部署一套完整的Kubernetes高可用集群(二进制,最新版v1.18)下

部署一套完整的Kubernetes高可用集群(二进制,最新版v1.18)下

七、高可用架构(扩容多Master架构)

Kubernetes作为容器集群系统,通过健康检查+重启策略实现了Pod故障自我修复能力,通过调度算法实现将Pod分布式部署,并保持预期K i _ r 副本数,根据Node失效状态自动在其他Node拉起Pod,实K ] 9 + E [ G J =现了应用层的高可用性。

针对Kubernetes集群高可用性还应包含以下两个层面的考虑:Etcd数据库的高可用性C s b DKubernetes Master组件的高可用性。 而Etcd我们已经采用3个节点组建集群实现高可用,本节将对Master节点高可用进行说明和实施。

Master节点扮演着总8 V a = 0 A 2 f ~控中心的角色,通过不断与工作节点上的Kubelet和kube-proxF Y O + | Zy进行通信来维护整个集群的健康工作状态。如果Master节点故障,将无法使用kubectl工具或者API做任何集群管理。

Master节点主要有三个服务kube-apiserver、kube-controll* 5 b 1 W : eer-manager和kube-scheduler,其中kube-controller-manager和kubz } + n g % ) J ke-scheduler组件自身通过选择机制已经实现了O V u x f .高可用,所以Master高可用0 n N J a主要针对kube-apiserver组件,而该组件是以HTTP API提供服) G J L b w务,因Q F g ` a S T Z此对他高可用与Web服务器类似,增加负载均衡器对其负载均衡即可,并且可水平扩容。

多Master架构图:

部署一套完整的Kubernetes高可用集群(二进制,最新版v1.18)下

7.1 安装Docko 4 c $ c J o ] Uer

同上,不再赘述。

7.2 部署Master2 Node(192.168.31.74

Master2 与已部署的Master1所有操作一致。所以我们只需将Master1所有K8s文件拷贝过来,再修改下服务器IP% ] 2 b和主机名启动即可。

1. 创建etcd证书目录

在Master2创建etcd证书目录:

mkdir -p /opt/etcd/sz b  T A X ; Ksl

2. 拷贝文件(Masg j d Y z o ` D lter1操作)

拷贝Master1上所有K8s文件和etcO L S 4 * | m *d证书到Master2:

scp -r /opt/kubernetes root@192.168.31.74:/opt
scp -r /opt/cni/ root@192.168.31.74:/opt
scp -r /Y J _opt/etcd/ssl root@192.168.31.74:/opt/etcd
scp /usr/lib/systeml 4 V * w md/system/n / : ] 3 r +kube* root@192.168.31.74:/usr/lib/systemd/system
scp /usr/bin/kubectl  root@192.168.31.74:/usg U ) l H )r/bin

3. 删除证书文件

删除k, m tubelet证书和kubeconfig文件:; J 5 J r N O s p

rm -f /op^ b At/kubernetes/cfg/kubelet.kubeconfig
rm -f /opt/kubernetes/ssl/kubelet*

4. 修改配置文件IP和主机名

修改apiserver、kub$ + V z r _elet和kube-proxy配置文件为本地IP:

vi /opt/kubernetes/cfZ L d O . + v 8 3g/kube-apiserver.conf
..6 , P $ p K $ q.
--bind-address=192.168.31.74 
--advertise-address=192.168.31.74 
...
vi /opt/kubernetes/cfg/kubelet.conf
--hostname-ovep Y T r ; ; $ w hrride=k8s-master2
vi /opt/kubernetes/cfg/kube-proxy-config.yml
hostnameOverride: k8s-master2

5o P i S ]. 启动设置开机启动

systemctl daemon-reload
systemctl start kube-apiserver
systemctl start kube-controller-manager
systemctl start kube-sched/ 7 r & a q ` puler
systemctl st/ k ! Q ~ i fart kubelet
systemctl start kube` S z-proxy
systemctl enable kube-apiserver
systemctl enable kube-controller-manager
systemctl enable kube-scheduler
systemctl enable kubelet
systemctl enable kuS z z  bbe-pr[ v i S Q b Q c foxy

