nginx反向代理+keepalived高可用实验
环境准备:
主机名 | ip地址 | 服务 | 系统信息 |
---|---|---|---|
master | 192.168.174.170 | nginx keepalived | centos8 |
backup | 192.168.174.175 | nginx keepalived | centos8 |
RS1 | 192.168.174.177 | httpd | centos8 |
RS2 | 192.168.174.178 | nginx | centos8 |
vip:192.168.111.250
首先部署好web界面
RS1:
//配置yum源
[root@RS1 ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo
[root@RS1 ~]# sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
//关闭防火墙和selinux
[root@master ~]# setenforce 0
[root@master ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config
[root@master ~]# systemctl disable --now firewalld.service
//安装httpd服务,主页内容为apache
[root@RS1 ~]# dnf -y install httpd
[root@RS1 ~]# echo "apache" > /var/www/html/index.html
[root@RS1 ~]# systemctl enable --now httpd.service
[root@RS1 ~]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
[root@RS1 ~]# curl 192.168.174.177
apache
RS2:
//配置yum源
[root@RS2 ~]# curl -o /etc/yum.repos.d/CentOS-Base.repo https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repo
[root@RS2 ~]# sed -i -e '/mirrors.cloud.aliyuncs.com/d' -e '/mirrors.aliyuncs.com/d' /etc/yum.repos.d/CentOS-Base.repo
//关闭防火墙和selinux
[root@RS2 ~]# setenforce 0
[root@RS2 ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config
[root@RS2 ~]# systemctl disable --now firewalld.service
//安装nginx服务,主页内容为web2
[root@RS2 ~]# dnf -y install nginx
[root@RS2 ~]# echo "nginx" > /usr/share/nginx/html/index.html
[root@RS2 ~]# systemctl enable --now nginx.service
[root@RS2 ~]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
[root@RS2 ~]# curl 192.168.174.178
nginx
部署nginx负载均衡
master端:
//关闭防火墙和selinux
[root@master ~]# setenforce 0
[root@master ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config
[root@master ~]# systemctl disable --now firewalld.service
//下载nginx
[root@master ~]# dnf -y install nginx
//修改配置文件,实现负载均衡
[root@master ~]# vim /etc/nginx/nginx.conf
......
upstream webservers { //定义一个服务器列表,默认的方式是轮询
ip_hash; //同一访问者发出请求总是由同一个后端服务器来处理
server 192.168.174.177:80 weight=3;
server 192.168.174.178:80;
}
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://webservers;
}
......
[root@master ~]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
//重启服务并开机自启
[root@master ~]# systemctl restart nginx.service
[root@master ~]# systemctl enable --now nginx.service
//访问测试
[root@master ~]# curl 192.168.174.170
nginx
[root@master ~]# curl 192.168.174.170
nginx
[root@master ~]# curl 192.168.174.170
nginx
backup端:
//关闭防火墙和selinux
[root@backup ~]# setenforce 0
[root@backup ~]# sed -ri 's/^(SELINUX=).*/\1disabled/g' /etc/selinux/config
[root@backup ~]# systemctl disable --now firewalld.service
//下载nginx
[root@backup ~]# dnf -y install nginx
//修改配置文件,实现负载均衡
[root@backup ~]# vim /etc/nginx/nginx.conf
upstream webservers { //定义一个服务器列表,默认的方式是轮询
ip_hash; //同一访问者发出请求总是由同一个后端服务器来处理
server 192.168.174.177:80 weight=3;
server 192.168.174.178:80;
}
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_pass http://webservers;
}
......
