• 如果您觉得本站非常有看点,那么赶紧使用Ctrl+D 收藏吧

高可用服务之Keepalived基础入门

开发技术 开发技术 2周前 (09-08) 16次浏览

  前面我们聊了聊高可用集群corosync+pacemaker的相关概念以及相关工具的使用和说明,回顾请参考https://www.cnblogs.com/qiuhom-1874/category/1838133.html;今天我们说一下高可用服务keepalived;

  keepalived相对corosync+pacemaker这种高可用集群,它要轻量很多;它的工作原理就是vrrp的实现;vrrp(Virtual Router Redundancy Protocol,虚拟路由冗余协议 ),设计之初它主要用于对LVS集群的高可用,同时它也能够对LVS后端real server做健康状态检测;它主要功能有基于vrrp协议完成地址流动,从而实现服务的故障转移;为VIP地址所在的节点生成ipvs规则;为ipvs集群的各RS做健康状态检测;基于脚本调用接口通过执行脚本完成脚本中定义的功能,进而影响集群事务;

  keepalved架构

高可用服务之Keepalived基础入门

  提示:keepalived的主要由vrrp stack、checkers、ipvs wrapper以及控制组件配置文件分析器,IO复用器,内存管理这些组件组成,其中vrrp stack 是用来实现vip的高可用;checkers用于基于不同协议对后端服务做检测,它两都是基于系统调用和SMTP协议来完成对vip的转移,以及故障转移后的邮件通知,以及vip和后端服务的检测;ipvs wrapper主要用于生成ipvs规则;而对于keepalved的核心组件vrrp stack 和checkers是由watchdog进程一直监控着,一旦vrrp stack 或者checkers宕掉,watchdog会立即启动一个新的vrrp stack或checkers,从而保证了keepalived自身的组件的高可用;

  keepalived实现

  环境说明

  准备两台keepalived服务器,各server必须满足时间同步,确保iptables及selinux都是关闭着;如果有必要可以配置各节点通过hosts文件解析以及各节点的ssh互信,后面的主机名解析和ssh互信不是必须的;

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门

  提示:有关ssh互信,可以参考本人博客https://www.cnblogs.com/qiuhom-1874/p/11783371.html;除了确保以上几条外,还需要确保我们的网卡支持多播功能;

高可用服务之Keepalived基础入门

  提示:如果网卡没有启动多播功能需要用ip link set multicast on dev 网卡名称即可;

  安装keepalived程序包

yum install keepalived -y

  提示:两节点都要安装

  查看keepalived的程序环境

[root@node01 ~]# rpm -ql keepalived
/etc/keepalived
/etc/keepalived/keepalived.conf
/etc/sysconfig/keepalived
/usr/bin/genhash
/usr/lib/systemd/system/keepalived.service
/usr/libexec/keepalived
/usr/sbin/keepalived
/usr/share/doc/keepalived-1.3.5
/usr/share/doc/keepalived-1.3.5/AUTHOR
/usr/share/doc/keepalived-1.3.5/CONTRIBUTORS
/usr/share/doc/keepalived-1.3.5/COPYING
/usr/share/doc/keepalived-1.3.5/ChangeLog
/usr/share/doc/keepalived-1.3.5/NOTE_vrrp_vmac.txt
/usr/share/doc/keepalived-1.3.5/README
/usr/share/doc/keepalived-1.3.5/TODO
/usr/share/doc/keepalived-1.3.5/keepalived.conf.SYNOPSIS
/usr/share/doc/keepalived-1.3.5/samples
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.HTTP_GET.port
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.IPv6
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.SMTP_CHECK
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.SSL_GET
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.fwmark
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.inhibit
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.misc_check
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.misc_check_arg
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.quorum
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.sample
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.status_code
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.track_interface
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.virtual_server_group
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.virtualhost
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.localcheck
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.lvs_syncd
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.routes
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.rules
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.scripts
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.static_ipaddress
/usr/share/doc/keepalived-1.3.5/samples/keepalived.conf.vrrp.sync
/usr/share/doc/keepalived-1.3.5/samples/sample.misccheck.smbcheck.sh
/usr/share/man/man1/genhash.1.gz
/usr/share/man/man5/keepalived.conf.5.gz
/usr/share/man/man8/keepalived.8.gz
/usr/share/snmp/mibs/KEEPALIVED-MIB.txt
/usr/share/snmp/mibs/VRRP-MIB.txt
/usr/share/snmp/mibs/VRRPv3-MIB.txt
[root@node01 ~]# 

