わたしの部屋

1
curl -s https://install.zerotier.com | sudo bash
2
sudo zerotier-cli join <network_id>
3
# 在 ZeroTier Central 管理后台授权节点，并确保它们获得预期的 IP（如 10.0.0.10、10.0.0.30、10.0.0.40）
4
sudo zerotier-cli listnetworks   # 查看接口名称，通常为 zt<网络ID前10位>

1
sudo apt update
2
sudo apt install -y haproxy keepalived
3

4
# 允许绑定非本机 IP（HAProxy 需要监听 VIP）
5
echo "net.ipv4.ip_nonlocal_bind=1" | sudo tee -a /etc/sysctl.conf
6
sudo sysctl -p
7

8
# 停止并禁用这两个服务，后续由 keepalived 控制 HAProxy 启停
9
sudo systemctl stop haproxy keepalived
10
sudo systemctl disable haproxy keepalived

1
#!/bin/bash
2
# 检查 haproxy 进程是否存活
3
if systemctl is-active --quiet haproxy; then
4
  exit 0
5
else
6
  exit 1
7
fi

1
#!/bin/bash
2
VIP="10.0.0.100"
3
DEV="ztpp6n6xmz"   # 使用 ZeroTier 接口名
4

5
case "$1" in
6
    master)
7
        sleep 1
8
        ip addr show $DEV | grep -q $VIP || exit 1
9
        systemctl start haproxy
10
        logger "keepalived: transition to MASTER, haproxy started"
11
        ;;
12
    backup)
13
        systemctl stop haproxy
14
        logger "keepalived: transition to BACKUP, haproxy stopped"
15
        ;;
16
    fault)
17
        systemctl stop haproxy
18
        logger "keepalived: transition to FAULT, haproxy stopped"
19
        ;;
20
    *)
21
        echo "Usage: $0 {master|backup|fault}"
22
        exit 1
23
        ;;
24
esac

1
# 定义健康检查脚本，供 track_script 引用
2
vrrp_script chk_haproxy {
3
    script "/etc/keepalived/chk_haproxy.sh"   # 检查 haproxy 是否存活
4
    interval 2                                # 每 2 秒执行一次
5
    weight -20                                # 失败时优先级减 20，让其他节点更容易抢占
6
    fall 3                                    # 连续失败 3 次才认为故障
7
    rise 2                                    # 连续成功 2 次才恢复健康
8
}
9

10
vrrp_instance VI_CLUSTER {
11
    state BACKUP                   # 所有节点都设为 BACKUP，依靠优先级竞选 Master
12
    interface ztpp6n6xmz          # ZeroTier 虚拟网卡接口
13
    virtual_router_id 51           # 同一 VRRP 组必须相同
14
    priority 100                   # 最高优先级，默认成为 Master
15
    advert_int 1                   # 通告间隔（秒）
16
    authentication {
17
        auth_type PASS
18
        auth_pass your_password    # 所有节点必须一致
19
    }
20
    virtual_ipaddress {
21
        10.0.0.100/32 dev ztpp6n6xmz  # 虚拟 IP，仅 Master 持有
22
    }
23
    track_interface {
24
        ztpp6n6xmz                 # 监控 ZeroTier 接口，若 down 立即降级
25
    }
26
    track_script {
27
        chk_haproxy                # 引用上方健康检查脚本
28
    }
29
    notify "/etc/keepalived/notify.sh"  # 状态变化时调用通知脚本
30
}

1
sudo systemctl start keepalived

1
ip addr show ztpp6n6xmz | grep 10.0.0.100

1
sudo mkdir -p /etc/rancher/k3s
2
cat <<EOF | sudo tee /etc/rancher/k3s/config.yaml
3
tls-san:
4
  - 10.0.0.100
5
EOF
6

7
# 删除动态证书缓存并逐台重启 K3s（注意保持 etcd quorum）
8
sudo rm -f /var/lib/rancher/k3s/server/tls/dynamic-cert.json
9
sudo systemctl restart k3s

1
# 写库测试（应返回 f）
2
psql -h 10.0.0.100 -p 5432 -U postgres -c "select pg_is_in_recovery();"
3

4
# 读库测试（应返回 t）
5
psql -h 10.0.0.100 -p 5433 -U postgres -c "select pg_is_in_recovery();"

1
pg_is_in_recovery
2
-------------------
3
 f
4
(1 row)
5

6
pg_is_in_recovery
7
-------------------
8
 t
9
(1 row)

1
kubectl get nodes --server https://10.0.0.100:6443