k8s高可用集群安装：HAProxy及Keepalived部署

淡淡的烟草味﹌ 2024-02-17 08:32 44阅读 0赞

## 四、HAProxy及Keepalived部署 ##

### 4.1 HAProxy及keepalived安装 ###

[root@master01 ~]# yum -y install haproxy keepalived

[root@master02 ~]# yum -y install haproxy keepalived

### 4.2 HAProxy配置及启动 ###

[root@master01 ~]# vim /etc/haproxy/haproxy.cfg
    [root@master01 ~]# cat /etc/haproxy/haproxy.cfg
    #---------------------------------------------------------------------
    # Example configuration for a possible web application.  See the
    # full configuration options online.
    #
    #
    #---------------------------------------------------------------------
    
    #---------------------------------------------------------------------
    # Global settings
    #---------------------------------------------------------------------
    global
      maxconn  2000
      ulimit-n  16384
      log  127.0.0.1 local0 err
      stats timeout 30s
    
    defaults
      log global
      mode  http
      option  httplog
      timeout connect 5000
      timeout client  50000
      timeout server  50000
      timeout http-request 15s
      timeout http-keep-alive 15s
    
    frontend monitor-in
      bind *:33305
      mode http
      option httplog
      monitor-uri /monitor
    
    frontend k8s-master
      bind 0.0.0.0:16443
      bind 127.0.0.1:16443
      mode tcp
      option tcplog
      tcp-request inspect-delay 5s
      default_backend k8s-master
    
    backend k8s-master
      mode tcp
      option tcplog
      option tcp-check
      balance roundrobin
      default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100
      server master01   192.168.10.11:6443  check
      server master02   192.168.10.12:6443  check
      server master03   192.168.10.13:6443  check

[root@master01 ~]# systemctl enable haproxy;systemctl start haproxy
    
    [root@master01 ~]# systemctl status haproxy

![在这里插入图片描述][74db9e5f682e4b8ca648c79d09590802.png]

[root@master01 ~]# scp /etc/haproxy/haproxy.cfg master02:/etc/haproxy/haproxy.cfg

[root@master02 ~]# systemctl enable haproxy;systemctl start haproxy
    
    [root@master02 ~]# systemctl status haproxy

![在这里插入图片描述][373a53770c3946c892b4947658675d15.png]

### 4.3 Keepalived配置及启动 ###

[root@master01 ~]# vim /etc/keepalived/keepalived.conf
    [root@master01 ~]# cat /etc/keepalived/keepalived.conf
    ! Configuration File for keepalived
    global_defs {
        
        router_id LVS_DEVEL
    script_user root
        enable_script_security
    }
    vrrp_script chk_apiserver {
        
        script "/etc/keepalived/check_apiserver.sh" #此脚本需要多独定义，并要调用。
        interval 5
        weight -5
        fall 2
    rise 1
    }
    vrrp_instance VI_1 {
        
        state MASTER
        interface ens33 # 修改为正在使用的网卡
        mcast_src_ip 192.168.10.11 #为本master主机对应的IP地址
        virtual_router_id 51
        priority 101
        advert_int 2
        authentication {
        
            auth_type PASS
            auth_pass abc123
        }
        virtual_ipaddress {
        
            192.168.10.100 #为VIP地址
        }
        track_script {
        
           chk_apiserver # 执行上面检查apiserver脚本
        }
    }

[root@master01 ~]# vim /etc/keepalived/check_apiserver.sh
    [root@master01 ~]# cat /etc/keepalived/check_apiserver.sh
    #!/bin/bash
    
    err=0
    for k in $(seq 1 3)
    do
        check_code=$(pgrep haproxy)
        if [[ $check_code == "" ]]; then
            err=$(expr $err + 1)
            sleep 1
            continue
        else
            err=0
            break
        fi
    done
    
    if [[ $err != "0" ]]; then
        echo "systemctl stop keepalived"
        /usr/bin/systemctl stop keepalived
        exit 1
    else
        exit 0
    fi

[root@master01 ~]# chmod +x /etc/keepalived/check_apiserver.sh

[root@master01 ~]# scp /etc/keepalived/keepalived.conf master02:/etc/keepalived/
    
    [root@master01 ~]# scp /etc/keepalived/check_apiserver.sh master02:/etc/keepalived/

[root@master02 ~]# vim /etc/keepalived/keepalived.conf
    [root@master02 ~]# cat /etc/keepalived/keepalived.conf
    ! Configuration File for keepalived
    global_defs {
        
        router_id LVS_DEVEL
    script_user root
        enable_script_security
    }
    vrrp_script chk_apiserver {
        
        script "/etc/keepalived/check_apiserver.sh" #此脚本需要多独定义，并要调用。
        interval 5
        weight -5
        fall 2
    rise 1
    }
    vrrp_instance VI_1 {
        
        state BACKUP
        interface ens33 # 修改为正在使用的网卡
        mcast_src_ip 192.168.10.12 #为本master主机对应的IP地址
        virtual_router_id 51
        priority 99 # 修改为99
        advert_int 2
        authentication {
        
            auth_type PASS
            auth_pass abc123
        }
        virtual_ipaddress {
        
            192.168.10.100 #为VIP地址
        }
        track_script {
        
           chk_apiserver # 执行上面检查apiserver脚本
        }
    }

[root@master01 ~]# systemctl enable keepalived;systemctl start keepalived

[root@master02 ~]# systemctl enable keepalived;systemctl start keepalived

### 4.4 验证高可用集群可用性 ###

[root@master01 ~]# ip a s ens33
    2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
        link/ether 00:0c:29:50:f9:5f brd ff:ff:ff:ff:ff:ff
        inet 192.168.10.11/24 brd 192.168.10.255 scope global noprefixroute ens33
           valid_lft forever preferred_lft forever
        inet 192.168.10.100/32 scope global ens33
           valid_lft forever preferred_lft forever
        inet6 fe80::adf4:a8bc:a1c:a9f7/64 scope link tentative noprefixroute dadfailed
           valid_lft forever preferred_lft forever
        inet6 fe80::2b33:40ed:9311:8812/64 scope link tentative noprefixroute dadfailed
           valid_lft forever preferred_lft forever
        inet6 fe80::8508:20d8:7240:32b2/64 scope link tentative noprefixroute dadfailed
           valid_lft forever preferred_lft forever

[root@master01 ~]# ss -anput | grep ":16443"
    tcp    LISTEN     0      2000   127.0.0.1:16443                 *:*                   users:(("haproxy",pid=2983,fd=6))
    tcp    LISTEN     0      2000      *:16443                 *:*                   users:(("haproxy",pid=2983,fd=5))

[root@master02 ~]# ss -anput | grep ":16443"
    tcp    LISTEN     0      2000   127.0.0.1:16443                 *:*                   users:(("haproxy",pid=2974,fd=6))
    tcp    LISTEN     0      2000      *:16443                 *:*                   users:(("haproxy",pid=2974,fd=5))

[74db9e5f682e4b8ca648c79d09590802.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/02/06/6e90dc0bfe4b47b499a80c215400b2c7.png
[373a53770c3946c892b4947658675d15.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/02/06/c02b9a62a3f54db3b9ab20d07a57bfbe.png