k8s - nginx reverse proxy

Install and deploy the 4-layer reverse proxy service of the master node, deployed on the hdss-1-11 hdss-1-12 machine, use the 7443 port of VIP 192.168.1.10, and replace the hdss-1-21 and hdss-1-22 apiserver6443 port

Nginx configuration (four-layer reverse proxy)

Operate on HDSS-1-11 and HDSS-1-12 at the same time, install nginx, and add reverse proxy configuration at the end of the configuration file

[root@hdss7-11 ~]# yum install -y nginx	
[root@hdss7-11 ~]# vi /etc/nginx/nginx.conf		
stream {
    upstream kube-apiserver {
        server 192.168.1.21:6443     max_fails=3 fail_timeout=30s;
        server 192.168.1.22:6443     max_fails=3 fail_timeout=30s;
    }
    server {
        listen 7443;
        proxy_connect_timeout 2s;
        proxy_timeout 900s;
        proxy_pass kube-apiserver;
    }
}

Check the configuration file and start

[root@hdss-1-11 nginx]# nginx -t 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful
 [root@hdss-1-11 nginx]# systemctl start nginx 
[root@hdss-1-11 nginx]# systemctl enable nginx 

keepalived installation and configuration

[root@hdss-1-11 nginx]# yum install keepalived -y

 Write monitoring script

[root@hdss-1-11 nginx]# vim /etc/keepalived/check_port.sh

#!/bin/bash
#keepalived 监控端口脚本
#使用方法：
#在keepalived的配置文件中
#vrrp_script check_port {#创建一个vrrp_script脚本,检查配置
#    script "/etc/keepalived/check_port.sh 6379" #配置监听的端口
#    interval 2 #检查脚本的频率,单位（秒）
#}
CHK_PORT=$1
if [ -n "$CHK_PORT" ];then
        PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l`
        if [ $PORT_PROCESS -eq 0 ];then
                echo "Port $CHK_PORT Is Not Used,End."
                exit 1
        fi
else
        echo "Check Port Cant Be Empty!"
fi

Empower execution

[root@hdss-1-12 nginx]# chmod +x /etc/keepalived/check_port.sh

 Configure keepalived keepalived master:

[root@hdss-1-11 keepalived]# vim keepalived.conf 
global_defs {
   router_id 192.168.1.11

}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_port.sh 7443"
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface ens160      # 根据实际网卡更改
    virtual_router_id 251
    priority 100
    advert_int 1
    mcast_src_ip 192.168.1.11
    nopreempt

    authentication {
        auth_type PASS
        auth_pass 11111111
    }
    track_script {
         chk_nginx
    }
    virtual_ipaddress {
        192.168.1.10
    }
}

keepalived from:

[root@hdss-1-12 nginx]#  vi /etc/keepalived/keepalived.conf

global_defs {
        router_id 192.168.1.12
        script_user root
        enable_script_security
}
vrrp_script chk_nginx {
        script "/etc/keepalived/check_port.sh 7443"
        interval 2
        weight -20
}
vrrp_instance VI_1 {
        state BACKUP
        interface ens160
        virtual_router_id 251
        mcast_src_ip 192.168.1.12
        priority 90
        advert_int 1
        authentication {
                auth_type PASS
                auth_pass 11111111
        }
        track_script {
                chk_nginx
        }
        virtual_ipaddress {
                192.168.1.10
        }
}

 Start keepalived

[root@hdss7-11 ~]# systemctl start keepalived
[root@hdss7-11 ~]# systemctl enable keepalived

View virtual ip address 10 

Turn off nginx on 11, check whether the duffy ip drifts