k8s-部署-08-nginx-L4层反向代理

k8s-部署-08-nginx-L4层反向代理

1、部署主机

 

 2、nginx安装部署

# 1、安装nginx
yum install -y nginx
yum install nginx-mod-stream -y

# 2、修改配置文件，在 /etc/nginx/nginx.conf 最后添加如下内容
stream {
    upstream kube-apiserver {
        server 10.4.7.21:6443     max_fails=3 fail_timeout=30s;
        server 10.4.7.22:6443     max_fails=3 fail_timeout=30s;
    }
    server {
        listen 7443;
        proxy_connect_timeout 2s;
        proxy_timeout 900s;
        proxy_pass kube-apiserver;
    }
}

# 2、启动nginx
nginx -t 
systemctl start nginx
systemctl enable nginx

 3、安装keepalived

# 1、安装keepalived
yum install -y keepalived

# 2、添加监控脚本。注意 10.4.7.11 和 10.4.7.12 上的脚本不一样
# 10.4.7.12
[root@hdss7-12 ~]# cat /etc/keepalived/check_port.sh 
#!/bin/bash
#keepalived 监控端口脚本
#使用方法：
#在keepalived的配置文件中
#vrrp_script check_port {#创建一个vrrp_script脚本,检查配置
#    script "/etc/keepalived/check_port.sh 6379" #配置监听的端口
#    interval 2 #检查脚本的频率,单位（秒）
#}
CHK_PORT=$1
if [ -n "$CHK_PORT" ];then
        PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l`
        if [ $PORT_PROCESS -eq 0 ];then
                echo "Port $CHK_PORT Is Not Used,End."
                exit 1
        fi
else
        echo "Check Port Cant Be Empty!"
fi
[root@hdss7-12 ~]# 

# 10.4.7.11
[root@hdss7-11 ~]# cat /etc/keepalived/check_port.sh 
#!/bin/bash
#keepalived 监控端口脚本
#使用方法：
#在keepalived的配置文件中
#vrrp_script check_port {#创建一个vrrp_script脚本,检查配置
#    script "/etc/keepalived/check_port.sh 6379" #配置监听的端口
#    interval 2 #检查脚本的频率,单位（秒）
#}
CHK_PORT=$1
if [ -n "$CHK_PORT" ];then
        PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l`
        if [ $PORT_PROCESS -eq 0 ];then
                echo "Port $CHK_PORT Is Not Used,End."
                exit 1
        fi
else
        echo "Check Port Cant Be Empty!"
fi

# 3、脚本添加可执行权限
chmod +x check_port.sh

# 4、修改keepalived.conf 
# 10.4.7.12
[root@hdss7-12 ~]# cat /etc/keepalived/keepalived.conf 
! Configuration File for keepalived
global_defs {
        router_id 10.4.7.12
        script_user root
        enable_script_security 
}
vrrp_script chk_nginx {
        script "/etc/keepalived/check_port.sh 7443"
        interval 2
        weight -20
}
vrrp_instance VI_1 {
        state BACKUP
        interface ens33
        virtual_router_id 251
        mcast_src_ip 10.4.7.12
        priority 90
        advert_int 1
        authentication {
                auth_type PASS
                auth_pass 11111111
        }
        track_script {
                chk_nginx
        }
        virtual_ipaddress {
                10.4.7.10
        }
}

# 10.4.7.11 
[root@hdss7-11 ~]# cat /etc/keepalived/keepalived.conf 
! Configuration File for keepalived

global_defs {
   router_id 10.4.7.11

}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_port.sh 7443"
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 251
    priority 100
    advert_int 1
    mcast_src_ip 10.4.7.11
    nopreempt

    authentication {
        auth_type PASS
        auth_pass 11111111
    }
    track_script {
         chk_nginx
    }
    virtual_ipaddress {
         10.4.7.10
    }
}

# 启动keepalived
systemctl start keepalived
systemctl enable keepalived
systemctl status keepalived

# 注意：如果vip出现变动，主keepalived恢复后，一定要确认主keepalived端口起来， 服务搞好，重启keepalived，是vip变回主keepalived

# 在10.4.7.11 上查看VIP地址
[root@hdss7-11 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:cc:17:ca brd ff:ff:ff:ff:ff:ff
    inet 10.4.7.11/24 brd 10.4.7.255 scope global ens33
       valid_lft forever preferred_lft forever
    inet 10.4.7.10/32 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fecc:17ca/64 scope link 
       valid_lft forever preferred_lft forever
[root@hdss7-11 ~]#