一、实验主机配置1.主机信息角色IP备注LVS-Master172.25.254.10lb01LVS-Backup172.25.254.11lb02Nginx RS1172.25.254.20web01Nginx RS2172.25.254.21web02Redis Master172.25.254.30redis-masterRedis Slave172.25.254.31redis-slave监控节点172.25.254.40monitorVIP172.25.254.100前置准备所有节点关闭防火墙、关闭 SELinux、能互通、能 ping 通网关2.主机环境配置(1)关闭防火墙# 临时关闭 systemctl stop firewalld # 开机不自启 systemctl disable firewalld # 查看状态 systemctl status firewalld如果是 iptables 版本老系统systemctl stop iptables systemctl disable iptables(2)关闭 SELinux永久关闭 临时关闭# 临时关闭立即生效重启失效 setenforce 0 # 永久关闭修改配置文件 sed -i s/^SELINUXenforcing/SELINUXdisabled/ /etc/selinux/config sed -i s/^SELINUXpermissive/SELINUXdisabled/ /etc/selinux/config # 验证 getenforce # 输出 Permissive / Disabled 就ok(3)主机名设置方便识别可选建议配置# LB01执行 hostnamectl set-hostname lb01 # LB02执行 hostnamectl set-hostname lb02 # Web01执行 hostnamectl set-hostname web01 # Web02执行 hostnamectl set-hostname web02(4)主机名解析 /etc/hosts所有节点都配置cat /etc/hosts EOF 192.168.1.101 lb01 192.168.1.102 lb02 192.168.1.103 web01 192.168.1.104 web02 EOF验证互通ping lb01 ping lb02 ping web01 ping web02 ping 网关IP(5)时间同步企业必做面试加分所有节点# 安装chrony yum install -y chrony systemctl start chronyd systemctl enable chronyd # 校验时间同步 chronyc sources(6)基础依赖包所有节点提前装yum install -y wget curl net-tools vim ipvsadm keepalived nginx(7)内核参数前置LVS-DR 模式必须重点面试官爱问cat /etc/sysctl.conf EOF net.ipv4.conf.all.arp_ignore 1 net.ipv4.conf.all.arp_announce 2 net.ipv4.conf.lo.arp_ignore 1 net.ipv4.conf.lo.arp_announce 2 EOF # 生效 sysctl -p二、LB (master,backup)节点 keepalived LVS-DR 配置VIP172.25.254.100 后端 RS172.25.254.20、172.25.254.21 端口801.LB01(MASTER)(1)备份原有配置文件cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak(2)写入 keepalived.confcat /etc/keepalived/keepalived.conf EOF ! Configuration File for keepalived global_defs { router_id LVS_MASTER } vrrp_instance VI_1 { state MASTER interface eth0 # 改成你自己的网卡比如ens33 virtual_router_id 51 # 主备必须一致0-255 priority 100 # 主节点优先级高于备 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } } virtual_server 172.25.254.100 80 { delay_loop 6 lb_algo rr # 轮询调度也可以改成wrr lb_kind DR # DR模式重点 persistence_timeout 0 protocol TCP real_server 172.25.254.20 80 { weight 1 TCP_CHECK { connect_timeout 3 nb_get_retry 3 delay_before_retry 3 connect_port 80 } } real_server 172.25.254.21 80 { weight 1 TCP_CHECK { connect_timeout 3 nb_get_retry 3 delay_before_retry 3 connect_port 80 } } } EOF(3)启动并开机自启systemctl start keepalived systemctl enable keepalived(4)查看 ipvs 规则keepalived 会自动生成不用手动 ipvsadm 添加ipvsadm -Ln ip a2.LB02(backup)(1)备份原有配置文件cp /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.bak(2) 写入 keepalived.confcat /etc/keepalived/keepalived.conf EOF ! Configuration File for keepalived global_defs { router_id LVS_BACKUP } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 51 priority 90 # 优先级比master低 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } } virtual_server 172.25.254.100 80 { delay_loop 6 lb_algo rr lb_kind DR persistence_timeout 0 protocol TCP real_server 172.25.254.20 80 { weight 1 TCP_CHECK { connect_timeout 3 nb_get_retry 3 delay_before_retry 3 connect_port 80 } } real_server 172.25.254.21 80 { weight 1 TCP_CHECK { connect_timeout 3 nb_get_retry 3 delay_before_retry 3 connect_port 80 } } } EOF(3)启动并开机自启systemctl start keepalived systemctl enable keepalived(4)查看 ipvs 规则keepalived 会自动生成不用手动 ipvsadm 添加ipvsadm -Ln ip a​3.