Nginx与keepalived高可用节点搭建实验

本文主要介绍了nginx+keepalived的部署实验，并简单说明了nginx的集中负载分担模式

简介：

nginx可以通过反向代理功能对后端服务器实现负载均衡功能

keepalived 是一种高可用集群选举软件

keepalived架构

分为三个模块：

1、keepalived core 核心模块

2、keepalived VRRP模块，加载vrrp协议，通过vrrp进行主备选举

------设置vrrp优先级，默认优先级100,

3、keepalive check检查模块，监控检查

------心跳检测，每一秒发送一次心跳

------备份节点如果三秒钟没有收到心跳信息，则认为主节点故障，备份节点切换为主节点

备份节点切换为主节点后，集群IP地址漂移到新的主节点结合SMTP服务实现邮件发送

环境

VMwareworkstation 17 pro

CentOS Linux release 7.8.2003 (Core)

------4G内存，2core

------20G硬盘

------minimal安装

------NAT网络

#创建完web模板后进行克隆效率更高，随意

#5节点部署，如图所示

搭建web节点

#搭建web节点
yum -y install httpd

#修改主机名与html文件
hostnamectl set-hostname WEB1 && bash
echo web1 > /var/www/html/index.html
hostnamectl set-hostname WEB2 && bash
echo web2 > /var/www/html/index.html
hostnamectl set-hostname WEB3 && bash
echo web3 > /var/www/html/index.html

systemctl enable httpd --now

#安全相关
systemctl disable firewalld --now
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

搭建nginx服务

#搭建nginx节点
hostnamectl set-hostname HA1 && bash
hostnamectl set-hostname HA2 && bash

#安装软件包
yum -y install wget vim net-tools
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
yum -y install nginx nginx-mod-stream

systemctl enable nginx --now
netstat -tunlp | grep -i nginx # #验证
#tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      9482/nginx: master

#安全相关
systemctl disable firewalld --now
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

nginx服务配置

#nginx服务配置

#备份，并且清除注释
cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
sed -i 's/.*#.*//' /etc/nginx/nginx.conf
vim /etc/nginx/nginx.conf

###配置文件含义
user nginx;
worker_processes auto; 
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024; #worker进程上限
}

http { #自身http服务的配置
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
		keepalive_timeout   65;
    types_hash_max_size 4096;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    include /etc/nginx/conf.d/*.conf;

    server { #自己作为http服务器时的配置
        listen       80;
        listen       [::]:80; #监听的ipv6的地址与端口
        server_name  _;
        root         /usr/share/nginx/html;
        include /etc/nginx/default.d/*.conf; 
        error_page 404 /404.html; #出错之后的提示页面等
        location = /404.html {
        }
				error_page 500 502 503 504 /50x.html; 
        location = /50x.html {
        }
    }
}

###修改完成之后如下
#内含变量，建议vim，使用cat <<END或echo都会出错
user nginx;
worker_processes auto; 
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

stream {
log_format main '$remote_addr $upstream_addr - [$time_local] $status
$upstream_bytes_sent';
access_log /var/log/nginx/web_cluster.log main;
 upstream web_LB { #负载均衡设置
 server 192.168.8.162:80;  #添加要转发的地址与端口
 server 192.168.8.163:80;
 server 192.168.8.164:80;
 }
 server {
 listen 80; #本地监听的端口，可以修改
 proxy_pass web_LB; # 设置为通过负载均衡web_LB的方式进行代理
 }
}

#检查
nginx -t
#nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
#nginx: configuration file /etc/nginx/nginx.conf test is successful
nginx -s reload #重载配置文件

此时重新访问，发现访问160和161能访问到后端的web服务器，清除缓存后会变化

最小连接

通过判断哪一个服务器的负载最小，选择负载最小的服务器进行连接

vim /etc/nginx/nginx.conf

upstream web_LB {
least_conn;
server 192.168.8.162:80; 
server 192.168.8.163:80;
server 192.168.8.164:80;
}
nginx -t
nginx -s reload

权重轮询

通过修改weight值，根据权重进行负载的分配

vim /etc/nginx/nginx.conf

upstream web_LB { #负载均衡设置
server 192.168.8.162:80 weight=1;  #添加地址与端口
server 192.168.8.163:80 weight=2;
server 192.168.8.164:80 weight=3;
}
nginx -t
nginx -s reload

IPhash

根据源ip地址进行hash计算，根据计算值自动匹配到后端服务器

同个ip固定匹配一个服务器

适合流量大的时候使用，流量越多越均衡

vim /etc/nginx/nginx.conf

upstream web_LB {
hash $remote_addr consistent;
server 192.168.8.162:80; 
server 192.168.8.163:80;
server 192.168.8.164:80;
}
nginx -t
nginx -s reload

HA节点搭建

#部署
yum install -y keepalived
cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak

vim /etc/keepalived/keepalived.conf
根据实际情况修改
###配置文件解析，并修改配置文件
! Configuration File for keepalived

global_defs {
   notification_email {
     acassen@firewall.loc
     failover@firewall.loc
     sysadmin@firewall.loc
   }
	 notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 127.0.0.1 #通过SMTP来发送邮件的地址
   smtp_connect_timeout 30
   router_id ha1 #路由器代号，挂了之后邮件提升的内容，主备节点需要不同，我写本机
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}
vrrp_instance VI_1 { #实例1，instance的概念与网络中的一致，可以设置多实例来允许多网段的访问
    state MASTER   #状态
    interface ens33 #keepalived的接口地址，我的虚机网卡是ens33
    virtual_router_id 100 #虚拟地址路由器routerid，主备节点需要相同，建议自定义1-255
    priority 100 #优先级，主节点的需要比备节点高
    advert_int 1 #心跳间隔1s
    authentication {  #认证配置
        auth_type PASS #开启认证
        auth_pass 1111 #密钥
    }
    virtual_ipaddress { #虚拟的floating ip，支持多个
        192.168.8.200
    }
}

#启动服务
systemctl enable keepalived --now
systemctl restart keepalived

主节点的网卡会附带集群的地址，如下图

主备倒换测试

ha1停止keepalived，查看ha2的keepalived状态

systemctl stop keepalived

添加定时执行脚本自动拉活nginx

在keepalive的配置文件中添加脚本，用以检测nginx服务是否正常开启

通过脚本自动拉活nginx服务

vim /etc/keepalived/check_nginx_port.sh

#!/bin/bash
if [ "$(netstat -ntlp | grep "nginx: master" | wc -l)" == "0" ]
 then
 systemctl restart nginx
 sleep 2
 if [ "$(netstat -ntlp | grep "nginx: master" | wc -l)" == "0" ]
 then
 systemctl stop keepalived
 fi
fi

编辑配置文件

vim /etc/keepalived/keepalived.conf

...
vrrp_script check_nginx_port {
 script "/etc/keepalived/check_nginx_port.sh"
 interval 2  #间隔2秒
}

...

vrrp_instance VI_1 {
 ...
 track_script {
 check_nginx_port
 }
}