负载均衡器中的脚本自动化功能：从原理到实战的全面指南

# 注册EC2实例到Target Group
aws elbv2 register-targets \
  --target-group-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-app/73e2d6bc24d8a067 \
  --targets Id=i-0123456789abcdef0,Port=80

# 创建新版本池（v2-pool）
curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/pool \
-H "Content-Type: application/json" \
-d '{
    "name": "v2-pool",
    "members": [{"name": "10.0.0.20:80", "address": "10.0.0.20", "port": 80}]
}'
 
# 创建流量分配策略（10%到v2-pool，90%到v1-pool）
curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/traffic-policy \
-H "Content-Type: application/json" \
-d '{
    "name": "canary-policy",
    "rules": [
        {
            "name": "canary-rule",
            "conditions": [{"type": "http-uri", "path": "/api/*"}],
            "actions": [{"type": "pool", "pool": "v2-pool", "ratio": 10}]
        }
    ]
}'

# 安装Certbot
sudo apt install certbot python3-certbot-nginx
 
# 申请证书（首次）
sudo certbot --nginx -d example.com -d www.example.com
 
# 添加自动续期任务（crontab）
echo "0 3 * * * certbot renew --post-hook 'curl -X POST http://nginx-mgmt-ip:8080/api/3/http/upstreams/backend/reload'" | sudo tee -a /etc/crontab

# 从Prometheus获取错误率高的后端服务器IP
ERROR_SERVERS=$(curl -s http://prometheus-ip:9090/api/v1/query\?query\=haproxy_backend_server_errors_rate{backend="web"}>0.05 | jq -r '.data.result[] | .metric.server')
 
# 通过HAProxy的socket移除节点
for server in $ERROR_SERVERS; do
  echo "set server backend/$server state maintenance" | socat stdio /var/run/haproxy.sock
done

# 添加10.0.0.10:80到test-pool
curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/pool/test-pool/members \
-H "Content-Type: application/json" \
-d '{
    "name": "10.0.0.10:80",
    "address": "10.0.0.10",
    "port": 80,
    "connectionLimit": 1000  # 连接数限制（可选）
}'

http {
    lua_shared_dict blacklist 1m;  # 共享内存存储黑名单
 
    server {
        listen 80;
        server_name example.com;
 
        access_by_lua_block {
            local blacklist = ngx.shared.blacklist
            local client_ip = ngx.var.remote_addr
 
            # 从共享内存获取黑名单（可通过API动态更新）
            local blocked = blacklist:get(client_ip)
            if blocked then
                ngx.log(ngx.ERR, "Blocked IP: ", client_ip)
                ngx.exit(ngx.HTTP_FORBIDDEN)  # 返回403
            end
        }
 
        location / {
            proxy_pass http://backend;
        }
    }
}

# 定义VPC（依赖现有资源）
data "aws_vpc" "main" {
  id = "vpc-0123456789abcdef0"
}
 
# 定义安全组（允许80端口入站）
resource "aws_security_group" "lb_sg" {
  name        = "alb-security-group"
  vpc_id      = data.aws_vpc.main.id
 
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
 
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
 
# 定义ALB
resource "aws_lb" "example" {
  name               = "example-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.lb_sg.id]
  subnets            = ["subnet-01234567", "subnet-89abcdef"]  # 公网子网
}
 
# 定义Target Group（HTTP 80端口）
resource "aws_lb_target_group" "example" {
  name     = "example-targets"
  port     = 80
  protocol = "HTTP"
  vpc_id   = data.aws_vpc.main.id
 
  # 健康检查配置
  health_check {
    path                = "/health"
    interval            = 30
    timeout             = 5
    healthy_threshold   = 2
    unhealthy_threshold = 2
  }
}
 
# 定义监听规则（80端口转发到Target Group）
resource "aws_lb_listener" "example" {
  load_balancer_arn = aws_lb.example.arn
  port              = 80
  protocol          = "HTTP"
 
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.example.arn
  }
}

# 连接HAProxy的Stats Socket（默认路径：/var/run/haproxy.sock）
socat stdio /var/run/haproxy.sock
 
# 查看backend的服务器状态
show servers state backend
 
# 将server1设为维护模式
set server backend/server1 state maintenance
 
# 将server1恢复为正常状态
set server backend/server1 state ready

# 错误示例：多次执行会重复添加10.0.0.10:80到test-pool
curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/pool/test-pool/members \
-H "Content-Type: application/json" \
-d '{"name": "10.0.0.10:80", "address": "10.0.0.10", "port": 80}'

