1
user nginx;
2
worker_processes auto;
3
error_log /var/log/nginx/error.log;
4
pid /run/nginx.pid;
5

6
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
7
include /usr/share/nginx/modules/*.conf;
8

9
events {
10
    worker_connections 1024;
11
}
12

13
### 重点是这一段，配置反向代理，将请求转发给三个control plane实现负载均衡
14
stream {
15
  log_format main '$remote_addr $upstream_addr - [$time_local] $status $upstream_bytes_sent';
16
  access_log /var/log/nginx/k8s-access.log main;
17

18
  upstream kubernetes-apiserver {
19
    server 192.168.100.8:6443 weight=5 max_fails=3 fail_timeout=30s;
20
    server 192.168.100.11:6443 weight=5 max_fails=3 fail_timeout=30s;
21
    server 192.168.100.12:6443 weight=5 max_fails=3 fail_timeout=30s;
22
  }
23

24
  server {
25
    # listen可以选择任意没被占用的端口
26
    listen 16443;
27
    # proxy_pass将请求转发到上面upstream中定义的server池
28
    proxy_pass kubernetes-apiserver;
29
  }
30
}
31
###
32
### 下面是默认配置，没有修改
33
http {
34
      ...
35
    }

1
global_defs {
2
  # 本节点在 VRRP 集群中的唯一标识名，主节点用 NGINX_MASTER；备用节点需要改为 NGINX_BACKUP
3
  router_id NGINX_MASTER
4
}
5
# 健康检查脚本
6
vrrp_script check_nginx {
7
  script "/etc/keepalived/check_nginx.sh"
8
  interval 3       # 健康检查间隔
9
  timeout 2        # 脚本超时时间，超过2秒视为失败
10
  fall 3           # 连续失败3次才认定为不健康
11
  rise 2           # 连续成功2次才认定为恢复健康
12
  weight -10       # 检查失败时本节点优先级降低10
13
}
14
vrrp_instance VI_1 {
15
  # 节点的初始角色，主节点用 MASTER；备用节点需要将此配置改为 BACKUP
16
  state MASTER
17
  # VVIP 绑定的网卡
18
  interface eth0
19
  # VRRP 组的唯一标识，同一组的主备节点必须相同
20
  virtual_router_id 51
21
  # 优先级，谁高谁当Master，需要将备用节点的priority设置低于主节点
22
  priority 100
23
  # MASTER 每隔多少秒向组播地址发送一次心跳，BACKUP 节点如果超过这个时间没收到心跳，就认为 MASTER 挂了并发起竞选
24
  advert_int 1
25
  # 主备节点之间通信的认证方式，防止局域网内其他机器伪造 VRRP 报文
26
  # PASS是明文传输，安全性较低，生产环境建议用 AH
27
  authentication {
28
    auth_type PASS
29
    auth_pass 1111
30
  }
31
  # 虚拟IP地址，此地址必须是网络中没有被占用的
32
  virtual_ipaddress {
33
    192.168.100.211/24
34
  }
35
  # 引用健康检查
36
  track_script {
37
    check_nginx
38
  }
39
}

1
#!/bin/bash
2

3
http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 http://127.0.0.1:20080/health)
4

5
if [ "$http_code" == "200" ]; then
6
    exit 0
7
fi
8

9
# 探测失败，尝试重启 nginx
10
systemctl restart nginx
11
sleep 2
12

13
# 重启后再探测一次，决定返回值给 keepalived 计数
14
http_code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 http://127.0.0.1:20080/health)
15
if [ "$http_code" == "200" ]; then
16
    exit 0  # 重启后恢复了，keepalived 不计失败
17
else
18
    exit 1  # 重启也没救，keepalived 累计失败次数
19
fi

1
apiVersion: v1
2
data:
3
  ClusterConfiguration: |
4
    apiVersion: kubeadm.k8s.io/v1beta4
5
    caCertificateValidityPeriod: 87600h0m0s
6
    certificateValidityPeriod: 8760h0m0s
7
    certificatesDir: /etc/kubernetes/pki
8
    clusterName: kubernetes
9
    controllerManager: {}
10
    dns: {}
11
    encryptionAlgorithm: RSA-2048
12
    etcd:
13
      local:
14
        dataDir: /var/lib/etcd
15
    imageRepository: registry.k8s.io
16
    kind: ClusterConfiguration
17
    kubernetesVersion: v1.31.14
18
    controlPlaneEndpoint: "192.168.100.211:16443"  # 将VIP设置为控制平面入口
19
    apiServer:
20
      certSANs:  # 添加 VIP 到证书备用名称（关键！）
21
      - "192.168.100.8"
22
      - "192.168.100.11"
23
      - "192.168.100.12"
24
      - "192.168.100.211"
25
      - "kubernetes"
26
      - "kubernetes.default"
27
      - "kubernetes.default.svc"
28
      - "kubernetes.default.svc.cluster.local"
29
      - "localhost"
30
      - "127.0.0.1"
31
    networking:
32
      dnsDomain: cluster.local
33
      podSubnet: 10.244.0.0/16
34
      serviceSubnet: 10.96.0.0/12
35
    proxy: {}
36
    scheduler: {}
37
kind: ConfigMap
38
metadata:
39
  creationTimestamp: "2026-03-15T08:07:27Z"
40
  name: kubeadm-config
41
  namespace: kube-system
42
  resourceVersion: "110579"
43
  uid: 765ac92b-04ba-4ec2-8959-b1d2060f3d3f