安裝及設定 Ansible 來管理 Azure 中的虛擬機器Install and configure Ansible to manage virtual machines in Azure

Ansible 可讓您將環境中的資源部署和設定自動化。Ansible allows you to automate the deployment and configuration of resources in your environment. 您可以使用 Ansible 在 Azure 中管理虛擬機器 (VM),就像是任何其他資源一樣。You can use Ansible to manage your virtual machines (VMs) in Azure, the same as you would any other resource. 本文詳細說明如何針對某些最常見的 Linux 發行版,安裝 Ansible 和必要的 Azure Python SDK 模組。This article details how to install Ansible and the required Azure Python SDK modules for some of the most common Linux distros. 您可以配合特定的平台調整安裝的套件,來將 Ansible 安裝在其他發行版上。You can install Ansible on other distros by adjusting the installed packages to fit your particular platform. 為了以安全的方式建立 Azure 資源,您也將了解如何建立及定義 Ansible 所要使用的認證。To create Azure resources in a secure manner, you also learn how to create and define credentials for Ansible to use.

如需其他平台的更多安裝選項和步驟,請參閱 Ansible 安裝指南For more installation options and steps for additional platforms, see the Ansible install guide.

開啟 Azure Cloud ShellOpen Azure Cloud Shell

Azure Cloud Shell 是免費的互動式 Shell,可讓您用來執行本文中的步驟。Azure Cloud Shell is a free, interactive shell that you can use to run the steps in this article. Cloud Shell 中已預先安裝和設定共用 Azure 工具,以便您搭配自己的帳戶使用。Common Azure tools are preinstalled and configured in Cloud Shell for you to use with your account. 只要選取 [複製] 按鈕即可複製程式碼,將它貼到 Cloud Shell 中,然後按 Enter 鍵加以執行。Just select the Copy button to copy the code, paste it in Cloud Shell, and then press Enter to run it. 以下有幾種開啟 Cloud Shell 的方式:There are a few ways to open Cloud Shell:

選取程式碼區塊右上角的 [試試看]。Select Try It in the upper-right corner of a code block. 本文中的 Cloud Shell
在您的瀏覽器中開啟 Cloud Shell。Open Cloud Shell in your browser. https://shell.azure.com/bash
選取 Azure 入口網站右上角功能表上的 [Cloud Shell] 按鈕。Select the Cloud Shell button on the menu in the upper-right corner of the Azure portal. 入口網站中的 Cloud Shell

如果您選擇在本機安裝和使用 CLI,本文會要求您執行 Azure CLI 2.0.30 版或更新版本。If you choose to install and use the CLI locally, this article requires that you are running the Azure CLI version 2.0.30 or later. 執行 az --version 以尋找版本。Run az --version to find the version. 如果您需要安裝或升級,請參閱安裝 Azure CLI 2.0If you need to install or upgrade, see Install Azure CLI 2.0.

安裝 AnsibleInstall Ansible

搭配 Azure 使用 Ansible 的其中一個最簡單方式是使用 Azure Cloud Shell 這個瀏覽器型的殼層經驗,其可用於管理和開發 Azure 資源。One of the easiest ways to use Ansible with Azure is with the Azure Cloud Shell, a browser-based shell experience to manage and develop Azure resources. Ansible 會預先安裝在 Cloud Shell 中,因此您可以跳過如何安裝 Ansible 的指示,並移至建立 Azure 認證Ansible is pre-installed in the Cloud Shell, so you can skip instructions on how to install Ansible and go to Create Azure credentials. 如需也可在 Cloud Shell 中使用的其他工具清單,請參閱 Azure Cloud Shell 中的 Bash 功能和工具For a list of additional tools also available in the Cloud Shell, see Features and tools for Bash in the Azure Cloud Shell.

