主页
产品
OpenShift Container Platform Installation
4.13
在 VMC 上安装
2.17. 配置外部负载均衡器

2.17. 配置外部负载均衡器

您可以将 OpenShift Container Platform 集群配置为使用外部负载均衡器来代替默认负载均衡器。

重要

在配置外部负载均衡器前，请确定您阅读了外部负载均衡器的"服务"部分。

阅读适用于您要为外部负载均衡器配置的服务的以下先决条件。

注意

MetalLB，在集群中运行，充当外部负载均衡器。

OpenShift API 的先决条件

您定义了前端 IP 地址。
TCP 端口 6443 和 22623 在负载均衡器的前端 IP 地址上公开。检查以下项：
- 端口 6443 提供对 OpenShift API 服务的访问。
- 端口 22623 可以为节点提供 ignition 启动配置。
前端 IP 地址和端口 6443 可以被您的系统的所有用户访问，其位置为 OpenShift Container Platform 集群外部。
前端 IP 地址和端口 22623 只能被 OpenShift Container Platform 节点访问。
负载均衡器后端可以在端口 6443 和 22623 上与 OpenShift Container Platform control plane 节点通信。

Ingress Controller 的先决条件

您定义了前端 IP 地址。
TCP 端口 443 和 80 在负载均衡器的前端 IP 地址上公开。
前端 IP 地址、端口 80 和端口 443 可以被您的系统所有用户访问，以及 OpenShift Container Platform 集群外部的位置。
前端 IP 地址、端口 80 和端口 443 可被 OpenShift Container Platform 集群中运行的所有节点访问。
负载均衡器后端可以在端口 80、443 和 1936 上与运行 Ingress Controller 的 OpenShift Container Platform 节点通信。

健康检查 URL 规格的先决条件

您可以通过设置健康检查 URL 来配置大多数负载均衡器，以确定服务是否可用或不可用。OpenShift Container Platform 为 OpenShift API、Machine Configuration API 和 Ingress Controller 后端服务提供这些健康检查。

以下示例演示了以前列出的后端服务的健康检查规格：

Kubernetes API 健康检查规格示例

Path: HTTPS:6443/readyz
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 10
Interval: 10

Path: HTTPS:6443/readyz
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 10
Interval: 10

Copy to Clipboard

Toggle word wrap

Machine Config API 健康检查规格示例

Path: HTTPS:22623/healthz
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 10
Interval: 10

Path: HTTPS:22623/healthz
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 10
Interval: 10

Copy to Clipboard

Toggle word wrap

Ingress Controller 健康检查规格示例

Path: HTTP:1936/healthz/ready
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 5
Interval: 10

Path: HTTP:1936/healthz/ready
Healthy threshold: 2
Unhealthy threshold: 2
Timeout: 5
Interval: 10

Copy to Clipboard

Toggle word wrap

流程

配置 HAProxy Ingress Controller，以便您可以在端口 6443、443 和 80 上从负载均衡器访问集群：

HAProxy 配置示例

...

#...
listen my-cluster-api-6443
    bind 192.168.1.100:6443
    mode tcp
    balance roundrobin
  option httpchk
  http-check connect
  http-check send meth GET uri /readyz
  http-check expect status 200
    server my-cluster-master-2 192.168.1.101:6443 check inter 10s rise 2 fall 2
    server my-cluster-master-0 192.168.1.102:6443 check inter 10s rise 2 fall 2
    server my-cluster-master-1 192.168.1.103:6443 check inter 10s rise 2 fall 2

listen my-cluster-machine-config-api-22623
    bind 192.168.1.100:22623
    mode tcp
    balance roundrobin
  option httpchk
  http-check connect
  http-check send meth GET uri /healthz
  http-check expect status 200
    server my-cluster-master-2 192.168.1.101:22623 check inter 10s rise 2 fall 2
    server my-cluster-master-0 192.168.1.102:22623 check inter 10s rise 2 fall 2
    server my-cluster-master-1 192.168.1.103:22623 check inter 10s rise 2 fall 2

listen my-cluster-apps-443
        bind 192.168.1.100:443
        mode tcp
        balance roundrobin
    option httpchk
    http-check connect
    http-check send meth GET uri /healthz/ready
    http-check expect status 200
        server my-cluster-worker-0 192.168.1.111:443 check port 1936 inter 10s rise 2 fall 2
        server my-cluster-worker-1 192.168.1.112:443 check port 1936 inter 10s rise 2 fall 2
        server my-cluster-worker-2 192.168.1.113:443 check port 1936 inter 10s rise 2 fall 2

listen my-cluster-apps-80
        bind 192.168.1.100:80
        mode tcp
        balance roundrobin
    option httpchk
    http-check connect
    http-check send meth GET uri /healthz/ready
    http-check expect status 200
        server my-cluster-worker-0 192.168.1.111:80 check port 1936 inter 10s rise 2 fall 2
        server my-cluster-worker-1 192.168.1.112:80 check port 1936 inter 10s rise 2 fall 2
        server my-cluster-worker-2 192.168.1.113:80 check port 1936 inter 10s rise 2 fall 2
# ...

