nginx生產環境平滑升級版本

背景

線上系統nginx版本爲1.14.0版本，因等保掃描，該版本存在漏洞，故須要對其升級到1.17.3版本，升級需保障線上業務平穩運行，需升級須要平滑升級，不對線上服務形成影響，如下記錄本次升級過程

步驟

1. 升級以前先獲取老版本nginx的變異參數

# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.14.0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --add-module=../fastdfs-nginx-module/src

2. 下載1.17.3版本的安裝包到software目錄

# cd /home/software
# wget http://nginx.org/download/nginx-1.17.3.tar.gz

3. 解壓新版本到program目錄

# cd /home/program
# tar -zxvf /home/software/nginx-1.17.3.tar.gz

4. 編譯nginx，注意不執行‘make install’

# cd /home/program/nginx-1.17.3
# ./configure --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --add-module=../fastdfs-nginx-module/src
# make

5. 備份舊版本nginx執行程序

cp -rf /usr/local/nginx/sbin/nginx /usr/local/nginx/sbin/nginx14.bak

6. 替換nginx執行程序爲最新的

cp -rf objs/nginx /usr/local/nginx/sbin/

7. 發送USR2信號給舊版本主進程號,使nginx的舊版本中止接收請求，用nginx新版本接替，且老進程處理完全部請求，關閉全部鏈接後，中止，相關信號以下所示：
   

# cd /usr/local/nginx/logs/
[root@Gene-redis 2021-04-12 18:38:28 /usr/local/nginx/logs] 
# ls
access.log  error.log  nginx.pid
# kill -USR2 `cat /usr/local/nginx/logs/nginx.pid`

此時查看nginx進程就會有兩個nginx的主進程，此時老的還在運行以前待處理的請求，新的請求將由新的進程處理請求

# ps -ef|grep nginx
root     27154     1  0 Mar25 ?        00:00:00 nginx: master process ./nginx
nobody   27492 27154  0 Mar25 ?        00:04:42 nginx: worker process
root     28681 27154  0 17:20 ?        00:00:00 nginx: master process ./nginx
nobody   28682 28681  0 17:20 ?        00:00:00 nginx: worker process
root     28684 28533  0 17:20 pts/1    00:00:00 grep --color=auto nginx

而且logs目錄下會生成nginx.pid.oldbin文件，裏面存放了老版本的pid號

# ll
total 1417008
-rw-r--r--. 1 root root 1234085629 Apr 12 17:21 access.log
-rw-r--r--. 1 root root   82733488 Apr 12 17:21 error.log
-rw-r--r--  1 root root          6 Apr 12 17:20 nginx.pid
-rw-r--r--  1 root root          6 Mar 25 14:59 nginx.pid.oldbin

8. 再從容優雅觀察舊的主進程，它會等請求處理完成再關閉

# kill -QUIT `cat /usr/local/nginx/logs/nginx.pid.oldbin`

此時能夠看到主進程的狀態改變了

# ps -ef|grep nginx
root     27154     1  0 Mar25 ?        00:00:00 nginx: master process ./nginx
nobody   27492 27154  0 Mar25 ?        00:04:42 nginx: worker process is shutting down
root     28681 27154  0 17:20 ?        00:00:00 nginx: master process ./nginx
nobody   28682 28681  0 17:20 ?        00:00:00 nginx: worker process
root     28720 28533  0 17:21 pts/1    00:00:00 grep --color=auto nginx

再過一會就只剩一個主進程提供服務了

# ps -ef|grep nginx
root     28681 27154  0 17:20 ?        00:00:00 nginx: master process ./nginx
nobody   28682 28681  0 17:20 ?        00:00:00 nginx: worker process
root     28720 28533  0 17:21 pts/1    00:00:00 grep --color=auto nginx

9. 再查看nginx版本信息，能夠看到nginx已經完成了升級，而且線上服務正常運行

# /usr/local/nginx/sbin/nginx -V
nginx version: nginx/1.17.3
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC) 
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --with-http_stub_status_module --with-http_ssl_module --with-http_realip_module --add-module=../fastdfs-nginx-module/src