### 1、部署nginx 我们需要在hdss7-11,hdss7-12 这两个机器做192.168.206.70虚拟VIP （keepalived）  ，来反向代理hdss-73  hdss-74 hdss-75 apiserver的L4 4层 6443，保证了6443端口的高可用。 nginx部署和配置 yum install nginx -y #### nginx四层负载，必须与http同级： ``` vi /etc/nginx/nginx.conf stream { upstream kube-apiserver { server 10.4.7.21:6443 max_fails=3 fail_timeout=30s; server 10.4.7.22:6443 max_fails=3 fail_timeout=30s; } server { listen 7443; proxy_connect_timeout 2s; proxy_timeout 900s; proxy_pass kube-apiserver; } } ``` #### 启动nginx ``` nginx -t systemctl start nginx systemctl enable nginx ``` ### 2、部署keepalived配置 #### 安装的机器hdss7-11，hdss7-12 ``` [root@hdss-71 ~]# yum install -y keepalived ``` ### 配置监听7443端口的检查脚本 ``` vi /etc/keepalived/check_port.sh #!/bin/bash #keepalived 监控端口脚本 #使用方法： #在keepalived的配置文件中 #vrrp_script check_port {#创建一个vrrp_script脚本,检查配置 # script "/etc/keepalived/check_port.sh 6379" #配置监听的端口 # interval 2 #检查脚本的频率,单位（秒） #} CHK_PORT=$1 if [ -n "$CHK_PORT" ];then PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l` if [ $PORT_PROCESS -eq 0 ];then echo "Port $CHK_PORT Is Not Used,End." exit 1 fi else echo "Check Port Cant Be Empty!" fi ``` #### 监听脚本授权 ``` chmod +x /etc/keepalived/check_port.sh ``` #### 编辑keepalived配置文件，注意主从配置文件不一样： hdss7-11 主： vi /etc/keepalived/keepalived.conf ``` ! Configuration File for keepalived global_defs { router_id 10.4.7.11 } vrrp_script chk_nginx { script "/etc/keepalived/check_port.sh 7443" interval 2 weight -20 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 251 priority 100 advert_int 1 mcast_src_ip 10.4.7.11 nopreempt #非抢占式 ，当主节点挂了以后，从节点vip飘到从上，主节点恢复以后，不主动飘回主，需要手动重启keepalived authentication { auth_type PASS auth_pass 11111111 } track_script { chk_nginx } virtual_ipaddress { 10.4.7.10 } } ``` 解释：   router\_id 192.168.206.71       vrrp\_script chk\_nginx {                脚本弄进来     script "/etc/keepalived/check\_port.sh 7443"    传参7443     interface ens33   网卡 hdss7-12 从 ``` ! Configuration File for keepalived global_defs { router_id 10.4.7.12 } vrrp_script chk_nginx { script "/etc/keepalived/check_port.sh 7443" interval 2 weight -20 } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 251 mcast_src_ip 10.4.7.12 priority 90 advert_int 1 authentication { auth_type PASS auth_pass 11111111 } track_script { chk_nginx } virtual_ipaddress { 10.4.7.10 } } ``` #### 启动keepalived ``` systemctl start keepalived systemctl enable keepalived ``` #### 查看情况   如果keepalived出现脑裂问题，两台上面都有vip，可以加入以下配置，将多播修改成单播：  **注意：** **主节点中，必须加上 nopreempt  非抢占式 因为一旦因为网络抖动导致keepalived未检测到主节点7443端口。就会触发VIP漂移，这样从节点就会接管，由于网络抖动keepalived检测主节点7443，会立马恢复到主节点，这算是重大的责任不能让它自动飘回来，所以必须配置 nopreempt：非抢占式，达到飘逸从节点后，即使检测主节点7443，也不会迁移VIP到主节点，必须要分析原因后手动迁移VIP到主节点！如主节点确认正常后，重启备节点的keepalive，让VIP飘到主节点.**