:
    http_port: 80
    app_env: production
  tasks:
    - debug:
        msg: "Port: {{ http_port }}, Env: {{ app_env }}"

- hosts: all
  vars_files:
    - vars/common.yml
    - vars/{{ ansible_facts['os_family'] }}.yml  # 动态路径
  tasks:
    - debug: var=app_version

- name: Check if service exists
  command: systemctl status nginx
  register: nginx_status
  ignore_errors: yes

- name: Display full register output
  debug:
    var: nginx_status

{
    "changed": false,
    "cmd": ["systemctl", "status", "nginx"],
    "rc": 0,
    "stdout": "● nginx.service - A high performance web server",
    "stderr": "",
    "stdout_lines": ["● nginx.service - A high performance web server"],
    "failed": false
}

- name: Detect if database is initialized
  stat:
    path: /var/lib/mysql/ibdata1
  register: mysql_data

- name: Initialize database (only if not exists)
  command: mysql_install_db
  when: not mysql_data.stat.exists

- name: Get disk usage
  shell: df -h / | tail -1 | awk '{print $5}' | sed 's/%//'
  register: disk_usage

- name: Trigger cleanup if disk > 80%
  include_tasks: cleanup.yml
  when: disk_usage.stdout | int > 80

- name: Load environment-specific variables
  include_vars:
    file: "vars/{{ env_type }}.yml"
  when: env_type is defined

- name: Load all YAML files from directory
  include_vars:
    dir: vars/components
    extensions:
      - yml
      - yaml
    ignore_files:
      - secrets.yml  # 排除敏感文件

- name: Load OS-specific package lists
  include_vars: "{{ item }}"
  with_first_found:
    - "vars/packages_{{ ansible_facts['distribution'] }}_{{ ansible_facts['distribution_major_version'] }}.yml"
    - "vars/packages_{{ ansible_facts['os_family'] }}.yml"
    - "vars/packages_default.yml"

- name: Calculate derived values
  set_fact:
    total_memory_mb: "{{ ansible_facts['memtotal_mb'] }}"
    available_memory_mb: "{{ ansible_facts['memfree_mb'] + ansible_facts['mem_buffers'] + ansible_facts['cached'] }}"
    memory_usage_percent: "{{ ((ansible_facts['memtotal_mb'] - ansible_facts['memfree_mb']) / ansible_facts['memtotal_mb'] * 100) | int }}"

- name: Build cluster node map
  set_fact:
    cluster_map: |
      {% set result = {} %}
      {% for host in groups['cluster'] %}
      {%   set _ = result.update({
             host: {
               'ip': hostvars[host]['ansible_facts']['default_ipv4']['address'],
               'role': hostvars[host].get('node_role', 'worker')
             }
           }) %}
      {% endfor %}
      {{ result }}

- debug:
    var: cluster_map

# 等效于在每个 Play 开始时自动执行:
- name: Gathering Facts
  setup:

- hosts: all
  gather_facts: no  # 跳过自动收集
  tasks:
    - name: Manually gather facts if needed
      setup:
      when: some_condition

- hosts: all
  gather_facts: yes
  gather_subset:
    - '!all'  # 排除所有
    - '!min'  # 排除最小集
    - network  # 仅收集网络信息
    - virtual  # 仅收集虚拟化信息

# 旧式访问 (仍然支持, 但不推荐)
{{ ansible_eth0.ipv4.address }}
{{ ansible_hostname }}

# 新式访问 (推荐)
{{ ansible_facts['eth0']['ipv4']['address'] }}
{{ ansible_facts['hostname'] }}

# 系统识别
ansible_facts['distribution']           # CentOS, Ubuntu, Debian
ansible_facts['distribution_version']   # 7.9, 20.04, 10
ansible_facts['os_family']              # RedHat, Debian, Suse
ansible_facts['kernel']                 # 5.4.0-42-generic

# 硬件信息
ansible_facts['processor_cores']        # CPU 核心数
ansible_facts['memtotal_mb']            # 总内存 (MB)
ansible_facts['devices']                # 磁盘设备字典
ansible_facts['mounts']                 # 挂载点列表