Copy to Clipboard

Toggle word wrap

使用 curl CLI 命令验证外部负载均衡器及其资源是否正常运行：

运行以下命令并查看响应，验证集群机器配置 API 是否可以被 Kubernetes API 服务器资源访问：

curl https://<loadbalancer_ip_address>:6443/version --insecure

$ curl https://<loadbalancer_ip_address>:6443/version --insecure

Copy to Clipboard

Toggle word wrap

如果配置正确，您会收到 JSON 对象的响应：

{
  "major": "1",
  "minor": "11+",
  "gitVersion": "v1.11.0+ad103ed",
  "gitCommit": "ad103ed",
  "gitTreeState": "clean",
  "buildDate": "2019-01-09T06:44:10Z",
  "goVersion": "go1.10.3",
  "compiler": "gc",
  "platform": "linux/amd64"
}

{
  "major": "1",
  "minor": "11+",
  "gitVersion": "v1.11.0+ad103ed",
  "gitCommit": "ad103ed",
  "gitTreeState": "clean",
  "buildDate": "2019-01-09T06:44:10Z",
  "goVersion": "go1.10.3",
  "compiler": "gc",
  "platform": "linux/amd64"
}

Copy to Clipboard

Toggle word wrap

运行以下命令并观察输出，验证集群机器配置 API 是否可以被 Machine 配置服务器资源访问：
```
curl -v https://<loadbalancer_ip_address>:22623/healthz --insecure
```
```
$ curl -v https://<loadbalancer_ip_address>:22623/healthz --insecure
```
Copy to Clipboard Toggle word wrap
如果配置正确，命令的输出会显示以下响应：
```
HTTP/1.1 200 OK
Content-Length: 0
```
```
HTTP/1.1 200 OK
Content-Length: 0
```
Copy to Clipboard Toggle word wrap

运行以下命令并观察输出，验证控制器是否可以被端口 80 上的 Ingress Controller 资源访问：

curl -I -L -H "Host: console-openshift-console.apps.<cluster_name>.<base_domain>" http://<load_balancer_front_end_IP_address>

$ curl -I -L -H "Host: console-openshift-console.apps.<cluster_name>.<base_domain>" http://<load_balancer_front_end_IP_address>

Copy to Clipboard

Toggle word wrap

如果配置正确，命令的输出会显示以下响应：

HTTP/1.1 302 Found
content-length: 0
location: https://console-openshift-console.apps.ocp4.private.opequon.net/
cache-control: no-cache

HTTP/1.1 302 Found
content-length: 0
location: https://console-openshift-console.apps.ocp4.private.opequon.net/
cache-control: no-cache

Copy to Clipboard

Toggle word wrap

运行以下命令并观察输出，验证控制器是否可以被端口 443 上的 Ingress Controller 资源访问：

curl -I -L --insecure --resolve console-openshift-console.apps.<cluster_name>.<base_domain>:443:<Load Balancer Front End IP Address> https://console-openshift-console.apps.<cluster_name>.<base_domain>

$ curl -I -L --insecure --resolve console-openshift-console.apps.<cluster_name>.<base_domain>:443:<Load Balancer Front End IP Address> https://console-openshift-console.apps.<cluster_name>.<base_domain>

Copy to Clipboard

Toggle word wrap

如果配置正确，命令的输出会显示以下响应：

HTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=UlYWOyQ62LWjw2h003xtYSKlh1a0Py2hhctw0WmV2YEdhJjFyQwWcGBsja261dGLgaYO0nxzVErhiXt6QepA7g==; Path=/; Secure; SameSite=Lax
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Wed, 04 Oct 2023 16:29:38 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=1bf5e9573c9a2760c964ed1659cc1673; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

HTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=UlYWOyQ62LWjw2h003xtYSKlh1a0Py2hhctw0WmV2YEdhJjFyQwWcGBsja261dGLgaYO0nxzVErhiXt6QepA7g==; Path=/; Secure; SameSite=Lax
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Wed, 04 Oct 2023 16:29:38 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=1bf5e9573c9a2760c964ed1659cc1673; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

Copy to Clipboard

Toggle word wrap

为您的集群配置 DNS 记录，以外部负载均衡器的前端 IP 地址为目标。您必须在负载均衡器上将记录更新为集群 API 和应用程序的 DNS 服务器。
修改 DNS 记录示例
```
<load_balancer_ip_address>  A  api.<cluster_name>.<base_domain>
A record pointing to Load Balancer Front End
```
```
<load_balancer_ip_address>  A  api.<cluster_name>.<base_domain>
A record pointing to Load Balancer Front End
```
Copy to Clipboard Toggle word wrap
```
<load_balancer_ip_address>   A apps.<cluster_name>.<base_domain>
A record pointing to Load Balancer Front End
```
```
<load_balancer_ip_address>   A apps.<cluster_name>.<base_domain>
A record pointing to Load Balancer Front End
```
Copy to Clipboard Toggle word wrap
重要
DNS 传播可能需要一些时间才能获得每个 DNS 记录。在验证每个记录前，请确保每个 DNS 记录传播。

