Nginx+Keepalived实现高可用

版权声明：©来自CSDN博客作者"Debug The Life"的原创作品，如需转载，请注明出处。 https://blog.csdn.net/zhaoxixc/article/details/82257065

• 规划

master：nginxa：192.168.10.158

backup：nginxb：192.168.10.178

vip:192.168.10.191

• 一、主机nginxa进行如下配置（此步骤nginxb同操作）

1、关闭selinux，清空iptables规则

[root@nginxa ~]# vim /etc/sysconfig/selinux 
SELINUX=disabled  #原enforcing修改为disabled
[root@nginxa ~]# setenforce 0

[root@nginxa ~]# iptables -F

或者
[root@nginxa ~]# firewall-cmd --permanent --add-port=80/tcp
success
[root@nginxa ~]# firewall-cmd --reload
success

或者
[root@nginxa ~]# systemctl stop firewalld.service
[root@nginxa ~]# systemctl disable firewalld.service
[root@nginxa ~]# yum install -y iptables-services.x86_64 
[root@nginxa ~]# vi /etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT  #新增，放行80端口
-A INPUT -p vrrp -j ACCEPT  #允许VRRP（虚拟路由冗余协议）通信
[root@nginxa ~]# systemctl restart iptables

2、安装编译环境

[root@nginxa ~]# yum -y install gcc gcc-c++ make automake autoconf libtool pcre pcre-devel zlib zlib-devel openssl openssl-devel

3、下载、安装nginx

[root@nginxa ~]# cd /usr/local/src/
[root@nginxa src]# wget http://nginx.org/download/nginx-1.13.0.tar.gz
[root@nginxa nginx-1.13.0]# tar -zxvf nginx-1.13.0.tar.gz
[root@nginxa src]# cd nginx-1.13.0/
[root@nginxa nginx-1.13.0]# ./configure --prefix=/usr/local/nginx 
[root@nginxa nginx-1.13.0]# make
[root@nginxa nginx-1.13.0]# make install

4、配置nginx

[root@nginxa nginx-1.13.0]# vi /usr/local/nginx/conf/nginx.conf
user  root;

5、修改nginx首页内容，用于区分nginxa和nginxb

[root@nginxa nginx-1.13.0]# vi /usr/local/nginx/html/index.html
<title>nginxa!</title>
<h1>Welcome to nginxa!</h1>

<h1>This is nginxa</h1>

6、测试nginx是否安装成功

[root@nginxa nginx-1.13.0]# /usr/local/nginx/sbin/nginx -t
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

7、启动nginx

[root@nginxa nginx-1.13.0]# /usr/local/nginx/sbin/nginx
[root@nginxa nginx-1.13.0]# /usr/local/nginx/sbin/nginx -s reload  #重新加载

8、nginx加入自启

[root@nginxa nginx-1.13.0]# vi /etc/rc.local 
/usr/local/nginx/sbin/nginx

此时访问192.168.10.158，如下

访问192.168.10.178，如下

9、安装keepalived

[root@nginxa src]# cd /usr/local/src/
[root@nginxa src]# wget http://www.keepalived.org/software/keepalived-1.2.18.tar.gz
[root@nginxa src]# tar -zxvf keepalived-1.2.18.tar.gz 
[root@nginxa src]# cd keepalived-1.2.18
[root@nginxa keepalived-1.2.18]# ./configure --prefix=/usr/local/keepalived
[root@nginxa keepalived-1.2.18]# make
[root@nginxa keepalived-1.2.18]# make install

10、将keepalived安装成linux系统服务

因为没有使用 keepalived 的默认路径安装，安装完成之后，需要复制默认配置文件到默认路径

[root@nginxa keepalived-1.2.18]# mkdir /etc/keepalived
[root@nginxa keepalived-1.2.18]# cp /usr/local/keepalived/etc/keepalived/keepalived.conf /etc/keepalived/

复制 keepalived 服务脚本到默认的地址

[root@nginxa keepalived-1.2.18]# cp /usr/local/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/
[root@nginxa keepalived-1.2.18]# cp /usr/local/keepalived/etc/sysconfig/keepalived /etc/sysconfig/
[root@nginxa keepalived-1.2.18]# ln -s /usr/local/keepalived/sbin/keepalived /usr/sbin/

