Nginx LB主要是用来给 Ingress Controller 负载流量以及为多个Master节点ApiServer负载流量。当前集群为单节点，可以不用配置ApiServer的负载均衡器，但为了方便后续扩展，这里也配置下负载均衡。

[root@maxiaoke deploy-kubernetes]# gosh cmd -H 10.4.7.80 "yum install -y nginx nginx-mod-stream"
[root@maxiaoke deploy-kubernetes]# gosh cmd -H 10.4.7.80 "mkdir /etc/nginx/conf.d/stream -p"
[root@maxiaoke deploy-kubernetes]# gosh push -H 10.4.7.80 conf/nginx/nginx.conf /etc/nginx/
[root@maxiaoke deploy-kubernetes]# gosh push -H 10.4.7.80 conf/nginx/apiserver.conf /etc/nginx/conf.d/stream/
[root@maxiaoke deploy-kubernetes]# gosh cmd -H 10.4.7.80 "nginx -t"
10.4.7.80
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@maxiaoke deploy-kubernetes]# gosh cmd -H 10.4.7.80 "systemctl start nginx;systemctl enable nginx"

conf/nginx/nginx.conf:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
include /usr/share/nginx/modules/*.conf;
events {
    worker_connections 4096;
}
http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
    log_format access '$time_local|$remote_addr|$upstream_addr|$status|'
                     '$upstream_connect_time|$bytes_sent|'
                     '$upstream_bytes_sent|$upstream_bytes_received' ;
    access_log /var/log/nginx/access.log access;
    error_log /var/log/nginx/error.log;
    gzip on;
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
    include /etc/nginx/conf.d/http/*.conf;
}
stream {
    log_format proxy '$time_local|$remote_addr|$upstream_addr|$protocol|$status|'
                     '$session_time|$upstream_connect_time|$bytes_sent|$bytes_received|'
                     '$upstream_bytes_sent|$upstream_bytes_received' ;
    access_log /var/log/nginx/stream_access.log proxy;
    error_log  /var/log/nginx/stream_error.log;
    include /etc/nginx/conf.d/stream/*.conf;
}

conf/nginx/apiserver.conf:

upstream kube-apiserver {
    server 10.4.7.81:6443 max_fails=1 fail_timeout=60s ;
    # server 10.4.7.82:6443 max_fails=1 fail_timeout=60s ;
    # server 10.4.7.83:6443 max_fails=1 fail_timeout=60s ;
}
server {
    listen 0.0.0.0:6443 ;
    allow 192.168.0.0/16;
    allow 10.0.0.0/8;
    deny all;
    proxy_connect_timeout 2s;
    proxy_next_upstream on;
    proxy_next_upstream_timeout 5;
    proxy_next_upstream_tries 1;
    proxy_pass kube-apiserver;
    access_log /var/log/nginx/kube-apiserver.log proxy;
}