企业 DevOps + 协同办公 + 可观测性 + 网络基础设施平台-Part 15.17 Network & HA Role

本部分生成企业级网络、高可用、负载均衡自动化部署代码

包含：

Keepalived VIP高可用
HAProxy四层/七层负载均衡
Nginx反向代理
Bind9 DNS服务器
Squid Proxy企业代理
OpenVPN远程接入
WireGuard VPN
MetalLB Kubernetes LoadBalancer
Firewall安全策略

适用于：

复制代码

Ubuntu 22.04 / 24.04

CentOS Stream 9

Debian 12

Kubernetes 1.28+

Docker

HAProxy 3.x

Keepalived 2.x

Bind9

OpenVPN 2.6

WireGuard

15.17.1 Network & HA整体架构

复制代码

                         Internet


                            |

                            |

                     Firewall


                            |

                            |

                    Keepalived VIP

                    10.10.10.100


                 +----------+----------+

                 |                     |

              HAProxy1              HAProxy2

             MASTER                 BACKUP


                 |                     |

                 +----------+----------+


                            |


                    Kubernetes / Apps


                            |


                     Internal DNS


                            |


                    Bind9 DNS Cluster



VPN:


Remote User

    |

OpenVPN/WireGuard

    |

Corporate Network

15.17.2 Network目录结构

创建：

复制代码

roles/network-ha/


├── defaults/

│   └── main.yml


├── tasks/

│
│   ├── main.yml
│   ├── keepalived.yml
│   ├── haproxy.yml
│   ├── nginx.yml
│   ├── bind9.yml
│   ├── squid.yml
│   ├── openvpn.yml
│   ├── wireguard.yml
│   ├── metallb.yml
│   └── firewall.yml


├── templates/


│   ├── keepalived.conf.j2
│   ├── haproxy.cfg.j2
│   ├── nginx.conf.j2
│   ├── named.conf.j2
│   ├── db.company.com.j2
│   ├── squid.conf.j2
│   ├── openvpn-server.conf.j2
│   └── wg0.conf.j2


└── handlers/


    └── main.yml

15.17.3 Network变量

文件：

复制代码

roles/network-ha/defaults/main.yml

---

network_domain:

 company.com


vip_address:

 10.10.10.100


interface:

 ens192


keepalived_router_id:

 51


haproxy_port:

 80


https_port:

 443


dns_domain:

 company.com


dns_server:

 10.10.10.53


proxy_port:

 3128


vpn_network:

 10.20.0.0/24


openvpn_port:

 1194


wireguard_port:

 51820

15.17.4 Network Playbook

文件：

复制代码

playbooks/network-ha.yml

---

- name:

    Deploy Network HA


  hosts:

    network


  become:

    true


  roles:


    - network-ha

15.17.5 主入口

文件：

复制代码

roles/network-ha/tasks/main.yml

---

- import_tasks:

    keepalived.yml


- import_tasks:

    haproxy.yml


- import_tasks:

    nginx.yml


- import_tasks:

    bind9.yml


- import_tasks:

    squid.yml


- import_tasks:

    openvpn.yml


- import_tasks:

    wireguard.yml


- import_tasks:

    metallb.yml


- import_tasks:

    firewall.yml

Part 15.17.6 Keepalived VIP

架构

复制代码

              VIP

        10.10.10.100


             |

     +-------+-------+

     |               |

  HAProxy1        HAProxy2

 MASTER           BACKUP

安装：

复制代码

---

- name:

    install keepalived


  apt:


    name:

      keepalived


    state:

      present

配置模板：

文件：

复制代码

templates/keepalived.conf.j2

vrrp_instance VI_1 {


 state {{ keepalived_state }}


 interface {{ interface }}


 virtual_router_id {{ keepalived_router_id }}


 priority {{ keepalived_priority }}


 advert_int 1



 authentication {


  auth_type PASS


  auth_pass password


 }



 virtual_ipaddress {


  {{ vip_address }}


 }


}

部署：

复制代码

---

- name:

    configure keepalived


  template:


    src:

      keepalived.conf.j2


    dest:

      /etc/keepalived/keepalived.conf



  notify:

    restart keepalived

Handler:

复制代码

---

- name:

    restart keepalived


  service:


    name:

      keepalived


    state:

      restarted

验证：

复制代码

ip addr show

输出：

复制代码

10.10.10.100

15.17.7 HAProxy部署

用途：

Kubernetes API HA
Ingress HA
Web服务

架构：

复制代码

Client

 |

VIP

 |

HAProxy

 |

+-----+-----+

|           |

K8S-M1    K8S-M2

安装：

复制代码

---

- name:

    install haproxy


  apt:


    name:

      haproxy


    state:

      present

配置：

文件：

复制代码

templates/haproxy.cfg.j2

global


 log /dev/log local0


 maxconn 50000



defaults


 mode tcp


 timeout connect 10s


 timeout client 1h


 timeout server 1h



frontend kubernetes_api


 bind *:6443


 default_backend kube_masters



backend kube_masters


 balance roundrobin


 server master1 10.10.10.11:6443 check


 server master2 10.10.10.12:6443 check



frontend http


 bind *:80


 mode http


 default_backend ingress



backend ingress


 mode http


 balance roundrobin


 server ingress1 10.10.10.21:80 check


 server ingress2 10.10.10.22:80 check

15.17.8 Nginx反向代理

用途：

Web入口
SSL终止
API Gateway

安装：

复制代码

---

- name:

    install nginx


  apt:


    name:

      nginx


    state:

      present

配置：

复制代码

server {


 listen 443 ssl;


 server_name gitlab.company.com;



 location / {


 proxy_pass http://gitlab;


 proxy_set_header Host $host;


 }


}

15.17.9 Bind9 DNS

架构：

复制代码

DNS-MASTER

10.10.10.53


DNS-SLAVE

10.10.10.54

安装：

复制代码

---

- name:

    install bind9


  apt:


    name:


      - bind9

      - bind9utils


    state:

      present

named.conf：

复制代码

zone "company.com" {


 type master;


 file "/etc/bind/db.company.com";


};

区域文件：

复制代码

db.company.com.j2

$TTL 86400


@ IN SOA dns.company.com. admin.company.com.


@ IN NS dns.company.com.


gitlab IN A 10.10.10.20


jenkins IN A 10.10.10.30


harbor IN A 10.10.10.40


grafana IN A 10.10.10.50


vault IN A 10.10.10.60

15.17.10 Squid Proxy

用途：

软件仓库代理
Docker代理
出口控制

安装：

复制代码

---

- name:

    install squid


  apt:


    name:

      squid


    state:

      present

配置：

复制代码

http_port 3128


acl localnet src 10.0.0.0/8


http_access allow localnet


cache_dir aufs /var/spool/squid 10000 16 256

15.17.11 OpenVPN

架构：

复制代码

Laptop

 |

VPN

 |

OpenVPN Server

 |

Internal Network

安装：

复制代码

---

- name:

    install openvpn


  apt:


    name:


      - openvpn

      - easy-rsa


    state:

      present

配置：

复制代码

port 1194


proto udp


dev tun


server 10.20.0.0 255.255.255.0


push "route 10.10.0.0 255.255.0.0"


keepalive 10 120

启动：

复制代码

systemctl enable openvpn-server@server

systemctl start openvpn-server@server

15.17.12 WireGuard

优势：

高性能
移动端友好

安装：

复制代码

---

- name:

 install wireguard


 apt:


  name:

   wireguard

配置：

复制代码

wg0.conf

[Interface]


Address = 10.30.0.1/24


ListenPort = 51820


PrivateKey = SERVER_KEY



[Peer]


PublicKey = CLIENT_KEY


AllowedIPs = 10.30.0.2/32

启动：

复制代码

systemctl enable wg-quick@wg0

systemctl start wg-quick@wg0

15.17.13 MetalLB Kubernetes

用途：

裸机Kubernetes LoadBalancer。

安装：

复制代码

---

- name:

    install metallb


  kubernetes.core.k8s:


    src:

      https://raw.githubusercontent.com/metallb/metallb/v0.14.9/config/manifests/metallb-native.yaml

地址池：

复制代码

apiVersion:

 metallb.io/v1beta1


kind:

IPAddressPool


metadata:


 name:

 default


spec:


 addresses:


 - 10.10.10.200-10.10.10.250

15.17.14 Firewall

使用：

UFW
Firewalld

Ubuntu：

复制代码

---

- name:

 enable firewall


 ufw:


  state:

   enabled

开放端口：

复制代码

- name:

 allow ports


 ufw:


  rule:

   allow


  port:

   "{{ item }}"


 loop:


 - 22

 - 80

 - 443

 - 6443

 - 1194

 - 51820

15.17.15 Network健康检查

文件：

复制代码

scripts/check-network.sh

#!/bin/bash


echo "VIP"


ip addr |grep 10.10.10.100



echo "HAProxy"


systemctl status haproxy



echo "DNS"


dig company.com



echo "VPN"


ss -tunlp |grep -E "1194|51820"

15.17完成

✅ Keepalived VIP高可用

✅ HAProxy负载均衡

✅ Kubernetes API HA

✅ Nginx反向代理

✅ Bind9 DNS

✅ Squid企业代理

✅ OpenVPN

✅ WireGuard

✅ MetalLB

✅ Firewall策略

✅ 网络健康检查