后端 Web 节点web01、web02 两台都执行DR 模式核心lo 绑定 VIP(1)手动添加 lo:0 虚拟网卡绑定 VIP(掩码必须 32 位)ifconfig lo:0 172.25.254.100 netmask 255.255.255.255 broadcast 172.25.254.100 up(2)添加主机路由去往 VIP 的流量走 lo:0route add -host 172.25.254.100 dev lo:0(3)验证是否配置成功(能看到 lo:0 网卡、172.25.254.100 路由条目就 OK)ifconfig lo:0 route -n(4)手动停止删除 VIP 和路由ifconfig lo:0 down route del -host 172.25.254.100 dev lo:0(5)开机自动生效手动配置不用 service 脚本vim /etc/rc.local在文件末尾添加两行ifconfig lo:0 172.25.254.100 netmask 255.255.255.255 broadcast 172.25.254.100 up route add -host 172.25.254.100 dev lo:0给 rc.local 执行权限RHEL/CentOS7 必须做chmod x /etc/rc.local故障切换测试# 在lb01停止keepalived模拟主LB宕机 systemctl stop keepalived # 去lb02执行 ip aVIP漂移到lb02 # 恢复lb01 systemctl start keepalived # VIP自动切回master因为master优先级更高ipvsadm 保存规则可选RHEL9 持久化keepalived 是自动管理 ipvs 规则一般不需要手动保存ipvsadm-save /etc/sysconfig/ipvsadm4.安装 Nginx写测试页面web01、web02 区分页面方便验证轮询web01yum install -y nginx echo web01 192.168.1.103 /usr/share/nginx/html/index.html systemctl start nginx systemctl enable nginxweb02yum install -y nginx echo web02 192.168.1.104 /usr/share/nginx/html/index.html systemctl start nginx systemctl enable nginx三、redis1.安装 Redis所有 redis 节点都执行yum install -y redis systemctl stop redis2. Redis-Master 配置(1)备份原配置cp /etc/redis/redis.conf /etc/redis/redis.conf.bak(2)写入主库配置cat /etc/redis/redis.conf EOF bind 0.0.0.0 port 6379 daemonize yes pidfile /var/run/redis_6379.pid logfile /var/log/redis/redis.log dbfilename dump.rdb dir /var/lib/redis requirepass Redis123 masterauth Redis123 EOF(3)启动 masterredis-server /etc/redis/redis.conf3. Redis-Slave 配置 192.168.1.21(1)备份原配置cp /etc/redis/redis.conf /etc/redis/redis.conf.bak(2)写入主库配置cat /etc/redis/redis.conf EOF bind 0.0.0.0 port 6379 daemonize yes pidfile /var/run/redis_6379.pid logfile /var/log/redis/redis.log dbfilename dump.rdb dir /var/lib/redis requirepass Redis123 masterauth Redis123 replicaof 192.168.1.20 6379 EOF(3)启动 slaveredis-server /etc/redis/redis.conf(4)验证主从在 master 上执行redis-cli -a Redis123 info replication正常可以看到 connected_slaves:14.Redis Sentinel 哨兵配置监控主从自动故障切换哨兵端口默认 26379至少 3 个哨兵实例我们在一台机器启 3 个哨兵模拟集群# 哨兵1配置 cat /etc/redis/sentinel-26379.conf EOF bind 0.0.0.0 port 26379 daemonize yes pidfile /var/run/redis-sentinel-26379.pid logfile /var/log/redis/sentinel-26379.log sentinel monitor mymaster 192.168.1.20 6379 2 sentinel auth-pass mymaster Redis123 sentinel down-after-milliseconds mymaster 3000 sentinel failover-timeout mymaster 10000 sentinel parallel-syncs mymaster 1 EOF # 哨兵2配置 cat /etc/redis/sentinel-26380.conf EOF bind 0.0.0.0 port 26380 daemonize yes pidfile /var/run/redis-sentinel-26380.pid logfile /var/log/redis/sentinel-26380.log