9.k8s主控节点-部署L4高可用反向代理服务

以你之姓@ 2022-10-17 00:42 128阅读 0赞

> VIP、keepalive、L4反向代理  
> node10、node11、node12

> 相关资料：  
> [Keepalived之——Keepalived + Nginx 实现高可用 Web 负载均衡][Keepalived_Keepalived _ Nginx _ Web]  
> [高可用实践——Keepalived踩坑记录][Keepalived]  
> [Keepalived原理][Keepalived 1]

### k8s主控节点-部署L4反向代理服务 ###

#### 安装nginx ####

#### nginx 4层代理配置 ####

> nginx http段中是7L代理配置，注意不要配置到http段下  
> `vi /etc/nginx/nginx.conf`

stream {
        upstream kube-apiserver {
            server 172.10.10.21:6443     max_fails=3 fail_timeout=30s;
            server 172.10.10.22:6443     max_fails=3 fail_timeout=30s;
        }
        server {
            listen 7443;
            proxy_connect_timeout 2s;
            proxy_timeout 900s;
            proxy_pass kube-apiserver;
        }
    }

node11和node12上分别配置4L代理，负载node21和node22的kube-apiserver

### keepalived ###

#### 编写检查脚本 ####

`vi /etc/keepalived/check_port.sh`

#!/bin/bash
    CHK_PORT=$1
    if [ -n "$CHK_PORT" ];then
            PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l`
            if [ $PORT_PROCESS -eq 0 ];then
                    echo "Port $CHK_PORT Is Not Used,End."
                    exit 1
            fi
    else
            echo "Check Port Cant Be Empty!"
    fi

该脚本用于keepalived调用，通过ss命令查看7443端口是否监听，判断上文nginx是否正常

#### 安装keepalived ####

`yum install keepalived`

#### 配置 ####

`vi /etc/keepalived/keepalived.conf`

! Configuration File for keepalived
    global_defs {
        ## 标识本节点的字条串，通常为 hostname
        router_id 172.10.10.12
    }
    vrrp_script chk_nginx {
        script "/etc/keepalived/check_port.sh 7443"
        interval 2
        weight -20
    }
    ## 定义虚拟路由， VI_1 为虚拟路由的标示符，自己定义名称
    vrrp_instance VI_1 {
        state BACKUP
        interface ens33
        virtual_router_id 251
        mcast_src_ip 172.10.10.12
        priority 90
        advert_int 1
        authentication {
            auth_type PASS
            auth_pass 11111111
        }
        track_script {
            chk_nginx
        }
        virtual_ipaddress {
            172.10.10.10
        }
    }

**注意`state`参数，主节点配置成`MASTER`，备节点配置成`BACKUP`**  
`vrrp_script chk_nginx` 配置一个名为chk\_nginx的脚本，在后续vrrp\_instance虚拟路由中配置使用  
上数配置，正常情况下MASTER服务器接管VIP成为【主】，当M服务器宕机后，BACKUP服务器接管VIP成为【主】，已达到灾备的效果，如果M服务器再次恢复正常，那么M服务器会重新抢回VIP成为【主】 B服务器变成【备】。  
若需VIP不随意飘动需配置nopreempt参数  
vrrp\_instance下配置项：`nopreempt`设置当前节点为非抢占式的  
资料：[Keepalived 设置master故障恢复后不重新抢回VIP(解决nopreempt无效)][Keepalived _master_VIP_nopreempt]

`systemctl start keepalived` 启动keepalived  
`nginx reload`

### 演示 ###

![在这里插入图片描述][20210531162705210.gif]

说明:

1.  通过node10访问nginx（node11和node12）
2.  初始时，node11为\[主\]，流量流向node11
3.  node11停掉nginx后，node12抢占VIP，流量流向node12
4.  node11再次启动nginx，此时VIP不会被node11抢占，因为此案例node11和node12的priority都设置成90了
5.  node12停掉nginx后，node11才会抢占VIP，获取流量

[Keepalived_Keepalived _ Nginx _ Web]: https://blog.csdn.net/l1028386804/article/details/72801492
[Keepalived]: https://zhuanlan.zhihu.com/p/148136167
[Keepalived 1]: https://blog.csdn.net/qq_24336773/article/details/82143367
[Keepalived _master_VIP_nopreempt]: https://blog.csdn.net/nimasike/article/details/52463806
[20210531162705210.gif]: /images/20221014/99fdfb9472d74aeba14a527f71b66555.png