# 网络信息
ansible_facts['default_ipv4']['address']    # 主 IP
ansible_facts['default_ipv4']['interface']  # 主网卡名
ansible_facts['all_ipv4_addresses']         # 所有 IPv4 列表
ansible_facts['interfaces']                 # 所有网卡名称列表

# 虚拟化
ansible_facts['virtualization_type']    # kvm, vmware, docker, lxc
ansible_facts['virtualization_role']    # guest, host

- name: Install web server based on OS
  package:
    name: |
      {% if ansible_facts['os_family'] == 'Debian' %}
      apache2
      {% elif ansible_facts['os_family'] == 'RedHat' %}
      httpd
      {% endif %}
    state: present

#!/bin/bash
cat << EOF
{
  "version": "2.1.4",
  "build_date": "2024-01-15",
  "environment": "production"
}
EOF

[main]
engine=postgresql
version=14.2
port=5432

[replication]
enabled=true
role=master

- debug:
    msg: |
      App Version: {{ ansible_facts['ansible_local']['app_info']['version'] }}
      DB Engine: {{ ansible_facts['ansible_local']['database']['main']['engine'] }}

hostvars = {
    'web01': {
        'ansible_facts': {...},
        'custom_var': 'value',
        ...
    },
    'db01': {
        'ansible_facts': {...},
        ...
    }
}

# 在 web 服务器上配置应用连接字符串
- hosts: web_servers
  tasks:
    - name: Configure app database connection
      template:
        src: app_config.j2
        dest: /etc/app/config.ini

[database]
host = {{ hostvars['db_primary']['ansible_facts']['default_ipv4']['address'] }}
port = {{ hostvars['db_primary']['db_port'] | default(5432) }}

# 生成所有 web 服务器的 IP 列表
- set_fact:
    web_backends: |
      {% set ips = [] %}
      {% for host in groups['web_servers'] %}
      {%   if hostvars[host]['ansible_facts'] is defined %}
      {%     set _ = ips.append(hostvars[host]['ansible_facts']['default_ipv4']['address']) %}
      {%   endif %}
      {% endfor %}
      {{ ips }}

# templates/haproxy.cfg.j2
backend web_cluster
    balance roundrobin
    {% for host in groups['web_servers'] %}
    server {{ host }} {{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }}:80 check
    {% endfor %}

backend api_cluster
    balance leastconn
    {% for host in groups['api_servers'] %}
    server {{ host }} {{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }}:8080 check
    {% endfor %}

- name: Install monitoring agent only on production
  package:
    name: datadog-agent
    state: present
  when: "'production' in group_names"

- name: Configure firewall for database servers
  firewalld:
    port: 5432/tcp
    permanent: yes
    state: enabled
  when: "'database_servers' in group_names"

- name: Generate complete service mesh map
  set_fact:
    service_mesh: |
      {% set mesh = {} %}
      {% for group in groups.keys() %}
      {%   if group not in ['all', 'ungrouped'] %}
      {%     set hosts = [] %}
      {%     for host in groups[group] %}
      {%       set _ = hosts.append({
                 'name': host,
                 'ip': hostvars[host]['ansible_facts']['default_ipv4']['address']
               }) %}
      {%     endfor %}
      {%     set _ = mesh.update({group: hosts}) %}
      {%   endif %}
      {% endfor %}
      {{ mesh | to_nice_json }}

# inventory
[web]
192.168.1.10  hostname=web01
192.168.1.11  hostname=web02

- name: Deploy SSH public key
  authorized_key:
    user: deploy
    key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

- name: Inject CA certificate
  copy:
    content: "{{ lookup('file', '/etc/ssl/certs/ca-bundle.crt') }}"
    dest: /usr/local/share/ca-certificates/internal-ca.crt

- name: Deploy all configuration snippets
  copy:
    src: "{{ item }}"
    dest: "/etc/app/conf.d/{{ item | basename }}"
  loop: "{{ lookup('fileglob', 'config-snippets/*.conf', wantlist=True) }}"

