MySQL MHA 구성을 위한 공개키 공유 Ansible

 Ansible Role로 구성하여 실행하는 MHA 자동화 구성 중 공개키 공유를 위한 playbook 부분을 발췌하였습니다.

 구성되어야 할 서버들에 대해 MHA 동작이 가능하게 하려면 공개키를 미리 생성하여 배포하고 ssh로 동작이 가능한 명령을 실행하게 됩니다. 이 때 사용되는 공개키는 각각의 서버에서 생성하고 known_hosts에 등록하게 되는데 이 작업을 매번 처리하다 보면 실수가 발생할 수 있어 MHA 구성을 위한 공개키 공유 부분부터 모두 Ansible을 통해 구성이 가능하도록 작성하였습니다.

 

defaults

main.yml

mha_ip_host:
  "ip1" : "host명1"
  "ip2" : "host명2"
  "ip3" : "host명3"
  "ip4" : "host명4"
  "ip5" : "host명5"
  
 linux_user: "mhauser"
 linux_DB_user: "mysql"

 

tasks

share_public_key.yml

- name: delete mhaserver group if exists in /etc/hosts file
  lineinfile:
    path: /etc/hosts
    regex: "{{ item.value }}"
    state: absent
  loop: "{{ lookup('ansible.builtin.dict', mha_ip_host) }}"
  
  - name: Add mhaserver group to /etc/hosts file
    lineinfile:
      path: /etc/hosts
      line: "{{ item.key }} {{ item.value }}"
      state: present
    loop: "{{ lookup('ansible.builtin.dict', mha_ip_host }}"
    
  - name: Delete user mhauser if exists
    user:
      name: "{{ linux_user }}"
      state: absent
      remove: true
  
 - name: Create group
   group:
     name: "{{ linux_user }}"
      state: present
 
 - name: "[mhamanager] Create mha user"
   user:
     name: "{{ linux_user }}"
     group: "{{ linux_user }}"
     password: "{{ '비밀번호' | password_hash('sha512') }}"
     generate_ssh_key: true
     update_password: on_create
     expires: -1
     shell: /bin/bash
   register: mha_manager_user
   when: group_names[0]=='mha_manager'
   
  - name: "[mha_node] Create mha user"
    user:
     name: "{{ linux_user }}"
     group: "{{ linux_DB_user }}"
     password: "{{ '비밀번호' | password_hash('sha512') }}"
     generate_ssh_key: true
     update_password: on_create
     expires: -1
     shell: /bin/bash
   register: mha_manager_user
   when: "'mha_node' in group_names"
   
  - name: "[mha_manager] populate mha_manager_user ssh publick key"
    authorized_key:
      user: "{{ linux_user }}"
      key: "{{ hostvars[item]['mha_manager_user']['ssh_public_key'] }}"
    loop: "{{ groups['mha_manager'] | sort }}"
    
  - name: "[mha_node] populate mha_node_user ssh public key"
    authorized_key:
      user: "{{ linux_user }}"
      key: "{{ hostvars[item]['mha_manager_user']['ssh_public_key'] }}"
    loop: "{{ groups['mha_node'] | sort }}"
    
  - name: touch known_hosts file
    file:
      path: /home/mhauser/.ssh/known_hosts
      state: touch
      owner: "{{ linux_user }}"
      group: "{{ linux_user }}"
      mode: u=rw,g=r,o=r
      
  - name: get keys
    shell: |
       ssh-keyscan -t rsa -H {{ hostvars[item].ansible_hostname }}
    loop: "{{ groups['all'] | sort }}"
    register: host_keys
    
  - name: set as known hosts
    copy:
      content: "{{ host_keys.result | map(attribute='stdout')|join('\n') }}"
      dest: "/home/mhauser/.ssh/known_hosts"
      
  - name: run chage mhauser for change expired date
    shell: |
      chage -E -1 -M 99999 "{{ linux_user }}"
    loop: "{{ groups['all'] | sort }}"