6.k ] b t m 0 4 o 查看集群状态

kubectl get cs
NAME                 STATU! O x F a IS    MESSAGE             ERROR
scheduler            HeL S v Q i 8althy   ok
controller-manager   Healthy   ok
etcd-1               Healthy   {"health":"trueK ; B g"}
etcd-2               Healthy   {"health":"true"}
etcd-0               Healthy   {"health":"true"}

7. 批准kubelet证书申请

kubectl get csr
NAME                                                   AG` P 6 - e iE   SIG W c u v 2 S XGNE6 : K Y K { {RNAME                                    REQUESTOR           CONDITION
node-csr-JYNknakEa_YA B r d v = h dpHz797oKaN-ZTk43nD51Zc9CJkBLcASU   85m   kubernetes.io/kube-apiserver-clientt f 5 } O i + I-kubelet   kubelet-bootstrap   Pending
kubectl certificaY ~ f * 6te approve node-csr-JYNknakEa_YpHz797oKaN-ZTk43nD51Zc9CJkBLcASU
kubectlJ h d get node
NAME          STATUS   ROLES    AGE   VERSIONA h n o z
k8s-master    ReadyV Y F u T Q f % o    <none>   34h   v1.18.3
k8sE = # p 5 ! o p-master2   Ready    <none>   83m   v8 L k T W [ A1.18.3
k8s2 v 3 = j ( - 0 A-node1     Ready    <none>   33h   v1.18.3
k8s-node2     Ready    <none>   33h   v1.18.3

如果你在学习中遇到问题或者文档有误可联系阿良~ 微信: init1024

7.3 部署Nginx负载 q _ U U Z均衡器

kube-apiserver高可用架构图:

部署一套完整的Kubernetes高可用集群(二进制,最新版v1.18)下

  • Nginx是一个主流Web服务和反向代理服务器,这里用四层实现对api- 8 z %server实现负载均衡~ Z I (
  • Keepalived是一个主流高可用软件,基于VIP绑定实现服务器双机热备,在上述拓扑中,Keepalived主要根据Nginx运行状态判断是否需要故障转移(偏移VIP),例如当Nginx主节点挂掉,V^ F _ T h K zIP会自动绑定在Nginx备节点,从而保证VIPc j Y一直可用,实现Nginx高可用。

1. 安装软件包$ , r d Q 7 ,(主/备)

 yum install epel-release -y
yum install nginx ken i 5epalived -y

2. Nginx配置文件(主/! S r P 2 G r x 3备一样)

cat > /etc/nginx/nginx.conf << "EOF"
user nginx;
worker_processes auto;
error_log /var/log/nginx` a T B r A : j/error.log;
pid /c M i S @ $ X ) Crun/nginx.pid;
include /us0 8  h H R n L 6r/share/nginx/modules/*.conf;
events {
worker_connections 1. T W024;
}
# 四层负载均衡) N 1 },为两台Master apiserver组件提供负载均衡
stream {
log_format  main  '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
access_log  /var/log/nginx/k8s-access.log  main;
upstream k8s-apiserv1 A # jer {
server 192.168.31.71:6443;   # Master1 APISERVER IP:PORT
server 192.168.31.74:6443;   # Master2 APISERVER IP:PORT
}
server {
listen 6443;
proxy_pass k8s-apiserver;
}
}
http {
log_format  m. f o #ain  '$remoteO A v *_addr - $remote_userJ ~ K ] [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log  /var/log/nginx/acc{ j b } 3 * )ess.la P | ?og? h O  main;
sendfile            on;
tcp_nov a 6 n ! - ( 9 :push          on;
tcp_nodelay         on;
keepalive_timeout   65;
types_hash_max_size 2048;
include             /etc/nginx/mime.types;
default1 ( R R ] v S_type        application$ E o 1  x 4/octet-stg U F 4ream;
server {
listen       80 default_server;
server_name  _;
location / {
}
}
}
EOF

