公网服务器使用docker、keepalived和Nginx模拟高可用

前言

最近学习高可用，但手上只有一台服务器，所以使用docker容器、keepalived和Nginx模拟场景。目标：从最开始的安装docker到最后实现高可用。

开始

安装docker

可参考我以前的博客：centos7中安装docker

下载镜像

docker pull centos:7

容器准备

生成容器并进入

docker run -itd --privileged=true --name=centos_kn centos:7 init
docker exec -it centos_kn bash

安装工具

yum install vim net-tools rsyslog ipvsadm initscripts libnl3-devel ipset-devel -y

安装keepalived

yum install -y gcc openssl-devel popt-devel 
yum install keepalived -y

安装nginx

rpm -Uvh http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm
yum install nginx -y
#启动nginx
nginx
#设置开机启动
systemctl enable nginx

打包容器

docker commit -a lwh -m 'centos with keepalived nginx' centos_kn centos_kn

进入容器

宿主机也需要安装keepalived并运行

yum install -y gcc openssl-devel popt-devel 
yum install keepalived -y
systemctl start keepalived
#运行完成后可以停止
systemctl stop keepalived

master容器

#进入master容器
docker run -itd --privileged=true --name=centos_master centos_kn init
docker exec -it centos_master bash
#设置keepalived配置
cd /etc/keepalived
#备份keepalived.conf
cp keepalived.conf keepalived.conf.bak
#更改配置，配置见下边master配置
#启动keepalived
systemctl start keepalived
#设置开启启动
systemctl enable keepalived
#设置nginx页面显示
echo master > /usr/share/nginx/html/index.html 

master配置

! Configuration File for keepalived

global_defs {
   notification_email {
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_MASTER
   #vrrp_skip_check_adv_addr
   #vrrp_strict
   #vrrp_garp_interval 0
   #vrrp_gna_interval 0
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }

    virtual_ipaddress {
        172.17.100.100
    }
}


virtual_server 172.17.100.100 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    #persistence_timeout 0
    protocol TCP

    real_server 172.17.0.2 80 {
        weight 1
        TCP_CHECK {
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }
    real_server 172.17.0.3 80 {
        weight 1
        TCP_CHECK {
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }

}

slave容器

#进入backup容器
docker run -itd --privileged=true --name=centos_slave centos_kn init
docker exec -it centos_slave bash
#设置keepalived配置
cd /etc/keepalived
#备份keepalived.conf
cp keepalived.conf keepalived.conf.bak
#更改配置，配置见下边master配置
#启动keepalived
systemctl start keepalived
#设置开启启动
systemctl enable keepalived
#设置nginx页面显示
echo slave> /usr/share/nginx/html/index.html 

slave配置

! Configuration File for keepalived

global_defs {
   notification_email {
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id LVS_SLAVE
   #vrrp_skip_check_adv_addr
   #vrrp_strict
   #vrrp_garp_interval 0
   #vrrp_gna_interval 0
}

vrrp_instance VI_2 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }

    virtual_ipaddress {
        172.17.100.100
    }
}

virtual_server 172.17.100.100 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    #persistence_timeout 0
    protocol TCP
    
    real_server 172.17.0.3 80 {
        weight 1
        TCP_CHECK {
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }
    real_server 172.17.0.2 80 {
        weight 1
        TCP_CHECK {
            connect_timeout 3
            retry 3
            delay_before_retry 3
        }
    }
}                                       

容器配置

两个容器都需要执行，否则无法轮询

#!/bin/bash
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
ifconfig lo:0 172.17.100.100 broadcast 172.17.100.100 netmask 255.255.255.255 up
route add -host 172.17.100.100 dev lo:0

测试是否配置成功

进入宿主机
首先使用curl访问虚拟ip:
curl 172.17.100.100
能看到返回的值说明配置成功了

使用公网访问

#开启防火墙
systemctl start firewalld.service
#查看防火墙状态，显示为running
firewall-cmd --state
#开通80端口
firewall-cmd --zone=public --add-port=80/tcp --permanent 
#设置端口转发
firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toaddr=172.17.100.100:toport=80
#刷新防火墙
firewall-cmd --reload

测试

使用浏览器访问会发现达不到轮询的效果，使用jmeter压测可以看到轮询的效果