Question

我正在尝试在远程主机上执行由Elastic提供的cert-util，但是，它在抱怨剧本的结构，但是，我有一个类似的剧本，可以很好地工作，但看不到区别。我觉得我需要另一双眼睛。

我已经尝试了对剧本顶部的各种更改，例如添加

名称：设置证书

但是，它抱怨-名称。我来自盐背景并且是新手，所以，我感觉好像缺少某种结构。

  hosts: elasticnodes
  become: true

  vars:
    elasticsearch_path_home: "/usr/share/elasticsearch"
    elasticsearch_path_etc: "/etc/elasticsearch"
    elasticsearch_tls_cert_ca_pass: "plop99"
    elasticsearch_tls_cert_pass: "plop99"
    elasticsearch_tls_cert_dir: "certs"
    elasticsearch_user: "elasticsearch"
    elasticsearch_user_group: "elasticsearch"

  tasks:

    - name: Create a certificate directory
      file:
        owner: root
        group: '{{ elasticsearch_user_group }}'
        mode: u=rwx,g+rx,o-rwx
        path: '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'
        state: directory
      when: elasticsearch_tls_cert_dir is defined

    - name: Check a certificate of authority
      stat:
        path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-stack-ca.p12"
        register: elastic_stack_ca_file

    - name: Generate a certificate of authority
      args:
        chdir: '{{ elasticsearch_path_etc }}'
        become: yes
        command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil ca --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --pass '{{ elasticsearch_tls_cert_pass }}'"
      when: not elastic_stack_ca_file.stat.exists

    - name: Check a certificate and private key for a node
      stat:
        path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-certificates.p12"
        register: elastic_certificates_file

    - name: Generate a certificate and private key for a node
      args:
        chdir: '{{ elasticsearch_path_etc }}'
        become: yes
        command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil cert --ca '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --ca-pass '{{ elasticsearch_tls_cert_pass }}' --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-certificates.p12 --pass '{{ elasticsearch_tls_cert_ca_pass }}'"
      when: elastic_stack_ca_file.stat.exists and not elastic_certificates_file.stat.exists

这给出了一个错误

ERROR! A playbook must be a list of plays, got a <class 'ansible.parsing.yaml.objects.AnsibleMapping'> instead

The error appears to be in '/root/elastic/ansible/playbooks/cert_setup.yml': line 2, column 3, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:

  hosts: elasticnodes
  ^ here

但是这样的剧本还是可以的。

# modify the /etc/sysctl.conf file
- name: Configure sysctl.conf and /etc/hosts
  hosts: elasticnodes
  become: true

  vars:
    fqdn: "domain.com"

  tasks:
    - name: Configure sysctl
      sysctl:
        name: "{{ item.name }}"
        value: "{{ item.value }}"
        state: present
        reload: yes
        sysctl_set: yes
      with_items:
         - { name: vm.swappiness, value: 1 }

# modify the /etc/hosts file work in progress
    - name: Build hosts file
      lineinfile:
        dest: /etc/hosts
        regexp: '.*{{ item }}$'
        line: '{{ hostvars[item].ansible_default_ipv4.address }} {{item}}.{{fqdn}} {{item}}'
        state: present
      with_items: '{{ groups["etc_hosts"] }}'

    - name: Update Host Names
      hostname:
        name: "{{ inventory_hostname }}"

# start firewall
    - name: Enable firewalld
      service:
        name: firewalld
        state: started
        enabled: yes

# restart firewall
    - name: Restart firewalld
      service:
        name: firewalld
        state: restarted
        enabled: yes

# Update firewall rules
    - name: Update Firewall Settings
      ansible.posix.firewalld:
        zone: public
        permanent: yes
        immediate: yes
        state: enabled
        port: 9200/tcp

# Update firewall rules
    - name: Update Firewall Settings
      ansible.posix.firewalld:
        zone: public
        permanent: yes
        immediate: yes
        state: enabled
        port: 9300/tcp

我不确定自己想念什么，感觉很明显。

Answer 1

错误为A playbook must be a list of plays。第一个剧本开头缺少-，则您没有列表播放，并且带有args的任务没有模块command。尝试如下。

   -  hosts: elasticnodes
      become: true
    
      vars:
        elasticsearch_path_home: "/usr/share/elasticsearch"
        elasticsearch_path_etc: "/etc/elasticsearch"
        elasticsearch_tls_cert_ca_pass: "plop99"
        elasticsearch_tls_cert_pass: "plop99"
        elasticsearch_tls_cert_dir: "certs"
        elasticsearch_user: "elasticsearch"
        elasticsearch_user_group: "elasticsearch"
    
      tasks:
    
        - name: Create a certificate directory
          file:
            owner: root
            group: '{{ elasticsearch_user_group }}'
            mode: u=rwx,g+rx,o-rwx
            path: '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'
            state: directory
          when: elasticsearch_tls_cert_dir is defined
    
        - name: Check a certificate of authority
          stat:
            path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-stack-ca.p12"
            register: elastic_stack_ca_file
    
        - name: Generate a certificate of authority
          command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil ca --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --pass '{{ elasticsearch_tls_cert_pass }}'"
          args:
            chdir: '{{ elasticsearch_path_etc }}'
            become: yes
          when: not elastic_stack_ca_file.stat.exists
    
        - name: Check a certificate and private key for a node
          stat:
            path: "{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}/elastic-certificates.p12"
            register: elastic_certificates_file
    
        - name: Generate a certificate and private key for a node
          command: "'{{ elasticsearch_path_home }}'/bin/elasticsearch-certutil cert --ca '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-stack-ca.p12 --ca-pass '{{ elasticsearch_tls_cert_pass }}' --out '{{ elasticsearch_path_etc }}/{{ elasticsearch_tls_cert_dir }}'/elastic-certificates.p12 --pass '{{ elasticsearch_tls_cert_ca_pass }}'"
          args:
            chdir: '{{ elasticsearch_path_etc }}'
            become: yes
          when: elastic_stack_ca_file.stat.exists and not elastic_certificates_file.stat.exists

这是将您的剧本命名为第二本剧本的最佳实践，我建议您阅读最佳实践以改善剧本。

https://www.ansible.com/blog/ansible-best-practices-essentials

检查command模块的正式文档。

https://docs.ansible.com/ansible/latest/collections/ansible/builtin/command_module.html

Ansible剧本出现错误

1 个答案: