0
点赞
收藏
分享

微信扫一扫

Nginx+Keepalived Kubernetes 负载均衡

火热如冰 04-14 19:30 阅读 1
linux服务器网络

部署Nginx+Keepalived高可用负载均衡器  kube-apiserver高可用架构图：

  • Nginx是一个主流Web服务和反向代理服务器，这里用四层实现对apiserver实现负载均衡。
  • Keepalived是一个主流高可用软件，基于VIP绑定实现服务器双机热备，在上述拓扑中，Keepalived主要根据Nginx运行状态判断是否需要故障转移（漂移VIP），例如当Nginx主节点挂掉，VIP会自动绑定在Nginx备节点，从而保证VIP一直可用，实现Nginx高可用。

在两台Master节点操作。 

1. 安装软件包（主/备） 

 yum install epel-release -y
 yum install nginx keepalived -y

2. Nginx配置文件（主/备一样）

cat > /etc/nginx/nginx.conf << "EOF"
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

# 四层负载均衡，为两台Master apiserver组件提供负载均衡
stream {

    log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';

    access_log  /var/log/nginx/k8s-access.log  main;

    upstream k8s-apiserver {
       server 192.168.31.71:6443;   # Master1 APISERVER IP:PORT
       server 192.168.31.72:6443;   # Master2 APISERVER IP:PORT
    }
    
    server {
       listen 16443; # 由于nginx与master节点复用，这个监听端口不能是6443，否则会冲突
       proxy_pass k8s-apiserver;
    }
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    server {
        listen       80 default_server;
        server_name  _;

        location / {
        }
    }
}
EOF

3. keepalived配置文件（Nginx Master）

cat > /etc/keepalived/keepalived.conf << EOF
global_defs { 
   notification_email { 
     acassen@firewall.loc 
     failover@firewall.loc 
     sysadmin@firewall.loc 
   } 
   notification_email_from Alexandre.Cassen@firewall.loc  
   smtp_server 127.0.0.1 
   smtp_connect_timeout 30 
   router_id NGINX_MASTER
} 

vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
}

vrrp_instance VI_1 { 
    state MASTER 
    interface ens33  # 修改为实际网卡名
    virtual_router_id 51 # VRRP 路由 ID实例，每个实例是唯一的 
    priority 100    # 优先级，备服务器设置 90 
    advert_int 1    # 指定VRRP 心跳包通告间隔时间，默认1秒 
    authentication { 
        auth_type PASS      
        auth_pass 1111 
    }  
    # 虚拟IP
    virtual_ipaddress { 
        192.168.31.88/24
    } 
    track_script {
        check_nginx
    } 
}
EOF
  •  vrrp_script：指定检查nginx工作状态脚本（根据nginx状态判断是否故障转移）
  • virtual_ipaddress：虚拟IP（VIP）

准备上述配置文件中检查nginx运行状态的脚本：

cat > /etc/keepalived/check_nginx.sh  << "EOF"
#!/bin/bash
count=$(ss -antp |grep 16443 |egrep -cv "grep|$$")

if [ "$count" -eq 0 ];then
    exit 1
else
    exit 0
fi
EOF
chmod +x /etc/keepalived/check_nginx.sh

4. keepalived配置文件（Nginx Backup）

cat > /etc/keepalived/keepalived.conf << EOF
global_defs { 
   notification_email { 
     acassen@firewall.loc 
     failover@firewall.loc 
     sysadmin@firewall.loc 
   } 
   notification_email_from Alexandre.Cassen@firewall.loc  
   smtp_server 127.0.0.1 
   smtp_connect_timeout 30 
   router_id NGINX_BACKUP
} 

vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
}

vrrp_instance VI_1 { 
    state BACKUP 
    interface ens33
    virtual_router_id 51 # VRRP 路由 ID实例，每个实例是唯一的 
    priority 90
    advert_int 1
    authentication { 
        auth_type PASS      
        auth_pass 1111 
    }  
    virtual_ipaddress { 
        192.168.31.88/24
    } 
    track_script {
        check_nginx
    } 
}
EOF

 准备上述配置文件中检查nginx运行状态的脚本：

cat > /etc/keepalived/check_nginx.sh  << "EOF"
#!/bin/bash
count=$(ss -antp |grep 16443 |egrep -cv "grep|$$")

if [ "$count" -eq 0 ];then
    exit 1
else
    exit 0
fi
EOF
chmod +x /etc/keepalived/check_nginx.sh

 5. 启动并设置开机启动

systemctl daemon-reload
systemctl start nginx keepalived
systemctl enable nginx keepalived

6. 查看keepalived工作状态

ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:04:f7:2c brd ff:ff:ff:ff:ff:ff
    inet 192.168.31.80/24 brd 192.168.31.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet 192.168.31.88/24 scope global secondary ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe04:f72c/64 scope link 
       valid_lft forever preferred_lft forever