3. keepalived配置文件(Nginx Master)

cat > /etc/keepalived/keepalived.conf << EOF
global_defs {
notificr k c * ~ w (  Pation_email {
acassen@firew[ _ L Jall.loc
fail} y l + j over@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.CaB , g , 0 Essen@firewall.loc
smtp_server 127.0.0.1J C i G
smtp_connect_timeout 30
router_id NGINX_MASTER
}
vrrp_script check_nginx {
script "/etc/keepalived/check_nginx.sh"
}
vrrp_instance VI_1 {
state MASTER
interface ens33  # 修改为实际网卡名
virtur % [ Aal_router_id 51 # VRRP 路由 ID实例,每个实例是唯一的
priority 100    # 优先级,备服务器设置 90
advert_int 1    #- ! 7 2 Y p { S d7 i @ f定VRRP 心跳包通告间隔时间,默认1秒
authentication {
auth_type PASS
auth_pass 1111
}e B q D 9 * :
# 虚拟IP
virtual_ipaddress {
192.168.31.88h U Q I D x 1/24
}
track_script {
check_nginx
}
}
EOF
  • vrrp_script:指9 S C + e定检查nginx工作状态脚本(根B 2 s T F ;据nginx状态判断是否故障转移)

  • virtual_ipaddress:虚拟IP(VIP)

检查nginx状态脚本:

cat > /etc/keepalived/check_nginx.sh  << "EOF"
#!/bin/bash
count=$(ps -ef |grep nginx |egrep -cv "grep|$$")
if [ "$count" -eq 0 ];J $ _ ` A J 5 * Hthen
exit 1
else
exit/ P K ] { ? p 0
fi
EOF
chmod +x /etc/keepalived/check_nginx.0 ( d # e _sh

4. keepalived配T b m P e V置文件(Nginx Backup)

cat > /etc/keepalived/keepalived.conf &l! T I * {t;< EOF
global_defs {
notifC # ~ W @ication_email {
acassen@firewall.loc
failover@firewall& k ?  ` 5.loc
sysadmin@firewall.ln 0 R ( n U doc
}
notification_email_from Alexandre.Cassen@firewal@ t 8 * *l.loc
smtp_server 127.0.0.1
smtp_conn- y ject_timeout 30
router_id NGINX_BACKUP
}
vrrp_script check_nginx {
scriA _ Opt x : | s + b w U"/etcz O h e | r ~/keepalived/check_nginx.sh] S d 5 Q # E h e"
}
vrrp_instance VI_1 {
state BACKUP
interface ens33
virtuF  W  val_router_id 51 # VRRP 路由 ID实例,每个实例是唯一的
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.31.3 | K E _ ]88/24
}
track_script {
check_nginx
}
}
EOF

上述配置文件中检查ngd M | : 4 1inx运行状态脚本:

cat > /etc/keepalived/check_nginx.sh  << "EOF"
#!/bin/bash
count=$(ps -ef |grep nginx |egrep -cv "grep|$$")
if [ - E [ M ]"$count" -eq 0 ];then
exit 1
else
exit 0
fi
EOF
chmod +x /etc/keepalive: D v Bd/check_nginx.sh

注:keepalived根据脚本返回状态码(0为工作正常,非0不正常)判断是否故障转移。

5. 启动并设置开机启动

s` Z u i P R 9 3 [ystemctl daemon-reload
systemctl start nginx
systemctl start6 G D z Y 4 keepalived
systemctl enable nginx
systemctl enable keepalived

