Linux服务器高可用集群搭建：Keepalived+Nginx负载均衡实战

小编 • • 服务器

服务器高可用集群是IDC数据中心基础设施的核心组件。单点Nginx反向代理一旦宕机，后端所有业务中断。Keepalived基于VRRP协议实现VIP浮动，配合Nginx构建主备高可用负载均衡集群，故障切换时间控制在秒级。本文记录在CentOS 9环境下的完整搭建过程，包含服务器故障排查和健康检查配置。

高可用集群架构设计

典型双机热备架构包含以下组件：

  • Master节点（192.168.1.10）：主负载均衡器，持有VIP（192.168.1.100）
  • Backup节点（192.168.1.11）：备负载均衡器，Master故障时接管VIP
  • VIP（192.168.1.100）：客户端访问的虚拟IP，在两节点间浮动
  • 后端Real Server（192.168.1.20-22）：实际提供业务服务的服务器

正常情况下，客户端请求到达VIP，由Master节点的Nginx转发到后端服务器。Master故障时，Backup节点通过VRRP协议检测到心跳超时，在1-3秒内接管VIP，实现无缝故障切换。

安装Keepalived与Nginx

在主备两台服务器上分别安装：

# 安装EPEL仓库
dnf install -y epel-release

# 安装Keepalived和Nginx
dnf install -y keepalived nginx

# 启动并设置开机自启
systemctl enable --now keepalived nginx

验证安装版本：

keepalived -v
# Keepalived v2.2.8

nginx -v
# nginx version: nginx/1.24.0

配置Keepalived VRRP实例

Master节点配置文件/etc/keepalived/keepalived.conf：

global_defs {
    router_id LVS_MASTER
    enable_script_security
    script_user root
}

vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight -20
    fall 2
    rise 1
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass YourStrongPass123
    }

    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }

    track_script {
        check_nginx
    }

    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
}

Backup节点配置，修改state和priority：

global_defs {
    router_id LVS_BACKUP
    enable_script_security
    script_user root
}

vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
    interval 2
    weight -20
    fall 2
    rise 1
}

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 51
    priority 90
    advert_int 1

    authentication {
        auth_type PASS
        auth_pass YourStrongPass123
    }

    virtual_ipaddress {
        192.168.1.100/24 dev eth0
    }

    track_script {
        check_nginx
    }

    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
}

Nginx健康检查脚本配置

创建/etc/keepalived/check_nginx.sh，检测Nginx进程是否存活：

#!/bin/bash
if [ -f /var/run/nginx.pid ]; then
    nginx_pid=$(cat /var/run/nginx.pid)
    if kill -0 $nginx_pid 2>/dev/null; then
        exit 0
    fi
fi

# Nginx进程不存在，尝试重启
systemctl restart nginx
sleep 2

if [ -f /var/run/nginx.pid ]; then
    nginx_pid=$(cat /var/run/nginx.pid)
    if kill -0 $nginx_pid 2>/dev/null; then
        exit 0
    fi
fi

exit 1

赋予脚本执行权限：

chmod +x /etc/keepalived/check_nginx.sh

创建故障切换通知脚本/etc/keepalived/notify.sh：

#!/bin/bash
STATE=$1
case $STATE in
    master)
        echo "$(date) - Became MASTER" >> /var/log/keepalived-notify.log
        curl -s -X POST "https://api.telegram.org/bot<TOKEN>/sendMessage" \
          -d "chat_id=<CHAT_ID>&text=Keepalived MASTER切换: $(hostname)"
        ;;
    backup)
        echo "$(date) - Became BACKUP" >> /var/log/keepalived-notify.log
        ;;
    fault)
        echo "$(date) - FAULT detected" >> /var/log/keepalived-notify.log
        ;;
esac

配置Nginx负载均衡上游服务器

编辑/etc/nginx/nginx.conf，配置upstream负载均衡：

http {
    upstream backend_pool {
        ip_hash;
        server 192.168.1.20:8080 weight=3 max_fails=3 fail_timeout=30s;
        server 192.168.1.21:8080 weight=2 max_fails=3 fail_timeout=30s;
        server 192.168.1.22:8080 weight=1 max_fails=3 fail_timeout=30s;
        backup server 192.168.1.23:8080;
    }

    server {
        listen 8088;
        location /nginx_status {
            stub_status on;
            access_log off;
            allow 192.168.1.0/24;
            deny all;
        }
    }

    server {
        listen 80;
        server_name 192.168.1.100;

        location / {
            proxy_pass http://backend_pool;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_connect_timeout 5s;
            proxy_read_timeout 60s;
        }

        location /health {
            access_log off;
            return 200 "ok";
        }
    }
}

启动服务与故障切换测试

启动Keepalived并验证VIP状态：

# Master节点启动
systemctl start keepalived

# 查看VIP绑定状态
ip addr show eth0 | grep 192.168.1.100
# inet 192.168.1.100/24 scope global secondary eth0

# 查看Keepalived状态
systemctl status keepalived
# Active: active (running)
# VRRP Instance: VI_1 - Master

模拟Master故障，在Master节点停止Keepalived：

# Master节点
systemctl stop keepalived

# Backup节点查看VIP接管
ip addr show eth0 | grep 192.168.1.100
# inet 192.168.1.100/24 scope global secondary eth0

# 查看Backup节点日志
tail -f /var/log/messages | grep Keepalived
# Keepalived: VRRP_Instance(VI_1) Transition to MASTER STATE
# Keepalived: VRRP_Instance(VI_1) Entering MASTER STATE

客户端使用curl持续测试，确认故障切换期间丢包数：

while true; do curl -s -o /dev/null -w "%{http_code} %{time_total}s\n" http://192.168.1.100/; sleep 0.5; done
# 200 0.012s
# 200 0.015s
# 000 0.501s  <-- 故障切换瞬间
# 200 0.018s

高可用集群安全加固

VRRP协议使用组播地址224.0.0.18通信，需配置防火墙规则：

# 允许VRRP协议通信
firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
firewall-cmd --add-service=http --permanent
firewall-cmd --reload

关闭SELinux或配置适当策略：

setenforce 0
sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

常见故障排查

脑裂问题：主备同时持有VIP，导致客户端请求混乱。排查网络连通性，确认VRRP组播包是否被交换机过滤。使用tcpdump抓包验证：

tcpdump -i eth0 vrrp -n
# 正常情况只有Master发送VRRP通告包

VIP无法绑定：检查网卡名称是否与配置文件中的interface一致，确认IP地址无冲突。查看系统日志/var/log/messages中的Keepalived错误信息。

故障切换后Nginx未启动：确认check_nginx.sh脚本权限和逻辑正确。手动执行脚本验证返回值。Keepalived的track_script权重调整需要合理设置，确保故障检测后优先级变化能触发切换。

对于更高可用性要求的场景，可以扩展为三节点集群，通过调整priority和quorum配置实现多数投票机制。配合Consul或etcd做服务发现，实现后端Real Server的动态上下线，构建更智能的负载均衡体系。在服务器安全加固方面，定期更新Keepalived和Nginx补丁，限制管理端口的访问来源，配合审计日志记录所有配置变更操作。

原创文章，作者：小编，如若转载，请注明出处：https://www.yunthe.com/linux-fu-wu-qi-gao-ke-yong-ji-qun-da-jian-keepalivednginx-2/

赞 (0)
小编小编
0
上一篇 4小时前
下一篇 4小时前

相关推荐