下列指示說明如何針對各種散發版本建立 Linux VM,然後再安裝 Ansible。The following instructions show you how to create a Linux VM for various distros and then install Ansible. 如果您不需要建立 Linux VM,請略過這第一個用來建立 Azure 資源群組的步驟。If you don't need to create a Linux VM, skip this first step to create an Azure resource group. 如果您需要建立 VM,則請先使用 az group create 建立資源群組。If you do need to create a VM, first create a resource group with az group create. 下列範例會在 eastus 位置建立名為 myResourceGroup 的資源群組:The following example creates a resource group named myResourceGroup in the eastus location:

az group create --name myResourceGroup --location eastus

現在,選取下列其中一個散發版本,以了解如何在有需要時建立 VM,然後再安裝 Ansible:Now, select one of the following distros for steps on how to create a VM, if needed, and then install Ansible:

CentOS 7.4CentOS 7.4

如有需要,請使用 az vm create 建立 VM。If needed, create a VM with az vm create. 下列範例會建立名為 myVMAnsible 的 VM:The following example creates a VM named myVMAnsible:

az vm create \
    --name myVMAnsible \
    --resource-group myResourceGroup \
    --image OpenLogic:CentOS:7.4:latest \
    --admin-username azureuser \
    --generate-ssh-keys

使用 VM 建立作業中的輸出所記錄的 publicIpAddress SSH 到您的 VM:SSH to your VM using the publicIpAddress noted in the output from the VM create operation:

ssh azureuser@<publicIpAddress>

在您的 VM 上,安裝 Azure Python SDK 模組和 Ansible 所需的套件,如下所示:On your VM, install the required packages for the Azure Python SDK modules and Ansible as follows:

## Install pre-requisite packages
sudo yum check-update; sudo yum install -y gcc libffi-devel python-devel openssl-devel epel-release
sudo yum install -y python-pip python-wheel

## Install Ansible and Azure SDKs via pip
sudo pip install ansible[azure]

現在繼續前往建立 Azure 認證Now move on to Create Azure credentials.

Ubuntu 16.04 LTSUbuntu 16.04 LTS

如有需要,請使用 az vm create 建立 VM。If needed, create a VM with az vm create. 下列範例會建立名為 myVMAnsible 的 VM:The following example creates a VM named myVMAnsible:

az vm create \
    --name myVMAnsible \
    --resource-group myResourceGroup \
    --image Canonical:UbuntuServer:16.04-LTS:latest \
    --admin-username azureuser \
    --generate-ssh-keys

使用 VM 建立作業中的輸出所記錄的 publicIpAddress SSH 到您的 VM:SSH to your VM using the publicIpAddress noted in the output from the VM create operation:

ssh azureuser@<publicIpAddress>

在您的 VM 上,安裝 Azure Python SDK 模組和 Ansible 所需的套件,如下所示:On your VM, install the required packages for the Azure Python SDK modules and Ansible as follows:

## Install pre-requisite packages
sudo apt-get update && sudo apt-get install -y libssl-dev libffi-dev python-dev python-pip

## Install Ansible and Azure SDKs via pip
sudo pip install ansible[azure]

現在繼續前往建立 Azure 認證Now move on to Create Azure credentials.

SLES 12 SP2SLES 12 SP2

如有需要,請使用 az vm create 建立 VM。If needed, create a VM with az vm create. 下列範例會建立名為 myVMAnsible 的 VM:The following example creates a VM named myVMAnsible:

az vm create \
    --name myVMAnsible \
    --resource-group myResourceGroup \
    --image SUSE:SLES:12-SP2:latest \
    --admin-username azureuser \
    --generate-ssh-keys

使用 VM 建立作業中的輸出所記錄的 publicIpAddress SSH 到您的 VM:SSH to your VM using the publicIpAddress noted in the output from the VM create operation:

ssh azureuser@<publicIpAddress>

在您的 VM 上,安裝 Azure Python SDK 模組和 Ansible 所需的套件,如下所示:On your VM, install the required packages for the Azure Python SDK modules and Ansible as follows:

## Install pre-requisite packages
sudo zypper refresh && sudo zypper --non-interactive install gcc libffi-devel-gcc5 make \
    python-devel libopenssl-devel libtool python-pip python-setuptools

## Install Ansible and Azure SDKs via pip
sudo pip install ansible[azure]

# Remove conflicting Python cryptography package
sudo pip uninstall -y cryptography

現在繼續前往建立 Azure 認證Now move on to Create Azure credentials.

建立 Azure 認證Create Azure credentials

Ansible 會使用使用者名稱與密碼或服務主體與 Azure 進行通訊。Ansible communicates with Azure using a username and password or a service principal. Azure 服務主體是安全性識別,可供您與應用程式、服務及諸如 Ansible 等自動化工具搭配使用。An Azure service principal is a security identity that you can use with apps, services, and automation tools like Ansible. 您可以控制和定義對於服務主體可以在 Azure 中執行哪些作業的權限。You control and define the permissions as to what operations the service principal can perform in Azure. 為了提高只提供使用者名稱和密碼的安全性,此範例會建立基本的服務主體。To improve security over just providing a username and password, this example creates a basic service principal.