- name: Generate complex config and store as variable
  set_fact:
    nginx_config: "{{ lookup('template', 'nginx.conf.j2') }}"

- name: Deploy pre-rendered config
  copy:
    content: "{{ nginx_config }}"
    dest: /etc/nginx/nginx.conf

- name: Use secret from environment
  uri:
    url: https://api.example.com/deploy
    headers:
      Authorization: "Bearer {{ lookup('env', 'API_TOKEN') }}"
    method: POST

- name: Get current user
  debug:
    msg: "Running as {{ lookup('env', 'USER') }}"

- name: Get Git commit hash
  set_fact:
    git_commit: "{{ lookup('pipe', 'git rev-parse --short HEAD') }}"

- name: Generate unique deployment ID
  set_fact:
    deploy_id: "{{ lookup('pipe', 'date +%Y%m%d%H%M%S') }}_{{ lookup('pipe', 'uuidgen | cut -d- -f1') }}"

- name: Tag deployed artifact
  copy:
    src: app.jar
    dest: "/opt/releases/app_{{ git_commit }}.jar"

# 首次运行生成密码, 后续运行读取相同密码
- name: Ensure database password exists
  set_fact:
    db_password: "{{ lookup('password', '/dev/null length=32 chars=ascii_letters,digits') }}"

# 持久化到文件
- name: Generate and persist MySQL root password
  set_fact:
    mysql_root_password: "{{ lookup('password', 'credentials/mysql_root_pass length=20') }}"

- name: Read from app.ini
  debug:
    msg: "DB Host: {{ lookup('ini', 'host section=database file=app.ini') }}"

# servers.csv:
# hostname,ip,role
# web01,192.168.1.10,frontend
# db01,192.168.1.20,database

- name: Get IP for web01
  debug:
    msg: "{{ lookup('csvfile', 'web01 file=servers.csv delimiter=, col=1') }}"
  # 输出: 192.168.1.10

- name: Fetch external configuration
  set_fact:
    external_config: "{{ lookup('url', 'https://config-server/api/app/prod') }}"

- name: Get public IP from service
  debug:
    msg: "Public IP: {{ lookup('url', 'https://ifconfig.me/ip') }}"

- name: Resolve load balancer IP
  set_fact:
    lb_ip: "{{ lookup('dig', 'lb.example.com') }}"

- name: Get all A records
  debug:
    var: lookup('dig', 'example.com', 'qtype=A', wantlist=True)

# 如果环境变量不存在, 使用默认值
- set_fact:
    api_key: "{{ lookup('env', 'API_KEY') | default('default-key-for-dev', true) }}"

# 如果文件不存在, 返回空字符串而非失败
- set_fact:
    optional_config: "{{ lookup('file', '/etc/optional.conf', errors='ignore') | default('') }}"

# 强制重新查询 (跳过缓存)
- debug:
    msg: "{{ lookup('pipe', 'date', cache=False) }}"

- name: Deploy microservice with dynamic configuration
  hosts: app_servers
  vars:
    # Lookup: 从 Git 获取版本信息
    git_branch: "{{ lookup('pipe', 'git rev-parse --abbrev-ref HEAD') }}"
    git_commit_short: "{{ lookup('pipe', 'git rev-parse --short HEAD') }}"
    
    # Lookup: 从环境变量获取敏感信息
    docker_registry_token: "{{ lookup('env', 'DOCKER_REGISTRY_TOKEN') }}"
    deployment_env: "{{ lookup('env', 'DEPLOY_ENV') | default('staging', true) }}"
    
    # Lookup: 从外部 API 获取配置
    service_discovery: "{{ lookup('url', 'https://consul.internal/v1/catalog/services') }}"
    
  tasks:
    - name: Load environment-specific variables
      include_vars:
        file: "vars/{{ deployment_env }}.yml"
    
    - name: Check current application version
      shell: cat /opt/app/version.txt 2>/dev/null || echo 'none'
      register: current_version
      changed_when: false
    