sentinel monitor mymaster 192.168.1.20 6379 2 sentinel auth-pass mymaster Redis123 sentinel down-after-milliseconds mymaster 3000 sentinel failover-timeout mymaster 10000 sentinel parallel-syncs mymaster 1 EOF # 哨兵3配置 cat /etc/redis/sentinel-26381.conf EOF bind 0.0.0.0 port 26381 daemonize yes pidfile /var/run/redis-sentinel-26381.pid logfile /var/log/redis/sentinel-26381.log sentinel monitor mymaster 192.168.1.20 6379 2 sentinel auth-pass mymaster Redis123 sentinel down-after-milliseconds mymaster 3000 sentinel failover-timeout mymaster 10000 sentinel parallel-syncs mymaster 1 EOF启动 3 个哨兵redis-sentinel /etc/redis/sentinel-26379.conf redis-sentinel /etc/redis/sentinel-26380.conf redis-sentinel /etc/redis/sentinel-26381.conf验证哨兵redis-cli -p 26379 -a Redis123 sentinel master mymaster故障测试停掉 redis-master# 在192.168.1.20 pkill redis-server哨兵会自动把 slave 提升为新 master查看哨兵日志确认切换。5.修改 Nginx 后端 Web 页面对接 Redis把 redis 融入业务Web1、Web2 两台 Nginx我们写一个简单 php 页面读取 / 写入 Redis证明业务真的在用 Redis 缓存 3、Nginx 配置对接 php-fpm(1)先在 web 节点安装 phpredis 扩展# 安装epel源RHEL9必须CentOS Stream9可选 dnf install -y epel-release yum install -y php php-cli php-fpm php-pecl-redis systemctl start php-fpm systemctl enable php-fpm(2)备份原有配置cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak(3)写入 nginx 主配置cat /etc/nginx/nginx.conf EOF user nginx; worker_processes auto; error_log /var/log/nginx/error.log; pid /run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; log_format main \$remote_addr - \$remote_user [\$time_local] \$request \$status \$body_bytes_sent \$http_referer \$http_user_agent \$http_x_forwarded_for; access_log /var/log/nginx/access.log main; sendfile on; keepalive_timeout 65; server { listen 80; server_name _; root /usr/share/nginx/html; index index.html index.php; location ~ \.php\$ { fastcgi_pass 127.0.0.1:9000; fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name; include fastcgi_params; } } } EOF6、编写业务页面访问计数页面对接后面 Redis 哨兵这个页面用来证明流量经过 LVS→Nginx→PHP→Redis 缓存面试演示效果很好cat /usr/share/nginx/html/index.php EOF ?php header(Content-Type:text/html;charsetutf-8); \$redis new Redis(); // 连接哨兵节点 192.168.1.22:26379 try{ \$redis-connect(192.168.1.22,26379,3); \$redis-auth(Redis123); // 通过哨兵获取当前master地址 \$res \$redis-rawCommand(sentinel,get-master-addr-by-name,mymaster); if(!empty(\$res)){ \$master_host \$res[0]; \$master_port \$res[1]; \$redis-close(); // 连接真实redis master读写 \$redis-connect(\$master_host,\$master_port,3); \$redis-auth(Redis123); \$redis-set(visit_count,\$redis-get(visit_count) 1); \$count \$redis-get(visit_count); echo h2Web访问统计页面/h2; echo 当前节点.gethostbyname(gethostname()).br; echo 访问次数\$count br; echo 当前Redis Master\$master_host:\$master_portbr; }else{ echo 哨兵获取master失败; } }catch(Exception \$e){ echo Redis异常.\$e-getMessage(); } ? EOFweb 节点创建/usr/share/nginx/html/redis_test.php?php $redis new Redis(); // 连接哨兵获取master地址企业真实写法这里简化直接连哨兵 $redis-connect(192.168.1.22,26379); $redis-auth(Redis123); $redis-set(web_visit_count, $redis-get(web_visit_count) 1); echo 页面访问计数.