[root@backup ~]# ss -anlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 [::]:22 [::]:*
//重启服务
[root@backup ~]# systemctl restart nginx.service
//访问测试
[root@backup ~]# curl 192.168.174.175
nginx
[root@backup ~]# curl 192.168.174.175
nginx
[root@backup ~]# curl 192.168.174.175
nginx
//backup端的nginx最好关掉
[root@backup ~]# systemctl stop nginx.service
开始部署keepalived高可用
master端配置:
//首先安装keepalived
[root@master ~]# dnf -y install keepalived
//编辑配置文件,并启动服务
[root@master ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id lb01
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.111.250
}
}
virtual_server 192.168.111.250 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 192.168.174.170 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.174.175 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
[root@master ~]# systemctl enable --now keepalived.service
//通过虚拟ip访问
[root@master ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:16:3e:4e:5a:f7 brd ff:ff:ff:ff:ff:ff
inet 192.168.174.170/24 brd 192.168.174.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet 192.168.111.250/32 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe4e:5af7/64 scope link
valid_lft forever preferred_lft forever
[root@master ~]# curl 192.168.111.250
apache
[root@master ~]# curl 192.168.111.250
apache
[root@master ~]# curl 192.168.111.250
apache
backup端配置:
//首先安装keepalived
[root@backup ~]# dnf -y install keepalived
//编辑配置文件,并启动服务
[root@backup ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id lb02
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.111.250
}
}
virtual_server 192.168.111.250 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 192.168.174.170 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.174.175 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
[root@backup ~]# systemctl enable --now keepalived.service
编写脚本
master端
[root@master ~]# mkdir /scripts
[root@master ~]# cd /scripts/
[root@master scripts]# vim check_nginx.sh
#!/bin/bash
nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
if [ $nginx_status -lt 1 ];then
systemctl stop keepalived
fi
[root@master scripts]# vim notify.sh
#!/bin/bash
VIP=$2
case "$1" in
master)
nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
if [ $nginx_status -lt 1 ];then
systemctl start nginx
fi
;;
backup)
nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
if [ $nginx_status -gt 0 ];then
systemctl stop nginx
[root@master scripts]# chmod +x check_haproxy.sh notify.sh
backup端
[root@backup ~]# mkdir /scripts
[root@backup ~]# cd /scripts/
[root@backup scripts]# scp root@192.168.174.170:/scripts/* .
[root@backup scripts]# ll
total 8
-rwxr-xr-x 1 root root 142 Oct 17 21:58 check_nginx
-rwxr-xr-x 1 root root 363 Oct 17 21:58 notify.sh
配置keepalived加入监控脚本的配置
master端
[root@master ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id lb01
}
vrrp_script haproxy_check { //添加此处内容
script "/scripts/nginx_haproxy.sh"
interval 1
weight -20
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.111.250
}
track_script { //添加此处内容
haproxy_check
}
notify_master "/scripts/notify.sh master 192.168.111.250"
notify_backup "/scripts/notify.sh backup 192.168.111.250"
}
virtual_server 192.168.111.250 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 192.168.174.170 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.174.175 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
backup端
backup无需检测nginx是否正常,当升级为MASTER时启动nginx,当降级为BACKUP时关闭
[root@backup ~]# vim /etc/keepalived/keepalived.conf
[root@backup ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
router_id lb02
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.111.250
}
notify_master "/scripts/notify.sh master 192.168.111.250" //只添加此处内容
notify_backup "/scripts/notify.sh backup 192.168.111.250"
}
virtual_server 192.168.111.250 80 {
delay_loop 6
lb_algo rr
lb_kind DR
persistence_timeout 50
protocol TCP
real_server 192.168.174.170 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 192.168.174.175 80 {
weight 1
TCP_CHECK {
connect_port 80
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
测试,模拟nginx服务故障
master端
[root@master ~]# curl 192.168.111.250
apache
[root@master ~]# curl 192.168.111.250
apache
[root@master ~]# curl 192.168.111.250
apache
[root@master ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:16:3e:4e:5a:f7 brd ff:ff:ff:ff:ff:ff
inet 192.168.174.170/24 brd 192.168.174.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet 192.168.111.250/32 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe4e:5af7/64 scope link
valid_lft forever preferred_lft forever
[root@master ~]# systemctl stop nginx.service
[root@master ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:16:3e:4e:5a:f7 brd ff:ff:ff:ff:ff:ff
inet 192.168.174.170/24 brd 192.168.174.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe4e:5af7/64 scope link
valid_lft forever preferred_lft forever
//backup端
[root@backup ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:6a:c4:f8 brd ff:ff:ff:ff:ff:ff
inet 192.168.174.175/24 brd 192.168.174.255 scope global dynamic noprefixroute ens33
valid_lft 1016sec preferred_lft 1016sec
inet 192.168.111.250/32 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe6a:c4f8/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@backup ~]# curl 192.168.111.250
apache
[root@backup ~]# curl 192.168.111.250
apache
[root@backup ~]# curl 192.168.111.250
apache
r 00:0c:29:6a:c4:f8 brd ff:ff:ff:ff:ff:ff
inet 192.168.174.175/24 brd 192.168.174.255 scope global dynamic noprefixroute ens33
valid_lft 1016sec preferred_lft 1016sec
inet 192.168.111.250/32 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe6a:c4f8/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root@backup ~]# curl 192.168.111.250
apache
[root@backup ~]# curl 192.168.111.250
apache
[root@backup ~]# curl 192.168.111.250
apache