设置keepalived服务开机自启

[root@nginxa ~]# chkconfig keepalived on

• 二、修改nginxa的keepalived配置文件

[root@nginxa ~]# vi /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    ## keepalived 自带的邮件提醒需要开启 sendmail 服务。 建议用独立的监控或第三方 SMTP
    router_id nginxa ## 标识本节点的字条串，通常为 hostname
} 
## keepalived 会定时执行脚本并对脚本执行的结果进行分析，动态调整 vrrp_instance 的优先级。如果脚本执行结果为 0，并且 weight 配置的值大于 0，则优先级相应的增加。如果脚本执行结果非 0，并且 weight配置的值小于 0，则优先级相应的减少。其他情况，维持原本配置的优先级，即配置文件中 priority 对应的值。
vrrp_script chk_nginx {
    script "/etc/keepalived/nginx_check.sh" ## 检测 nginx 状态的脚本路径
    interval 2 ## 检测时间间隔
    weight -20 ## 如果条件成立，权重-20
}
## 定义虚拟路由， VI_1 为虚拟路由的标示符，自己定义名称
vrrp_instance VI_1 {
    state MASTER ## 主节点为 MASTER， 对应的备份节点为 BACKUP
    interface eth0 ## 绑定虚拟 IP 的网络接口，与本机 IP 地址所在的网络接口相同， 我的是 eth0
    virtual_router_id 33 ## 虚拟路由的 ID 号， 两个节点设置必须一样， 相同的 VRID 为一个组，他将决定多播的 MAC 地址
    mcast_src_ip 192.168.10.158 ## 本机 IP 地址
    priority 100 ## 节点优先级， 值范围 0-254， MASTER 要比 BACKUP 高
    nopreempt ## 优先级高的设置 nopreempt 解决异常恢复后再次抢占的问题
    advert_int 1 ## 组播信息发送间隔，两个节点设置必须一样， 默认 1s
    ## 设置验证信息，两个节点必须一致
    authentication {
        auth_type PASS
        auth_pass 1111 ## 真实生产，按需求对应该过来
    }
    ## 将 track_script 块加入 instance 配置块
    track_script {
        chk_nginx ## 执行 Nginx 监控的服务
    } #
    # 虚拟 IP 池, 两个节点设置必须一样
    virtual_ipaddress {
        192.168.10.191 ## 虚拟 ip，可以定义多个
    }
}

• 三、修改nginxb的keepalived配置文件

[root@nginxb sbin]# vi /etc/keepalived/keepalived.conf 
! Configuration File for keepalived
global_defs {
    router_id nginxb
}
vrrp_script chk_nginx {
    script "/etc/keepalived/nginx_check.sh"
    interval 2
    weight -20
}
vrrp_instance VI_1 {
    state BACKUP
    interface eth1
    virtual_router_id 33
    mcast_src_ip 192.168.10.178
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    track_script {
        chk_nginx
    }
    virtual_ipaddress {
        192.168.10.191
    }
}

• 四、编写nginx状态检测脚本（此步骤nginxa和nginxb同操作）

编写 Nginx 状态检测脚本 /etc/keepalived/nginx_check.sh (已在 keepalived.conf 中配置)脚本要求：如果 nginx 停止运行，尝试启动，如果无法启动则杀死本机的 keepalived 进程， keepalied将虚拟 ip 绑定到 BACKUP 机器上。

[root@nginxa ~]# cat /etc/keepalived/nginx_check.sh
#!/bin/bash
A=`ps -C nginx –no-header |wc -l`
if [ $A -eq 0 ];then
/usr/local/nginx/sbin/nginx
sleep 2
if [ `ps -C nginx --no-header |wc -l` -eq 0 ];then
        killall keepalived
fi
fi
[root@nginxa ~]# 
[root@nginxa ~]# chmod +x /etc/keepalived/nginx_check.sh

启动keepalived服务

[root@nginxa ~]# systemctl start keepalived

• 五、验证

可以通过ip add查看VIP是否绑定成功

[root@nginxa ~]# ip address 
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:08:3e:47 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.158/24 brd 192.168.10.255 scope global dynamic ens33
       valid_lft 59397sec preferred_lft 59397sec
    inet 192.168.10.191/32 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::6bea:7e4d:fd17:8225/64 scope link 
       valid_lft forever preferred_lft forever

1、当nginxa：192.168.10.158和nginxb：192.168.10.178都启动了nginx和keepalived服务后，通过VIP：192.168.10.191进行访问，如下

2、关闭nginxa：192.168.10.158的keepalived和nginx服务

[root@nginxa ~]# service keepalived stop
Stopping keepalived (via systemctl):                       [  OK  ]
[root@nginxa ~]# /usr/local/nginx/sbin/nginx -s stop

此时再通过VIP：192.168.10.191进行访问，如下

3、重新将nginxa开启keepalived和nginx服务

[root@nginxa ~]# /usr/local/nginx/sbin/nginx
[root@nginxa ~]# service keepalived start

因为写了脚本nginx_check.sh，这个脚本会自动启动nginx
所以也可以执行

[root@nginxa ~]# service keepalived start
Starting keepalived (via systemctl):                       [  OK  ]

此时再通过VIP：192.168.10.191进行访问，如下