可以看到，在ens33网卡绑定了192.168.31.88 虚拟IP，说明工作正常。

7. Nginx+Keepalived高可用测试
关闭主节点Nginx，测试VIP是否漂移到备节点服务器。 在Nginx Master执行 pkill nginx；在Nginx Backup，ip addr命令查看已成功绑定VIP。 

 8. 访问负载均衡器测试
找K8s集群中任意一个节点，使用curl查看K8s版本测试，使用VIP访问：

curl -k https://192.168.31.88:16443/version
{
  "major": "1",
  "minor": "20",
  "gitVersion": "v1.20.4",
  "gitCommit": "e87da0bd6e03ec3fea7933c4b5263d151aafd07c",
  "gitTreeState": "clean",
  "buildDate": "2021-02-18T16:03:00Z",
  "goVersion": "go1.15.8",
  "compiler": "gc",
  "platform": "linux/amd64"
}

可以正确获取到K8s版本信息，说明负载均衡器搭建正常。该请求数据流程：curl -> vip(nginx) -> apiserver，通过查看Nginx日志也可以看到转发apiserver IP：

tail /var/log/nginx/k8s-access.log -f
192.168.31.71 192.168.31.71:6443 - [02/Apr/2021:19:17:57 +0800] 200 423
192.168.31.71 192.168.31.72:6443 - [02/Apr/2021:19:18:50 +0800] 200 423

到此还没结束，还有下面最关键的一步。

7.3 修改所有Worker Node连接LB VIP
试想下，虽然我们增加了Master2 Node和负载均衡器，但是我们是从单Master架构扩容的，也就是说目前所有的Worker Node组件连接都还是Master1 Node，如果不改为连接VIP走负载均衡器，那么Master还是单点故障。

因此接下来就是要改所有Worker Node（kubectl get node命令查看到的节点）组件配置文件，由原来192.168.31.71修改为192.168.31.88（VIP）。

在所有Worker Node执行：

sed -i 's#192.168.31.71:6443#192.168.31.88:16443#' /opt/kubernetes/cfg/*
systemctl restart kubelet kube-proxy

 检查节点状态：

kubectl get node
NAME         STATUS   ROLES    AGE   VERSION
k8s-master1   Ready    <none>   32d   v1.20.4
k8s-master2   Ready    <none>   10m   v1.20.4
k8s-node1    Ready    <none>   31d   v1.20.4
k8s-node2    Ready    <none>   31d   v1.20.4

 至此，一套完整的 Kubernetes 高可用集群就部署完成了！

 -------------------------------------------------------------------------------------------------------------------------------

[apps@TLVM202016131 conf]$ cat nginx.conf
#user  nobody;
worker_processes  auto;
worker_cpu_affinity    auto;
worker_rlimit_nofile    262144;
error_log  logs/error.log;

pid        sbin/nginx.pid;


events {
    use epoll;
    #accept_mutex off
    worker_connections  65536;
}

stream {

    log_format basic '$remote_addr [$time_local] '
              '$protocol $server_addr $server_port $status $bytes_sent $bytes_received '
              '$session_time';

    include conf.d/*.tcp;
}



http {
    vhost_traffic_status_zone shared:vhost_traffic_status:64m;
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    server_tokens    off;
    #gzip  on;
    #gzip_min_length 2k;
    #gzip_types text/plain application/x-javascript text/css application/xml text/javascript;
    #client_body_buffer_size 512k;
    #client_header_buffer_size 16k;
    #large_client_header_buffers 4 16k;
    #client_max_body_size 100m;
    #proxy_ignore_client_abort on;
    #proxy_set_header Host $host;
    #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    include rule.d/*.conf;
    include conf.d/*.conf;
}

[apps@TLVM202016131 conf]$ ls conf.d/bak/
00-default.conf  apiserver.tcp    coredns.tcp    


[apps@TLVM202016131 bak]$ cat apiserver.tcp 
#---------- 20231113 k8s-uat ----------#
    upstream apiserver {
        #hash $remote_addr consistent;
        server 10.202.17.17:6443 max_fails=3 fail_timeout=1s;
        server 10.202.17.18:6443 max_fails=3 fail_timeout=1s;
        server 10.202.17.19:6443 max_fails=3 fail_timeout=1s;
    }

    server {
        listen 6443;
        access_log logs/tcp.log basic;
        proxy_connect_timeout 1s;
        proxy_timeout 3600s;
        proxy_pass apiserver;
    }
举报

相关推荐

nginx+keepalived实现nginx双主高可用的负载均衡

运维后端前端ViewUInginxPython后端开发

基于nginx+keepalived的负载均衡、高可用web集群

nginx负载均衡keepalived计算机网络linux运维yyds干货盘点

Keepalived+Nginx负载均衡+web实验

nginxkeepalived高可用Linux系统/运维

Nginx+Keepalived高可用

microServicejava高级开发

LVS+Keepalived+Nginx高可用负载均衡（主要Keepalived）

nginx负载均衡

Kubernetes——多节点master部署（负载均衡+keepalived）

高可用负载均衡nginxLinux系统/运维

Nginx+keepalived实现高可用

Nginx转载部分

nginx负载均衡案例和高可用keepalived

日记本转载部分

Nginx+Keepalived高可用之Docker

microServicejava高级开发

Nginx+Keepalived实现站点高可用

nginx优先级高可用HarmonyOS后端开发
0 条评论