配置nginx反向代理 部署keepalived实现高可用 vip漂移

实现 ：配置nginx反向代理kube-apiserver的6443端口到本地的7443端口，利用keepalived检测脚本，检测端口的有无，实现keepalived高可用

ip	role
10.4.7.11	nginx:80,7443和keepalived
104.7.12	nginx:80,7443和keepalived
10.4.7.21	kube-apiserver:6443
10.4.7.22	kube-apiserver:6443
10.4.7.10	vip

1.nginx反向代理kube-apiserver

nginx反向代理kube-apiserver的6443端口到本地的7443端口

# 将此段插入到nginx.conf的最后，注意
stream {
    upstream kube-apiserver {
        server 10.4.7.21:6443   max_fails=3 fail_timeout=30s;
        server 10.4.7.22:6443   max_fails=3 fail_timeout=30s;
    }
    server {
        listen 7443; #映射到本地的7443端口
        proxy_connect_timeout 2s;
        proxy_timeout 900s;
        proxy_pass kube-apiserver;
    }
}

2.keepalived编写脚本检测7443端口实现高可用

keepalived编写script检测nginx反向代理映射到本地的7443端口，当7443端口down掉的时候，实现高可用，vip飘移到keepalived-BACKUP上

2.1 keepalived-MASTER（主）

! Configuration File for keepalived

global_defs {
    router_id 10.4.7.11 #当前节点主机标识符，全局唯一
    script_user root #脚本执行者
    enable_script_security #标记脚本安全
}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_port.sh 7443" #脚本路径
    interval 2 #脚本执行间隔，单位s
    weight -20 #-254-254之间
}

vrrp_instance VI_1 { #实例名
    state MASTER #当前keepalived状态
    interface ens33
    virtual_router_id 251 #主备需一致
    priority 100
    advert_int 1 #发送VRRP通告间隔，单位s
    mcast_src_ip 10.4.7.11 #指定发送组播数据包的源ip地址，默认是绑定VRRP实例的接口的主ip地址，一般就是本机的ip
    nopreempt #设置非抢占模式，原本高优先级的MASER恢复之后，不会去抢现在是低优先级BACKUP

    authentication {
        auth_type PASS #主备验证信息，需一直
        auth_pass 123456 
    }
    track_script {
        chk_nginx #调用脚本,若脚本最后的执行结果是非0的，则判断端口down掉，此时vip会漂移到keepalived-BACKUP上
    }
    virtual_ipaddress {
        10.4.7.10 #vip
    }
}

2.2 keepalived-BACKUP（备）

! Configuration File for keepalived

global_defs {
    router_id 10.4.7.12
    script_user root
    enable_script_security
}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_port.sh 7443"
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 251
    mcast_src_ip 10.4.7.12
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    track_script {
        chk_nginx
    }
    virtual_ipaddress {
        10.4.7.10
    }
}

2.3 check-SCRIPT

#!/bin/bash
CHK_PORT=$1
if [ -n "$CHK_PORT" ];then
        PORT_PROCESS=`netstat -ntulp | grep $CHK_PORT | wc -l`
        if [ $PORT_PROCESS -eq 0 ];then
                echo "Port $CHK_PORT Is Not Used,End."
                exit 1
        fi
else
        echo "Check Port Can't Be Empty!"
fi