Nginx版本平滑升级

约定不等于承诺〃 2023-07-17 02:59 12阅读 0赞

### Nginx版本平滑升级 ###

*  nginx的平滑升级重要性
 *   *  安全漏洞报告
     *  nginx升级原理简介
 *  nginx平滑升级详细过程
 *   *  1、环境准备
     *  2、 开始升级

# nginx的平滑升级重要性 #

> 由于nginx的优越性能及强大功能，被业界大量使用，Nginx版本升级必然是越来越快的，以优化自身性能或修复安全漏洞。同时线上业务又不能停，此时nginx的平滑升级就显得尤为重要。

## 安全漏洞报告 ##

> [https://nginx.org/en/security\_advisories.html][https_nginx.org_en_security_advisories.html]

## nginx升级原理简介 ##

> **多进程模式下的请求分配方式**  
> Nginx默认工作在多进程模式下，即主进程（master process）启动后完成配置加载和端口绑定等动作，fork出指定数量的工作进程（worker process），这些子进程会持有监听端口的文件描述符（fd），并通过在该描述符上添加监听事件来接受连接（accept）。

> **信号的接收和处理**  
> Nginx主进程在启动完成后会进入等待状态，负责响应各类系统消息，如SIGCHLD、SIGHUP、SIGUSR2等。

> **Nginx信号简介**

主进程支持的信号

*  TERM, INT: 立刻退出
 *  QUIT: 等待工作进程结束后再退出
 *  KILL: 强制终止进程
 *  HUP: 重新加载配置文件，使用新的配置启动工作进程，并逐步 关闭旧进程。
 *  USR1: 重新打开日志文件
 *  USR2: 启动新的主进程，实现热升级
 *  WINCH: 逐步关闭工作进程

工作进程支持的信号

*  TERM, INT: 立刻退出
 *  QUIT: 等待请求处理结束后再退出
 *  USR1: 重新打开日志文件

# nginx平滑升级详细过程 #

## 1、环境准备 ##

*  查看当前版本及编译参数

[root@izwz96u1ukkfo2ki7ywqbiz local]# nginx -V
    nginx version: nginx/1.14.0
    built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
    built with OpenSSL 1.0.2k-fips  26 Jan 2017
    TLS SNI support enabled
    configure arguments: --with-http_ssl_module --with-http_stub_status_module

*  上传新版本nginx-1.17.9

D:\soft>scp nginx-1.17.9.tar.gz root@120.79.xxx.xxx:/opt/soft
    root@120.79.xxx.xxx's password:
    nginx-1.17.9.tar.gz                                                                   100% 1015KB   3.4MB/s   00:00
    
    D:\soft>

*  解压、编译新版本Nginx源码，安装路径必须与旧版本一致，**且不能执行make install**

[root@izwz96u1ukkfo2ki7ywqbiz soft]# ll
    total 1020
    drwxr-xr-x 9 1001 erposm    4096 Oct 12  2018 nginx-1.14.0
    -rw-r--r-- 1 root root   1039136 Mar 19 11:19 nginx-1.17.9.tar.gz
    [root@izwz96u1ukkfo2ki7ywqbiz soft]# tar -zxf nginx-1.17.9.tar.gz 
    [root@izwz96u1ukkfo2ki7ywqbiz soft]# ll
    total 1024
    drwxr-xr-x 9 1001 erposm    4096 Oct 12  2018 nginx-1.14.0
    drwxr-xr-x 8 1001 erposm    4096 Mar  3 23:04 nginx-1.17.9
    -rw-r--r-- 1 root root   1039136 Mar 19 11:19 nginx-1.17.9.tar.gz

*  **配置源码，务必保持与老版本参数一致**

[root@izwz96u1ukkfo2ki7ywqbiz soft]# cd nginx-1.17.9
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# ./configure --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module
    checking for OS
     + Linux 3.10.0-693.2.2.el7.x86_64 x86_64
    ······
    creating objs/Makefile
    