# 先查询是否存在
EXISTS=$(curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/pool/test-pool/members/10.0.0.10:80 | jq '.code')
 
if [ "$EXISTS" != "200" ]; then
    # 不存在则添加
    curl -k -u admin:password https://f5-mgmt-ip/mgmt/tm/ltm/pool/test-pool/members \
    -H "Content-Type: application/json" \
    -d '{"name": "10.0.0.10:80", "address": "10.0.0.10", "port": 80}'
fi

import requests
from requests.auth import HTTPBasicAuth
import json
 
F5_MGMT_IP = "10.0.1.10"
POOL_NAME = "test-pool"
MEMBER = "10.0.0.10:80"
BACKUP_FILE = "pool_backup.json"
 
# 备份当前池配置
def backup_pool():
    url = f"https://{F5_MGMT_IP}/mgmt/tm/ltm/pool/{POOL_NAME}"
    response = requests.get(url, auth=HTTPBasicAuth("admin", "password"), verify=False)
    response.raise_for_status()
    with open(BACKUP_FILE, "w") as f:
        json.dump(response.json(), f)
    print(f"Backup saved to {BACKUP_FILE}")
 
# 恢复池配置
def restore_pool():
    with open(BACKUP_FILE, "r") as f:
        payload = json.load(f)
    url = f"https://{F5_MGMT_IP}/mgmt/tm/ltm/pool/{POOL_NAME}"
    response = requests.put(url, json=payload, auth=HTTPBasicAuth("admin", "password"), verify=False)
    response.raise_for_status()
    print("Pool restored from backup")
 
# 删除池成员
def delete_member():
    url = f"https://{F5_MGMT_IP}/mgmt/tm/ltm/pool/{POOL_NAME}/members/{MEMBER}"
    response = requests.delete(url, auth=HTTPBasicAuth("admin", "password"), verify=False)
    response.raise_for_status()
    print(f"Deleted member {MEMBER}")
 
if __name__ == "__main__":
    try:
        backup_pool()
        delete_member()
    except Exception as e:
        print(f"Error: {str(e)}")
        restore_pool()
        raise e

import boto3
import requests
from requests.auth import HTTPBasicAuth
import json
from botocore.exceptions import ClientError
 
# 配置参数
F5_MGMT_IP = "10.0.1.10"
F5_POOL_NAME = "web-pool"
F5_PORT = 80
SECRET_NAME = "f5-credentials"  # 存储在AWS Secrets Manager中的F5用户名/密码
 
# 获取F5凭证（从Secrets Manager）
def get_f5_credentials():
    session = boto3.session.Session()
    client = session.client(service_name="secretsmanager", region_name="us-east-1")
    try:
        response = client.get_secret_value(SecretId=SECRET_NAME)
    except ClientError as e:
        raise e
    secret = json.loads(response["SecretString"])
    return secret["username"], secret["password"]
 
# 获取EC2实例的私有IP
def get_ec2_private_ip(instance_id):
    ec2 = boto3.client("ec2", region_name="us-east-1")
    response = ec2.describe_instances(InstanceIds=[instance_id])
    return response["Reservations"][0]["Instances"][0]["PrivateIpAddress"]
 
# 检查F5池成员是否存在
def is_member_exist(f5_username, f5_password, private_ip):
    url = f"https://{F5_MGMT_IP}/mgmt/tm/ltm/pool/{F5_POOL_NAME}/members/{private_ip}:{F5_PORT}"
    response = requests.get(
        url, auth=HTTPBasicAuth(f5_username, f5_password), verify=False
    )
    return response.status_code == 200
 
# 添加F5池成员
def add_f5_member(f5_username, f5_password, private_ip):
    url = f"https://{F5_MGMT_IP}/mgmt/tm/ltm/pool/{F5_POOL_NAME}/members"
    payload = {
        "name": f"{private_ip}:{F5_PORT}",
        "address": private_ip,
        "port": F5_PORT,
        "connectionLimit": 1000
    }
    response = requests.post(
        url, json=payload, auth=HTTPBasicAuth(f5_username, f5_password), verify=False
    )
    response.raise_for_status()
 
# Lambda入口函数
def lambda_handler(event, context):
    # 获取事件中的EC2实例ID
    instance_id = event["detail"]["instance-id"]
    print(f"Processing instance: {instance_id}")
 
    # 获取F5凭证
    f5_username, f5_password = get_f5_credentials()
 
    # 获取EC2私有IP
    private_ip = get_ec2_private_ip(instance_id)
    print(f"Instance private IP: {private_ip}")
 
    # 检查成员是否已存在
    if is_member_exist(f5_username, f5_password, private_ip):
        print(f"Member {private_ip}:{F5_PORT} already exists in pool {F5_POOL_NAME}")
        return
 
    # 添加成员到F5池
    try:
        add_f5_member(f5_username, f5_password, private_ip)
        print(f"Successfully added member {private_ip}:{F5_PORT} to pool {F5_POOL_NAME}")
    except Exception as e:
        print(f"Failed to add member: {str(e)}")
        raise e
 
    return {"statusCode": 200, "body": "Success"}