在主機電腦上或在 Azure Cloud Shell 中,使用 az ad sp create-for-rbac 建立服務主體。On your host computer or in the Azure Cloud Shell, create a service principal using az ad sp create-for-rbac. Ansible 所需的認證會輸出到螢幕上:The credentials that Ansible needs are output to the screen:

az ad sp create-for-rbac --query '{"client_id": appId, "secret": password, "tenant": tenant}'

上述命令的輸出範例如下所示:An example of the output from the preceding commands is as follows:

{
  "client_id": "eec5624a-90f8-4386-8a87-02730b5410d5",
  "secret": "531dcffa-3aff-4488-99bb-4816c395ea3f",
  "tenant": "72f988bf-86f1-41af-91ab-2d7cd011db47"
}

若要向 Azure 驗證,您也需要使用 az account show 取得 Azure 訂用帳戶識別碼:To authenticate to Azure, you also need to obtain your Azure subscription ID using az account show:

az account show --query "{ subscription_id: id }"

您將在下一個步驟中使用這兩個命令的輸出。You use the output from these two commands in the next step.

建立 Ansible 認證檔案Create Ansible credentials file

若要提供認證給 Ansible,您可以定義環境變數或建立本機認證檔案。To provide credentials to Ansible, you define environment variables or create a local credentials file. 如需如何定義 Ansible 認證的詳細資訊,請參閱 Providing Credentials to Azure Modules (提供認證給 Azure 模組)。For more information about how to define Ansible credentials, see Providing Credentials to Azure Modules.

針對開發環境,在您的主機 VM 上建立 Ansible 的「認證」檔案。For a development environment, create a credentials file for Ansible on your host VM. 在上一個步驟的 Ansible 安裝所在 VM 上建立認證檔案:Create a credentials file on the VM where you installed Ansible in a previous step:

mkdir ~/.azure
vi ~/.azure/credentials

「認證」檔案本身結合了訂用帳戶識別碼與建立服務主體的輸出。The credentials file itself combines the subscription ID with the output of creating a service principal. 為了符合 client_id、secret 和 tenant 所需,先前 az ad sp create-for-rbac 命令的輸出內容必須相同。Output from the previous az ad sp create-for-rbac command is the same as needed for client_id, secret, and tenant. 下列範例認證檔案顯示符合上述輸出的值。The following example credentials file shows these values matching the previous output. 輸入您自己的值,如下所示︰Enter your own values as follows:

[default]
subscription_id=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
client_id=eec5624a-90f8-4386-8a87-02730b5410d5
secret=531dcffa-3aff-4488-99bb-4816c395ea3f
tenant=72f988bf-86f1-41af-91ab-2d7cd011db47

儲存並關閉檔案。Save and close the file.

使用 Ansible 環境變數Use Ansible environment variables

如果您想要使用 Ansible Tower 或 Jenkins 等工具,則需要定義環境變數。If you are going to use tools such as Ansible Tower or Jenkins, you need to define environment variables. 如果您就只要使用 Ansible 用戶端和上一個步驟所建立的 Azure 認證檔案,則可以略過此步驟。This step can be skipped if you are just going to use the Ansible client and the Azure credentials file created in the previous step. 環境變數會定義和 Azure 認證檔案相同的資訊:Environment variables define the same information as the Azure credentials file:

export AZURE_SUBSCRIPTION_ID=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export AZURE_CLIENT_ID=eec5624a-90f8-4386-8a87-02730b5410d5
export AZURE_SECRET=531dcffa-3aff-4488-99bb-4816c395ea3f
export AZURE_TENANT=72f988bf-86f1-41af-91ab-2d7cd011db47

後續步驟Next steps

您現在已安裝 Ansible 和必要的 Azure Python SDK 模組,並已定義 Ansible 所要使用的認證。You now have Ansible and the required Azure Python SDK modules installed, and credentials defined for Ansible to use. 了解如何使用 Ansible 建立 VMLearn how to create a VM with Ansible. 您也可以了解如何使用 Ansible 建立完整的 Azure VM 和支援資源You can also learn how to create a complete Azure VM and supporting resources with Ansible.