    Configuration summary
      + using system PCRE library
      + using system OpenSSL library
      + using system zlib library
    
      nginx path prefix: "/usr/local/nginx"
      nginx binary file: "/usr/local/nginx/sbin/nginx"
      nginx modules path: "/usr/local/nginx/modules"
      nginx configuration prefix: "/usr/local/nginx/conf"
      nginx configuration file: "/usr/local/nginx/conf/nginx.conf"
      nginx pid file: "/usr/local/nginx/logs/nginx.pid"
      nginx error log file: "/usr/local/nginx/logs/error.log"
      nginx http access log file: "/usr/local/nginx/logs/access.log"
      nginx http client request body temporary files: "client_body_temp"
      nginx http proxy temporary files: "proxy_temp"
      nginx http fastcgi temporary files: "fastcgi_temp"
      nginx http uwsgi temporary files: "uwsgi_temp"
      nginx http scgi temporary files: "scgi_temp"
    
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

*  编译：make

[root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# make
    make -f objs/Makefile
    make[1]: Entering directory `/opt/soft/nginx-1.17.9' cc -c -pipe -O -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror -g -I src/core -I src/event -I src/event/modules -I src/os/unix -I objs \ -o objs/src/core/nginx.o \ src/core/nginx.c ······ -Wl,-E sed -e "s|%%PREFIX%%|/usr/local/nginx|" \ -e "s|%%PID_PATH%%|/usr/local/nginx/logs/nginx.pid|" \ -e "s|%%CONF_PATH%%|/usr/local/nginx/conf/nginx.conf|" \ -e "s|%%ERROR_LOG_PATH%%|/usr/local/nginx/logs/error.log|" \ < man/nginx.8 > objs/nginx.8 make[1]: Leaving directory `/opt/soft/nginx-1.17.9'
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

*  备份二进制文件，用新版本代替

[root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]mv /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx.old
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# ls 
    auto  CHANGES  CHANGES.ru  conf  configure  contrib  html  LICENSE  Makefile  man  objs  README  src
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# ls objs/
    autoconf.err  Makefile  nginx  nginx.8  ngx_auto_config.h  ngx_auto_headers.h  ngx_modules.c  ngx_modules.o  src
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# cp objs/nginx /usr/local/nginx/sbin/
    cp: overwrite ‘/usr/local/nginx/sbin/nginx’? y
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# ll /usr/local/nginx/sbin/
    total 11460
    -rwxr-xr-x 1 root root 5949736 Mar 19 12:24 nginx
    -rwxr-xr-x 1 root root 5783064 Jun 22  2018 nginx.old
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

*  检验新版本是否可用

[root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# nginx -t
    nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
    nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

## 2、 开始升级 ##

[root@localhost sbin]# ps -ef|grep nginx
    root     24772     1  0 1月10 ?       00:00:00 nginx: master process ./nginx
    nobody   24925 24772  0 1月10 ?       00:20:43 nginx: worker process
    root     28168 24991  0 21:46 pts/0    00:00:00 grep --color=auto nginx
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

*  向主进程(master)发送USR2信号。Nginx会启动一个新版本的master进程和对应的工作进程和旧版本一起处理请求  
    重新启动了worker进程

[root@localhost sbin]# kill -USR2 24772
    [root@localhost sbin]# ps -ef|grep nginx
    root     24772     1  0 1月10 ?       00:00:00 nginx: master process ./nginx
    nobody   24925 24772  0 1月10 ?       00:20:43 nginx: worker process
    root     28222 24772  0 21:47 ?        00:00:00 nginx: master process ./nginx
    nobody   28224 28222  0 21:47 ?        00:00:00 nginx: worker process
    root     28227 24991  0 21:47 pts/0    00:00:00 grep --color=auto nginx
    [root@localhost sbin]#

*  查看升级后的版本

[root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]# nginx -V
    nginx version: nginx/1.17.9
    built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) 
    built with OpenSSL 1.0.2k-fips  26 Jan 2017
    TLS SNI support enabled
    configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module --with-http_stub_status_module
    [root@izwz96u1ukkfo2ki7ywqbiz nginx-1.17.9]#

通过发送WINCH信号（平缓停止worker process）和QUIT信号（平缓停止Nginx服务）停止旧的Nginx服务进程

kill -WINCH `cat /usr/local/nginx/logs/nginx.pid.oldbin`  
kill -QUIT `cat /usr/local/nginx/logs/nginx.pid.oldbin`

[https_nginx.org_en_security_advisories.html]: https://nginx.org/en/security_advisories.html