使用 curl CLI 命令验证外部负载均衡器和 DNS 记录配置是否正常运行：

运行以下命令并查看输出，验证您可以访问集群 API：

curl https://api.<cluster_name>.<base_domain>:6443/version --insecure

$ curl https://api.<cluster_name>.<base_domain>:6443/version --insecure

Copy to Clipboard

Toggle word wrap

如果配置正确，您会收到 JSON 对象的响应：

{
  "major": "1",
  "minor": "11+",
  "gitVersion": "v1.11.0+ad103ed",
  "gitCommit": "ad103ed",
  "gitTreeState": "clean",
  "buildDate": "2019-01-09T06:44:10Z",
  "goVersion": "go1.10.3",
  "compiler": "gc",
  "platform": "linux/amd64"
  }

{
  "major": "1",
  "minor": "11+",
  "gitVersion": "v1.11.0+ad103ed",
  "gitCommit": "ad103ed",
  "gitTreeState": "clean",
  "buildDate": "2019-01-09T06:44:10Z",
  "goVersion": "go1.10.3",
  "compiler": "gc",
  "platform": "linux/amd64"
  }

Copy to Clipboard

Toggle word wrap

运行以下命令并查看输出，验证您可以访问集群机器配置：
```
curl -v https://api.<cluster_name>.<base_domain>:22623/healthz --insecure
```
```
$ curl -v https://api.<cluster_name>.<base_domain>:22623/healthz --insecure
```
Copy to Clipboard Toggle word wrap
如果配置正确，命令的输出会显示以下响应：
```
HTTP/1.1 200 OK
Content-Length: 0
```
```
HTTP/1.1 200 OK
Content-Length: 0
```
Copy to Clipboard Toggle word wrap

运行以下命令并查看输出，验证您可以在端口上访问每个集群应用程序：

curl http://console-openshift-console.apps.<cluster_name>.<base_domain> -I -L --insecure

$ curl http://console-openshift-console.apps.<cluster_name>.<base_domain> -I -L --insecure

Copy to Clipboard

Toggle word wrap

如果配置正确，命令的输出会显示以下响应：

HTTP/1.1 302 Found
content-length: 0
location: https://console-openshift-console.apps.<cluster-name>.<base domain>/
cache-control: no-cacheHTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=39HoZgztDnzjJkq/JuLJMeoKNXlfiVv2YgZc09c3TBOBU4NI6kDXaJH1LdicNhN1UsQWzon4Dor9GWGfopaTEQ==; Path=/; Secure
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Tue, 17 Nov 2020 08:42:10 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=9b714eb87e93cf34853e87a92d6894be; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

HTTP/1.1 302 Found
content-length: 0
location: https://console-openshift-console.apps.<cluster-name>.<base domain>/
cache-control: no-cacheHTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=39HoZgztDnzjJkq/JuLJMeoKNXlfiVv2YgZc09c3TBOBU4NI6kDXaJH1LdicNhN1UsQWzon4Dor9GWGfopaTEQ==; Path=/; Secure
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Tue, 17 Nov 2020 08:42:10 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=9b714eb87e93cf34853e87a92d6894be; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

Copy to Clipboard

Toggle word wrap

运行以下命令并查看输出，验证您可以在端口 443 上访问每个集群应用程序：

curl https://console-openshift-console.apps.<cluster_name>.<base_domain> -I -L --insecure

$ curl https://console-openshift-console.apps.<cluster_name>.<base_domain> -I -L --insecure

Copy to Clipboard

Toggle word wrap

如果配置正确，命令的输出会显示以下响应：

HTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=UlYWOyQ62LWjw2h003xtYSKlh1a0Py2hhctw0WmV2YEdhJjFyQwWcGBsja261dGLgaYO0nxzVErhiXt6QepA7g==; Path=/; Secure; SameSite=Lax
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Wed, 04 Oct 2023 16:29:38 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=1bf5e9573c9a2760c964ed1659cc1673; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

HTTP/1.1 200 OK
referrer-policy: strict-origin-when-cross-origin
set-cookie: csrf-token=UlYWOyQ62LWjw2h003xtYSKlh1a0Py2hhctw0WmV2YEdhJjFyQwWcGBsja261dGLgaYO0nxzVErhiXt6QepA7g==; Path=/; Secure; SameSite=Lax
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-frame-options: DENY
x-xss-protection: 1; mode=block
date: Wed, 04 Oct 2023 16:29:38 GMT
content-type: text/html; charset=utf-8
set-cookie: 1e2670d92730b515ce3a1bb65da45062=1bf5e9573c9a2760c964ed1659cc1673; path=/; HttpOnly; Secure; SameSite=None
cache-control: private

Copy to Clipboard

Toggle word wrap

返回顶部

2.17. 配置外部负载均衡器

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links