    - name: Determine if deployment needed
      set_fact:
        should_deploy: "{{ current_version.stdout != git_commit_short }}"
        deployment_timestamp: "{{ lookup('pipe', 'date +%s') }}"
    
    - name: Build service mesh configuration
      set_fact:
        service_endpoints: |
          {% set endpoints = {} %}
          {% for svc_type in ['api', 'worker', 'cache'] %}
          {%   set hosts = [] %}
          {%   for host in groups[svc_type + '_servers'] | default([]) %}
          {%     if hostvars[host]['ansible_facts'] is defined %}
          {%       set host_info = {
                     'hostname': host,
                     'ip': hostvars[host]['ansible_facts']['default_ipv4']['address'],
                     'cpu_cores': hostvars[host]['ansible_facts']['processor_cores'],
                     'healthy': hostvars[host].get('health_check_passed', true)
                   } %}
          {%       if host_info.healthy %}
          {%         set _ = hosts.append(host_info) %}
          {%       endif %}
          {%     endif %}
          {%   endfor %}
          {%   set _ = endpoints.update({svc_type: hosts}) %}
          {% endfor %}
          {{ endpoints }}
    
    - name: Deploy application configuration
      template:
        src: app-config.json.j2
        dest: /opt/app/config.json
      when: should_deploy | bool
    
    - name: Tag deployment metadata
      copy:
        content: |
          {
            "version": "{{ git_commit_short }}",
            "branch": "{{ git_branch }}",
            "environment": "{{ deployment_env }}",
            "deployed_at": "{{ deployment_timestamp }}",
            "deployed_by": "{{ lookup('env', 'USER') }}",
            "inventory_group": {{ group_names | to_json }}
          }
        dest: /opt/app/version.txt
      when: should_deploy | bool

{
  "app": {
    "name": "{{ app_name }}",
    "version": "{{ git_commit_short }}",
    "environment": "{{ deployment_env }}"
  },
  "database": {
    "primary": {
      "host": "{{ hostvars[groups['database_primary'][0]]['ansible_facts']['default_ipv4']['address'] }}",
      "port": {{ db_port | default(5432) }},
      "name": "{{ db_name }}"
    },
    "replicas": [
      {% for host in groups['database_replicas'] | default([]) -%}
      {
        "host": "{{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }}",
        "port": {{ db_port | default(5432) }}
      }{{ ',' if not loop.last else '' }}
      {% endfor %}
    ]
  },
  "service_mesh": {{ service_endpoints | to_nice_json }},
  "feature_flags": {
    "enable_cache": {{ 'redis_servers' in groups }},
    "enable_async_workers": {{ (groups['worker_servers'] | default([]) | length) > 0 }}
  }
}

{% if ansible_facts['os_family'] == "RedHat" %}
# RHEL Specific Config
Listen 80
{% elif ansible_facts['os_family'] == "Debian" %}
# Debian Specific Config
Port 80
{% else %}
# Default
ListenAddress 0.0.0.0:80
{% endif %}

# Upstream Servers
{% for host in groups['web_servers'] %}
server {{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }}:80 check;
{% endfor %}

class FilterModule(object):
    def filters(self):
        return {
            'hex_convert': self.to_hex,
        }

    def to_hex(self, value):
        return hex(int(value))

# HAProxy Backend Config
backend dynamic_web
    balance roundrobin
    {% for host in groups['web_servers'] -%}
    # Node: {{ host }} ({{ loop.index }}/{{ loop.length }})
    server {{ host }} {{ hostvars[host]['ansible_facts']['default_ipv4']['address'] }}:80 check {{ 'backup' if hostvars[host]['is_backup'] | default(false) else '' }}
    {% endfor %}

# 运行 Playbook 时需提供密码过关
ansible-playbook site.yml --ask-vault-pass

# 生成加密字符串
ansible-vault encrypt_string 'my_super_password' --name 'db_password'

db_user: admin
db_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          363836336137666231313331...