【自动化运维神器Ansible】Ansible常用模块之File模块详解

• 状态检查：Ansible首先检查远程文件系统对象的当前状态
• 决策比较：将当前状态与期望状态进行比较
• 操作执行：如状态不符，则执行相应操作（创建、删除、修改属性等）
• 结果返回：返回操作执行结果和变更状态

- name: Ensure file exists with permissions
  ansible.builtin.file:
    path: /etc/app/config.conf
    state: touch
    owner: appuser
    group: appgroup
    mode: '0640'

- name: Ensure directory exists
  file:
    path: /opt/app/logs
    state: directory
    mode: '0755'
    recurse: yes  # 递归设置权限

- name: Create symbolic link
  file:
    src: /opt/app/current
    dest: /opt/app/releases/v1.2
    state: link

• recurse参数允许递归修改目录及其内容的属性：

- name: Recursively change ownership
  file:
    path: /opt/app
    owner: appuser
    group: appgroup
    recurse: yes

• File模块可以精确控制文件的时间戳：

- name: Set specific timestamps
  file:
    path: /tmp/timefile
    modification_time: "202308011200.00"
    access_time: "now"  # 特殊值：保留当前时间

• File模块支持多种状态间的转换：

• 权限最小化原则：

- name: Secure configuration file
  file:
    path: /etc/app.conf
    mode: '0640'  # 所有者读写，组只读
    owner: root
    group: appadmin

• 敏感目录保护：

- name: Restrict log directory
  file:
    path: /var/log/app
    mode: '0750'  # 禁止其他用户访问

• 符号链接安全：

- name: Create secure symlink
  file:
    src: /opt/app/secure
    dest: /etc/app_link
    state: link
    follow: no  # 不解析现有链接

• 批量操作优化：

- name: Batch update permissions
  file:
    path: "{{ item }}"
    mode: '0644'
  loop:
    - /path/file1
    - /path/file2
    - /path/file3

• 条件执行：

- name: Only update if owner incorrect
  file:
    path: /opt/app
    owner: appuser
  register: result
  when: ansible_facts['file']['/opt/app']['owner'] != 'appuser'

• 递归操作谨慎使用：

- name: Recursive change with limit
  file:
    path: /large_dir
    owner: newuser
    recurse: yes
  async: 300  # 异步执行防止超时
  poll: 0

- name: Safe file operation
  block:
    - name: Configure file
      file:
        path: /etc/app/config
        state: touch
  rescue:
    - name: Ensure parent exists
      file:
        path: /etc/app
        state: directory
        
    - name: Retry with higher privileges
      become: yes
      file:
        path: /etc/app/config
        state: touch

- name: Prepare application environment
  hosts: app_servers
  tasks:
    - name: Ensure directories exist
      file:
        path: "{{ item }}"
        state: directory
        mode: '0755'
      loop:
        - /opt/app
        - /opt/app/bin
        - /opt/app/logs
        - /opt/app/config

    - name: Set up log rotation
      file:
        path: /etc/logrotate.d/app
        state: touch
        mode: '0644'

- name: Enforce permission compliance
  hosts: all
  vars:
    secure_files:
      - path: /etc/passwd
        mode: '0644'
      - path: /etc/shadow
        mode: '0000'
      - path: /etc/sudoers
        mode: '0440'
  tasks:
    - name: Apply secure permissions
      file:
        path: "{{ item.path }}"
        mode: "{{ item.mode }}"
      loop: "{{ secure_files }}"

- name: Manage log files
  hosts: all
  tasks:
    - name: Ensure log directory exists
      file:
        path: /var/log/app
        state: directory
        mode: '0755'

    - name: Remove old log files
      file:
        path: "/var/log/app/{{ item }}"
        state: absent
      loop: "{{ query('fileglob', '/var/log/app/*.log.*') }}"
      when: "'log' in item"

• 使用become提升权限

- name: Modify protected file
  become: yes
  file:
    path: /etc/sudoers
    mode: '0440'

• 预先检查当前权限

- name: Check current permissions
  stat:
    path: /etc/securefile
  register: file_stat
  
- name: Report permission issue
  debug:
    msg: "Current mode is {{ file_stat.stat.mode }}"
  when: file_stat.stat.mode != '0600'

- name: Safely manage symlink
  file:
    src: /opt/app/current
    dest: /opt/app/link
    state: link
    follow: no  # 明确指定不解析现有链接

- name: Safe recursive change
  file:
    path: /large_dir/subset
    owner: newuser
    recurse: yes
  async: 600
  poll: 0

• 使用with_fileglob进行批量处理：

- name: Update multiple files
  file:
    path: "{{ item }}"
    mode: '0644'
  with_fileglob:
    - /configs/*.conf
    - /scripts/*.sh

• 利用facts减少不必要操作：

- name: Only change if needed
  file:
    path: /opt/app
    owner: appuser
  when: ansible_facts['file']['/opt/app']['owner'] != 'appuser'

• 对于大型文件系统操作：

- name: Recursive change async
  file:
    path: /data
    group: datagroup
    recurse: yes
  async: 1200  # 20分钟超时
  poll: 0  # 不等待完成