AWS中Keepalived+Nginx高可用部署流程

1.AWS中Keepalived+Nginx高可用部署

1.1 环境安装

1.1.1 安装keepalived

1.1.2 配置AWS-IAM

1.1.3 创建一个弹性ip地址

1.1.4 开启ipv4转发

1.2 Keepalived主从配置

1.2.1 注意事项

1.2.2 配置主节点

1.2.3 配置从节点

1.2.4 所有的主从keepalived机器配置脚本

1.2.4.1 —绑定弹性IP到节点私有网卡

1.2.4.2 —解绑弹性IP到私有网卡

1.2.4.3 给这两个文件赋予执行权限

1.3 生效配置

1.3.0 创建普通用户

1.3.1 生效开启ipv4转发

1.3.2 重启keepalived

1.3.3 如果有更新nginx配置,也要进行重载

1.4 内网测试访问

1.AWS中Keepalived+Nginx高可用部署

1.1 环境安装

1.1.1 安装keepalived

sudo yum -y install keepalived jq

1.1.2 配置AWS-IAM

#需要所有的EC2权限
sudo aws configure
AK
SK
us-east-1
json

1.1.3 创建一个弹性ip地址

sudo aws ec2 allocate-address
#记下你的AllocationId,后面要用到.

{
    "Domain": "vpc", 
    "PublicIpv4Pool": "amazon", 
    "PublicIp": "11.221.15.113", 
    "AllocationId": "eipalloc-xxxxxxxx", 
    "NetworkBorderGroup": "us-east-1"
}

1.1.4 开启ipv4转发

sudo vim /etc/sysctl.conf
...
net.ipv4.ip_forward=1
net.ipv4.ip_nonlocal_bind=1

1.2 Keepalived主从配置

1.2.1 注意事项

#注意事项:
1.Aws的虚拟交换机（VPC）VRRP 协议的组播被禁止，所以需要配置心跳通知为单播模式.
2.配置虚拟IP前，需要去AWS的子网去看你的ip地址段，虚拟IP要和你的子网处于同一个网段中.

1.2.2 配置主节点

sudo vim /etc/keepalived/keepalived.conf

#全局配置
global_defs {
    router_id LVS_Master
    script_user root
    }
#VRRP 的实例 Group_LVS_1 配置
vrrp_instance Group_LVS_1 {
    #主节点为MASTER，从节点为BACKUP
    state MASTER
    #你的实例网卡名称，通过ip a可以查看到
    interface eth0
    #这里的id所有的主从节点都需要保持一致
    virtual_router_id 51
    #主节点一定比从节点高
    priority 100
    advert_int 1
    track_interface {
        eth0
        }
# AWS 上 VRRP 协议的组播被禁止，因此这里配置心跳通知为单播模式
unicast_src_ip 172.31.1.147 #本机 IP
unicast_peer {
#单播对象 IP，页就是你的从节点
    172.31.3.248
}
authentication {
auth_type PASS
auth_pass 123456
}
#虚拟 IP 地址
virtual_ipaddress {
172.31.6.111
}
# 参数1 弹性IP的AllocationId 参数2:要绑定的虚拟IP 参数3:EC2实例ID
notify_master "/etc/keepalived/assign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
notify_backup "/etc/keepalived/unassign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
notify_fault "/etc/keepalived/unassign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
}

1.2.3 配置从节点

sudo vim /etc/keepalived/keepalived.conf

#全局配置
global_defs {
    router_id LVS_Master
    script_user root
    }
#VRRP 的实例 Group_Lvs_1 配置
vrrp_instance Group_LVS_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 1
    track_interface {
        eth0
        }
# AWS 上 VRRP 协议的组播被禁止，因此这里配置心跳通知为单播模式
unicast_src_ip 172.31.3.248 #本机 IP
unicast_peer {
#单播对象 IP
    172.31.1.147
}
authentication {
auth_type PASS
auth_pass 123456
}
#虚拟 IP 地址
virtual_ipaddress {
172.31.6.111
}
# 参数1 弹性IP的AllocationId 参数2:要绑定的虚拟IP 参数3:EC2实例ID
notify_master "/etc/keepalived/assign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
notify_backup "/etc/keepalived/unassign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
notify_fault "/etc/keepalived/unassign_private_ip.sh 弹性IPAllocationId 172.31.6.111 当前EC2实例ID"
}

1.2.4 所有的主从keepalived机器配置脚本

1.2.4.1 —绑定弹性IP到节点私有网卡

sudo vim /etc/keepalived/assign_private_ip.sh

#!/bin/bash
set -o errexit
set -o nounset

ASSOCIATION_ID=eipalloc-xxxxxxxx
PRIVATE_IP=172.31.6.111
INSTANCE_ID=i-xxxxxxxx

# 根据实例ID找到网卡ID
ENI=$(\
    aws ec2 describe-instances \
    --instance-ids $INSTANCE_ID | \
    jq -r \
    '.Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId' \
)

# 绑定辅助私有IP地址到网卡
aws ec2 assign-private-ip-addresses \
    --network-interface-id $ENI \
    --private-ip-addresses $PRIVATE_IP \
    --allow-reassignment
# 关联弹性IP地址到辅助私有IP地址
aws ec2 associate-address \
    --allocation-id $ASSOCIATION_ID \
    --network-interface-id $ENI \
    --private-ip-address $PRIVATE_IP \
    --allow-reassociation

echo "Adding ELASTICE IP to ENI $ENI"

1.2.4.2 —解绑弹性IP到私有网卡

sudo vim /etc/keepalived/unassign_private_ip.sh

#!/bin/bash
set -o errexit
set -o nounset

ASSOCIATION_ID=eipalloc-xxxxxxxx
PRIVATE_IP=172.31.6.111
INSTANCE_ID=i-xxxxxxxx

# 根据实例ID找到网卡ID
ENI=$(\
    aws ec2 describe-instances \
    --instance-ids $INSTANCE_ID | \
    jq -r \
    '.Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId' \
)

# 解除弹性IP地址与辅助私有IP地址的关联
aws ec2 disassociate-address \
    --association-id $ASSOCIATION_ID

# 解绑辅助私有IP地址从网卡
aws ec2 unassign-private-ip-addresses \
    --network-interface-id $ENI \
    --private-ip-addresses $PRIVATE_IP

echo "Removing ELASTIC IP from ENI $ENI"

1.2.4.3 给这两个文件赋予执行权限

sudo chmod -R 777 /etc/keepalived/unassign_private_ip.sh
sudo chmod -R 777 /etc/keepalived/assign_private_ip.sh

1.3 生效配置

1.3.0 创建普通用户

useradd -r keepalived_script

1.3.1 生效开启ipv4转发

sysctl -p

1.3.2 重启keepalived

sudo systemctl restart keepalived.service
sudo systemctl enable keepalived.service
sudo systemctl status keepalived.service

1.3.3 如果有更新nginx配置,也要进行重载

nginx -s reload

1.4 内网测试访问

#注意
安全组一定要开VIP访问80端口

#curl VIP
curl 172.31.6.111

#测试
#模拟下线操作
systemctl stop keepalived
#查看VIP是否漂移
ip addr show
#查看是否绑定到EIP
aws ec2 describe-addresses --allocation-ids
#内网服务器进行访问
curl -I 172.31.6.111 && curl 172.31.6.111