【K8s+Docker技术全解】07.Master主控节点服务-配置nginx4层反向代理

## 99.101/102配置nginx4层反向代理 kub-apiserver启动以后监听6443端口，使用nginx的7443端口去反向代理两个apiserver的6443端口 ### 99.101配置nginx反代 #### nginx安装 ```bash # 192.168.99.101 [root@k8s99-101 ~]# yum install nginx -y ``` #### nginx配置7443代理apiserver的6443端口 ```bash # 192.168.99.101 [root@k8s99-101 ~]# vim /etc/nginx/nginx.conf # 放在nginx.conf的最后，不能放在http段里，因为http里是7层（应用层），而stream是4层（传输层）反代 stream { upstream kube-apiserver { server 192.168.99.151:6443 max_fails=3 fail_timeout=30s; server 192.168.99.152:6443 max_fails=3 fail_timeout=30s; } server { listen 7443; proxy_connect_timeout 2s; proxy_timeout 900s; proxy_pass kube-apiserver; } } ``` #### 启动nginx ```bash # 192.168.99.101 [root@k8s99-101 ~]# nginx -t [root@k8s99-101 ~]# systemctl start nginx [root@k8s99-101 ~]# systemctl status nginx [root@k8s99-101 ~]# systemctl enable nginx ``` 如果`nginx -t`通过测试，但启动nginx报错，通过`systemctl status nginx`检查到`nginx: [emerg] bind() to 0.0.0.0:7443 failed (13: Permission denied)`这样的错误，处理办法： ```bash [root@k8s99-101 ~]# getenforce Enforcing [root@k8s99-101 ~]# setenforce 0 [root@k8s99-101 ~]# systemctl start nginx # 这样就可以运行了，如果是要永久修改 [root@k8s99-101 ~]# vim /etc/selinux/config # 将SELINUX=enforcing改为SELINUX=disabled 然后重启即可 ``` #### 检查nginx启动状态 ```bash # 192.168.99.101 [root@k8s99-101 ~]# netstat -luntp | grep nginx tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3388/nginx: master tcp 0 0 0.0.0.0:7443 0.0.0.0:* LISTEN 3388/nginx: master tcp6 0 0 :::80 :::* LISTEN 3388/nginx: master ``` 7443端口已经被监听了。 #### 防火墙允许对外端口 ```bash # 192.168.99.101 [root@k8s99-101 ~]# firewall-cmd --zone=public --add-port=7443/tcp --permanent [root@k8s99-101 ~]# firewall-cmd --reload ``` ### 99.102配置nginx反代 ```bash # 192.168.99.102 # 安装nginx yum install nginx -y cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak # 修改nginx配置文件 echo 'stream { upstream kube-apiserver { server 192.168.99.151:6443 max_fails=3 fail_timeout=30s; server 192.168.99.152:6443 max_fails=3 fail_timeout=30s; } server { listen 7443; proxy_connect_timeout 2s; proxy_timeout 900s; proxy_pass kube-apiserver; } }' >> /etc/nginx/nginx.conf # 测试启动nginx并查看启动状态 nginx -t setenforce 0 # 关闭selinux vim /etc/selinux/config systemctl start nginx systemctl status nginx systemctl enable nginx netstat -luntp | grep nginx # 防火墙添加端口 firewall-cmd --zone=public --add-port=7443/tcp --permanent firewall-cmd --reload ```

明人不说暗话 领红包就是支持！！！ 来都来了，再到页面底部看下呗~ ↓ ↓ ↓

本文地址： http://blog.starmeow.cn/detail/d947bf06a885db0d477d707121934ff8/

很赞哦！ (1)