$redis-get(web_visit_count); echo br当前Redis主节点; var_dump($redis-rawCommand(sentinel,get-master-addr-by-name,mymaster)); ?访问http://VIP/redis_test.php每刷新一次计数 1master 挂掉后哨兵自动切换业务无感知。7、启动服务 校验# 检查nginx配置语法 nginx -t # 启动 systemctl start nginx php-fpm # 查看状态 systemctl status nginx php-fpm四、脚本1.基本环境一键部署脚本#!/bin/bash # 集群所有节点前置初始化脚本 RHEL9/CentOS Stream9 set -e echo 关闭firewalld systemctl stop firewalld systemctl disable firewalld echo 关闭SELinux setenforce 0 sed -i s/^SELINUXenforcing/SELINUXdisabled/ /etc/selinux/config sed -i s/^SELINUXpermissive/SELINUXdisabled/ /etc/selinux/config echo 安装并启动chrony时间同步 dnf install -y chrony systemctl start chronyd systemctl enable chronyd echo 结果校验 echo SELinux状态: $(getenforce) echo firewalld状态: $(systemctl is-active firewalld) echo chronyd状态: $(systemctl is-active chronyd) echo 初始化完成请手动ping网关和其他节点验证互通 lvs节点一键部署内核脚本#!/bin/bash set -e echo LB节点内核参数 ip_forward echo 1 /proc/sys/net/ipv4/ip_forward echo 0 /proc/sys/net/ipv4/conf/all/send_redirects echo 0 /proc/sys/net/ipv4/conf/default/send_redirects echo 0 /proc/sys/net/ipv4/conf/ens33/send_redirects cat /etc/sysctl.conf EOF net.ipv4.ip_forward 1 net.ipv4.conf.all.send_redirects 0 net.ipv4.conf.default.send_redirects 0 net.ipv4.conf.ens33.send_redirects 0 net.core.somaxconn 2048 net.ipv4.tcp_syncookies 1 net.ipv4.tcp_fin_timeout 30 net.ipv4.tcp_tw_reuse 1 EOF sysctl -p echo lb sysctl donechmod x lb_sysctl.sh ./lb_sysctl.shrs节点一键部署内核脚本#!/bin/bash set -e echo RS节点 ARP抑制LVS-DR核心 echo 1 /proc/sys/net/ipv4/conf/all/arp_ignore echo 1 /proc/sys/net/ipv4/conf/ens33/arp_ignore echo 2 /proc/sys/net/ipv4/conf/all/arp_announce echo 2 /proc/sys/net/ipv4/conf/ens33/arp_announce cat /etc/sysctl.conf EOF net.ipv4.conf.all.arp_ignore 1 net.ipv4.conf.ens33.arp_ignore 1 net.ipv4.conf.all.arp_announce 2 net.ipv4.conf.ens33.arp_announce 2 net.core.somaxconn 2048 net.ipv4.tcp_syncookies 1 net.ipv4.tcp_fin_timeout 30 net.ipv4.tcp_tw_reuse 1 EOF sysctl -p echo web rs sysctl done后端web节点rs本地回环网卡绑定 VIP一键部署脚本cat /etc/init.d/lvsrs EOF #!/bin/bash VIP192.168.1.100 case \$1 in start) ifconfig lo:0 \$VIP netmask 255.255.255.255 broadcast \$VIP up route add -host \$VIP dev lo:0 ;; stop) ifconfig lo:0 down route del -host \$VIP dev lo:0 ;; *) echo Usage: \$0 {start|stop} exit 1 esac EOFchmod x /etc/init.d/lvsrs # 启动 /etc/init.d/lvsrs start # 开机自启CentOS7可以加到rc.local echo /etc/init.d/lvsrs start /etc/rc.local chmod x /etc/rc.localredis通用优化一键部署脚本#!/bin/bash set -e cat /etc/sysctl.conf EOF net.core.somaxconn 2048 net.ipv4.tcp_syncookies 1 net.ipv4.tcp_fin_timeout 30 net.ipv4.tcp_tw_reuse 1 vm.overcommit_memory 1 EOF sysctl -p echo redis monitor sysctl doneRS 节点 lo:0 绑定 VIP 脚本cat /usr/local/bin/lvs_rs_vip.sh EOF #!/bin/bash VIP192.168.1.100 /sbin/ifconfig lo:0 \$VIP netmask 255.255.255.255 broadcast \$VIP up /sbin/route add -host \$VIP dev lo:0 EOF chmod x /usr/local/bin/lvs_rs_vip.sh # 执行绑定 /usr/local/bin/lvs_rs_vip.sh #原理在本地回环网卡绑定 VIP掩码 255.255.255.255只供本机接收数据包不对外 ARP 响应