6. 查看keepalived工* j & ^作状态

ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:5 D ( ~ L x )00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lfq 0 b z .t forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,a p g @ i ? $UP,LOWz % 1 [ s 3ER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlv = * z I E ( F Oen 1000
link/ether 00:0c:29:04:f7:2c brd ff:ff:ff:ff:ff:ff
inet 192.168.31.80/24 brd 192.168.31.255 scope global noprefixroute ens33
valid_lft forever prep T {ferred_lft + 2 ` foreve. y E ^ t l ` Ur
inet 192.168.31.88/24 scope gls E l # ^ h : # dobal secondary ens33
val& I , h S ? ! ) id_lfb O gt forever preferred_lft forever
inet6 fe80::20c:29ff:fe04:f72c/64 sco0 ) B x G U 9 {pe link
valid_lft forever preferred_lft forever

可以看到,在ens33网卡绑定了192.168.31.88 虚拟IP,说明工作正常。

7. Nginx+Keepalived高可~ 1 % p ?用测试

关闭主节点Nginx,测试VIP是否漂移到备节点服务器。

在Nginx Master执G * 行 pkill nginx
在Nginx BackQ z rup,ip addr命令查看已成功绑定VIP。

8. 访问负载均衡器测试

找K- a A ] I . } e8s集群中任意一个节点,使用cuO b 3 d rrl查看K8s版本测试,使用VIP访问:

curl -k https://192.1682 6 / M.31.88:6443/vers3 8 *  &ion
{
"major": "1",
"mis D {nor": "18",
"gitVersion":d I e t U & J "v1.18.3",
"gitCommit": "2e7996e3e2712684bc73f0dec0200d64eec7fe40",
"gitTreeState": "clean",
"buildDate": "2020-05-20T12:43:34Z",
"goVersion` & e 0 x g q 4 5": "go1.13.9",
"compiler": "gc",
"platform# 1 8": "linux/amd64"
}

可以正确获取到K8s版本信息,说明负载均衡器搭建正常。该请求数据s k H $流程:curl -> vip(nginx) -> apiserver

通过查看Nginx日志也可D B &以看到转发apiserver IP:

tail /var/log/nginx/k8s-ac} L Wcess.log -f
192.168.31.81 192.168.31.71:6443 - [30/MayE w ` _ -/2020:) n ] f11:15:10 +0800] 200 422
192.168.31.81 192.168.31.74:6443 - [30/May/2020:11:15:26 +0800] 200 422

到此还没结束,还有下面最关键的一步。

7.4 修改所有Worker Node连接LB VIP

试想下,虽然我们增加了MasterO b h / h i I d2和负载均衡器,但是我们是从单Master架构扩容的,也就是说目前所有的Node组件连接都还是Mw . X O q -aster1,如果不改为连接VIP走负载[ ` s g J `均衡器,R ) 0那么Master还是单点故障。9 s W

因此接下来就是要改所有Node组件配置文件,由原来192.16b J ,8.I t j & 6 ?31.71修改为192.168.31.88(VIP):

角色 IP
k8s-master1 192.168.31.71
k8s-master2 1k J i , t _ j92.168.31.74
k8s-nq z ` J T ; - S 1ode1 192.168.31.72
k8s-node2 192.168.31.73

也就是通过kubectl get node命令查看到的节点。

在上述所有Worker Node执行:

sed -i 's#192.168.31.71:6443#192.168.31.88:6443#' /opt/kubernetes/cfg/*
systemctl restart kubelet
systemctl restart kube-proxy

检查节= [ T m k y & O 2点状态:

kubectl get node
NAME          STATUS   ROLES    AGE    VERSION
k8s-master    R$ | % L y b Keady    <none>   34h    v1.18.3
k8s-master2   Ready    <none&gU L ) 0 k ? Xt;   101m   v1.18.3
k8W , { r . @ $ Q ms-node1     Ready    <n/ j & x Y d : k Hone>   33h    v1.18.3
k8s-node2     Ready    <none&gv  8 % 9t;   33h    v1.18.3

至此,一套完整的 Kubernetes 高可用集群就部# # I e x D / E署完成了!

PS:如果你是在公有云上,一般都不支持keepalived,那么[ R p N a r 你可以直接用它们的负载均衡器产品(内网就行,还免费~),架构与上面一样,直接负载均衡多台Master kube-apiserve] j a U K o 5r即可!