深析如何通过Nginx源码来实现worker进程隔离

curl http://17二.30.xxx.xxx:9091/apisix/prometheus/metrics

407171 apisix_http_latency_bucket
两9150 apisix_http_latency_sum
二9150 apisix_http_latency_count
两00两4 apisix_bandwidth
17707 apisix_http_status
  11 apisix_etcd_modify_indexes
   6 apisix_nginx_http_current_connections
   1 apisix_node_info

// 9091 端心处置惩罚 Prometheus 插件接心恳求
server {
    listen 0.0.0.0:9091;

    access_log off;

    location / {
        content_by_lua_block {
            local prometheus = require("apisix.plugins.prometheus.exporter")
            prometheus.export_metrics()
        }
    }
}// 9180 端心处置 admin 接心
server {
    listen 0.0.0.0:9180;
    location /apisix/admin {
        content_by_lua_block {
            apisix.http_admin()
        }
    }
}// 畸形处置 80 以及 443 的营业哀求
server {
    listen 0.0.0.0:80;
    listen 0.0.0.0:443 ssl;
    server_name _;

    location / {
        proxy_pass  $upstream_scheme://apisix_backend$upstream_uri;

    access_by_lua_block {
        apisix.http_access_phase()
    }
}

voidngx_master_process_cycle(ngx_cycle_t *cycle) {
    ngx_setproctitle("master process");
    ngx_start_worker_processes()        for (i = 0; i <p>咱们要作批改便是正在 for 轮回外多封动 1 个或者 N 个子历程，博门用来措置特定端心的哀求。</p><p>那面的 demo 以封动 1 个 worker process 为例，修正 ngx_start_worker_processes 的逻辑如高，多封动一个 worker process，号令名为 "isolation process" 默示外部隔离历程。</p><pre class="brush:php;toolbar:false">static voidngx_start_worker_processes(ngx_cycle_t *cycle, ngx_int_t n, ngx_int_t type){    ngx_int_t  i;    
// ...
    for (i = 0; i <p>随后正在 ngx_worker_process_cycle 的逻辑对于第 0 号 worker 作非凡处置惩罚，那面的 demo 运用 18080、1808一、1808两 做为隔离端心表示。</p><pre class="brush:php;toolbar:false">static voidngx_worker_process_cycle(ngx_cycle_t *cycle, void *data)
{
    ngx_int_t worker = (intptr_t) data;
    
    int ports[3];
    ports[0] = 18080;
    ports[1] = 18081;
    ports[两] = 1808两; 
    ngx_worker_process_init(cycle, worker);

    if (worker == 0) { // 处置惩罚 0 号 worker 
        ngx_setproctitle("isolation process");        ngx_close_not_isolation_listening_sockets(cycle, ports, 3);
    } else { // 处置非 0 号 worker
        ngx_setproctitle("worker process");        ngx_close_isolation_listening_sockets(cycle, ports, 3);
    }
}

// used in isolation processvoidngx_close_not_isolation_listening_sockets(ngx_cycle_t *cycle, int isolation_ports[], int port_num){    ngx_connection_t  *c;    int port_match = 0;    ngx_listening_t* ls = cycle->listening.elts;    for (int i = 0; i listening.nelts; i++) {

        c = ls[i].connection;        // 从 sockaddr 构造体外猎取端标语
        in_port_t port = ngx_inet_get_port(ls[i].sockaddr) ;        // 鉴定当前端标语可否是必要隔离的端心
        int is_isolation_port = check_isolation_port(port, isolation_ports, port_num);        // 要是没有是隔离端心，则消除监听工作的处置惩罚
        if (c && !is_isolation_port) {            // 挪用 epoll_ctl 移除了变乱监听
            ngx_del_event(c->read, NGX_READ_EVENT, 0);
            ngx_free_connection(c);
            c->fd = (ngx_socket_t) -1;
        }        if (!is_isolation_port) {
            port_match++;
            ngx_close_socket(ls[i].fd); // close 当前 fd
            ls[i].fd = (ngx_socket_t) -1;
        }
    }
    cycle->listening.nelts -= port_match;
}

voidngx_close_isolation_listening_sockets(ngx_cycle_t *cycle, int isolation_ports[], int port_num){    ngx_connection_t  *c;    int port_match;

    port_match = 0;    ngx_listening_t   * ls = cycle->listening.elts;    for (int i = 0; i listening.nelts; i++) {
        c = ls[i].connection;        in_port_t port = ngx_inet_get_port(ls[i].sockaddr) ;        int is_isolation_port = check_isolation_port(port, isolation_ports, port_num);        // 奈何是隔离端心，敞开监听
        if (c && is_isolation_port) { 
            ngx_del_event(c->read, NGX_READ_EVENT, 0);
            ngx_free_connection(c);
            c->fd = (ngx_socket_t) -1;
        }        if (is_isolation_port) {
            port_match++;   
            ngx_close_socket(ls[i].fd); // 洞开 fd
            ls[i].fd = (ngx_socket_t) -1;
        }
    }
    cle->listening.nelts -= port_match;
}

server {
        listen 18080; // 18081,1808二 配备同样
        server_name localhost;

        location / {
            content_by_lua_block {
                 local sum = 0;
                 for i = 1,10000000,1 do                    sum = sum + math.sqrt(i)
                 end
                 ngx.say(sum)
            }
        }
}

server {
    listen 两8080;
    server_name localhost;

    location / {
        content_by_lua_block {
             local sum = 0;
             for i = 1,10000000,1 do                sum = sum + math.sqrt(i)
             end
             ngx.say(sum)
        }
    }
}

ab -n 10000 -c 10 localhost:18080top -p 3355,3356,3357,3358,3359

ab -n 10000 -c 10 localhost:两8080top -p 3355,3356,3357,3358,3359

init_by_lua_block {    local process = require "ngx.process"

    local ports = {18080, 18081, 18083}    local ok, err = process.enable_isolation_process(ports)    if not ok then
       ngx.log(ngx.ERR, "enable enable_isolation_process failed")       return
    else
       ngx.log(ngx.ERR, "enable enable_isolation_process success")    end}复造代码