Nginx+Keepalived高可用负载均衡架构实战

1. 高可用负载均衡架构设计原理在企业级Web服务架构中单点故障是必须解决的核心问题。Nginx作为高性能的反向代理服务器配合Keepalived实现的高可用方案能够确保服务持续可用。这套架构的核心在于通过VRRP协议实现虚拟IP的自动漂移当主节点发生故障时备份节点能在秒级完成接管。关键设计原则任何单台服务器的故障都不应影响整体服务可用性传统单Nginx架构存在明显的单点故障风险。我曾遇到过生产环境因为单个Nginx节点宕机导致整个电商平台不可用的事故。采用主备模式后即使硬件故障也能自动切换服务中断时间可以控制在3秒以内。2. 环境准备与组件安装2.1 服务器基础配置建议使用两台配置相同的CentOS 7服务器最小化安装后执行# 关闭防火墙和SELinux生产环境需按需调整 systemctl stop firewalld systemctl disable firewalld setenforce 0 sed -i s/SELINUXenforcing/SELINUXdisabled/g /etc/selinux/config # 安装EPEL仓库 yum install -y epel-release2.2 Nginx安装与优化采用官方源安装最新稳定版# 配置Nginx官方yum源 cat /etc/yum.repos.d/nginx.repo EOF [nginx-stable] namenginx stable repo baseurlhttp://nginx.org/packages/centos/\$releasever/\$basearch/ gpgcheck1 enabled1 gpgkeyhttps://nginx.org/keys/nginx_signing.key EOF # 安装并优化配置 yum install -y nginx mkdir -p /etc/nginx/conf.d/upstreams2.3 Keepalived安装配置通过yum安装Keepalivedyum install -y keepalived配置内核参数以支持VIP绑定echo net.ipv4.ip_nonlocal_bind 1 /etc/sysctl.conf sysctl -p3. 核心配置文件详解3.1 Nginx负载均衡配置在/etc/nginx/conf.d/loadbalance.conf中配置upstream backend { least_conn; # 使用最少连接算法 server 192.168.1.101:8080 weight5 max_fails3 fail_timeout30s; server 192.168.1.102:8080 weight3 max_fails3 fail_timeout30s; keepalive 32; # 保持长连接数量 } server { listen 80; server_name yourdomain.com; location / { proxy_pass http://backend; proxy_http_version 1.1; proxy_set_header Connection ; proxy_next_upstream error timeout invalid_header; } }3.2 Keepalived主节点配置/etc/keepalived/keepalived.conf主配置global_defs { router_id nginx_master # 唯一标识 } vrrp_script chk_nginx { script /etc/keepalived/check_nginx.sh interval 2 weight -5 # 检测失败时降低优先级 fall 2 # 连续2次失败才判定为故障 rise 1 # 1次成功即恢复 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS auth_pass yourpassword } virtual_ipaddress { 192.168.1.100/24 dev eth0 label eth0:1 } track_script { chk_nginx } }3.3 健康检测脚本/etc/keepalived/check_nginx.sh内容#!/bin/bash count$(ps -C nginx --no-heading | wc -l) if [ ${count} 0 ]; then systemctl restart nginx sleep 2 count$(ps -C nginx --no-heading | wc -l) if [ ${count} 0 ]; then systemctl stop keepalived fi fi exit 04. 高可用测试与故障演练4.1 正常状态验证# 查看VIP绑定情况 ip addr show eth0 # 检查进程状态 ps -ef | grep -E nginx|keepalived # 测试访问 curl -I http://192.168.1.1004.2 模拟主节点故障# 在主节点停止Nginx systemctl stop nginx # 观察日志变化 tail -f /var/log/messages # 在备节点检查VIP接管 ip addr show eth04.3 脑裂问题预防为防止网络分区导致的脑裂情况建议添加# 在keepalived.conf中添加 vrrp_strict # 严格遵守VRRP协议 track_interface { eth0 # 监控网卡状态 }5. 生产环境优化建议5.1 性能调优参数# 在nginx.conf的events块中添加 worker_connections 65535; multi_accept on; use epoll; # 在http块中添加 keepalive_timeout 65; keepalive_requests 10000; client_header_timeout 15; client_body_timeout 15; send_timeout 15;5.2 安全加固措施# 限制keepalived服务绑定用户 echo net.ipv4.conf.all.accept_redirects 0 /etc/sysctl.conf echo net.ipv4.conf.all.send_redirects 0 /etc/sysctl.conf # 配置Nginx访问控制 location /nginx_status { stub_status; allow 127.0.0.1; allow 192.168.1.0/24; deny all; }5.3 监控告警配置建议部署Prometheus监控# keepalived_exporter配置 scrape_configs: - job_name: keepalived static_configs: - targets: [192.168.1.101:9650,192.168.1.102:9650]6. 常见问题排查指南6.1 VIP无法绑定检查项网络接口名称是否正确ip addr查看是否开启ip_nonlocal_bind参数防火墙是否放行VRRP协议协议号1126.2 主备切换异常排查步骤# 查看VRRP报文交互 tcpdump -i eth0 vrrp -n # 检查优先级变化 grep -E VRRP_Instance|priority /var/log/messages6.3 Nginx检测误判优化检测脚本# 改用端口检测更可靠 if ! nc -z 127.0.0.1 80; then systemctl restart nginx || systemctl stop keepalived fi这套架构在实际电商项目中验证全年可用性达到99.99%。关键是要做好定期的主备切换演练完善的监控覆盖详细的故障预案配置变更的严格测试