1. 部署高可用nginx集群

1.1 nginx高可用配置

master01：

# 四层负载均衡，为两台Master apiserver组件提供负载均衡
stream {

    log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';

    access_log  /var/log/nginx/k8s-access.log  main;

    upstream k8s-apiserver {
       server 172.26.156.214:6443  max_fails=3 fail_timeout=30s;
       server 172.26.156.215:6443  max_fails=3 fail_timeout=30s ;   # xianchaomaster2 APISERVER IP:PORT
       server 172.26.156.216:6443  max_fails=3 fail_timeout=30s;   # xianchaomaster3 APISERVER IP:PORT
    }

    server {
       listen 172.26.156.188:6443; # 由于nginx与master节点复用，这个监听端口不能是6443，否则会冲突
#       server_name 172.26.156.188;
       proxy_pass k8s-apiserver;
    }
}

master02：

在这里插入代码片stream {

    log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';

    access_log  /var/log/nginx/k8s-access.log  main;

    upstream k8s-apiserver {
       server 172.26.156.214:6443  max_fails=3 fail_timeout=30s;
       server 172.26.156.215:6443  max_fails=3 fail_timeout=30s ;   # xianchaomaster2 APISERVER IP:PORT
       server 172.26.156.216:6443  max_fails=3 fail_timeout=30s;   # xianchaomaster3 APISERVER IP:PORT
    }

    server {
       listen 6443; # 由于nginx与master节点复用，这个监听端口不能是6443，否则会冲突
       proxy_pass k8s-apiserver;
    }
}

1.2 keepalived主备配置

master01

global_defs {
#   router_id 192.168.153.11

}

vrrp_script chk_nginx {
    script "/etc/keepalived/check_port.sh 6443"
    interval 2
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface ens160    # 根据实际网卡更改
    virtual_router_id 251
    priority 100
    advert_int 1
#    mcast_src_ip 192.168.153.11
    nopreempt

    authentication {
        auth_type PASS
        auth_pass 11111111
    }
    track_script {
         chk_nginx
    }
    virtual_ipaddress {
        172.26.156.188/16
    }
}

master02

vi /etc/keepalived/keepalived.conf
global_defs {
#        router_id 192.168.153.12
        script_user root
        enable_script_security
}
vrrp_script chk_nginx {
        script "/etc/keepalived/check_port.sh 6443"
        interval 2
        weight -20
}
vrrp_instance VI_1 {
        state BACKUP
        interface ens160  # 根据实际网卡更改
        virtual_router_id 251
        priority 90
        advert_int 1
        authentication {
         auth_type PASS
         auth_pass 11111111
        }
        track_script {
                chk_nginx
        }
        virtual_ipaddress {
                172.26.156.188/16
        }
}

脚本：

root@master01:~# cat  /etc/keepalived/check_port.sh 
#!/bin/bash
#keepalived 监控端口脚本
#使用方法：
#在keepalived的配置文件中
#vrrp_script check_port {#创建一个vrrp_script脚本,检查配置
#    script "/etc/keepalived/check_port.sh 6379" #配置监听的端口
#    interval 2 #检查脚本的频率,单位（秒）
#}
CHK_PORT=$1
if [ -n "$CHK_PORT" ];then
        PORT_PROCESS=`ss -lnt|grep $CHK_PORT|wc -l`
        if [ $PORT_PROCESS -eq 0 ];then
                echo "Port $CHK_PORT Is Not Used,End."
                exit 1
        fi
else
        echo "Check Port Cant Be Empty!"
fi

3. 部署kubeasz

根据github上kubeasz部署指引，部署获得一个安全可靠的二进制部署k8s集群
https://github.com/easzlab/kubeasz