  提示:主配置文件是/etc/keepalived/keepalived.conf;主程序文件/usr/sbin/keepalived;unit file是/usr/lib/systemd/system/keepalived.service;unit file的环境配置文件是/etc/sysconfig/keepalived;

  keepalived默认配置

[root@node01 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived

global_defs {
   notification_email {
     acassen@firewall.loc
     failover@firewall.loc
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 192.168.200.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.200.16
        192.168.200.17
        192.168.200.18
    }
}

virtual_server 192.168.200.100 443 {
    delay_loop 6
    lb_algo rr
    lb_kind NAT
    persistence_timeout 50
    protocol TCP

    real_server 192.168.201.100 443 {
        weight 1
        SSL_GET {
            url {
              path /
              digest ff20ad2481f97b1754ef3e12ecd3a9cc
            }
            url {
              path /mrtg/
              digest 9b3a0c85a887a256d6939da88aabd8cd
            }
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

virtual_server 10.10.10.2 1358 {
    delay_loop 6
    lb_algo rr 
    lb_kind NAT
    persistence_timeout 50
    protocol TCP

    sorry_server 192.168.200.200 1358

    real_server 192.168.200.2 1358 {
        weight 1
        HTTP_GET {
            url { 
              path /testurl/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl2/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl3/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.200.3 1358 {
        weight 1
        HTTP_GET {
            url { 
              path /testurl/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334c
            }
            url { 
              path /testurl2/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334c
            }
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

virtual_server 10.10.10.3 1358 {
    delay_loop 3
    lb_algo rr 
    lb_kind NAT
    persistence_timeout 50
    protocol TCP

    real_server 192.168.200.4 1358 {
        weight 1
        HTTP_GET {
            url { 
              path /testurl/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl2/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl3/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }

    real_server 192.168.200.5 1358 {
        weight 1
        HTTP_GET {
            url { 
              path /testurl/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl2/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            url { 
              path /testurl3/test.jsp
              digest 640205b7b0fc66c1ea91c463fac6334d
            }
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}
[root@node01 ~]# 

  提示:keepalived的配置文件主要由global configuration、vrrpdconfiguration、LVS configuration这三部分配置段组成;其中global配置段主要定义全局属性以及静态路由和地址相关配置;vrrp配置段主要定义VRRP实例或vrrp同步组相关配置;LVS配置段主要定义IPVS集群和LVS后端各real server相关的配置;

  keepalived配置说明

  全局配置常用指令说明

  global_defs {…}:用于定义全局配置段,在这个配置段里可以配置全局属性,以及邮件通知相关配置;

  notification_email {…}:该配置段是globald_defs配置段的一个子配置段用于配置当集群发生状态变化时,接受通知的邮箱;

  notification_email_from:用于指定发送邮件的发件人邮箱地址;

  smtp_server:用于指定邮件服务器地址;

  smtp_connect_timeout:用于指定邮件服务器连接超时时间;

  router_id:集群节点ID,通常这个ID是唯一的,不和其他节点相同;

  vrrp_skip_check_adv_addr:忽略检查通告vrrp通告和上一次接收的vrrp是同master地址的通告;

  vrrp_strict:严格遵守VRRP协议;

  vrrp_garp_interval:设定同一接口的两次arp广播的延迟时长,默认为0表示不延迟;

  vrrp_gna_interval:设定同一接口的两次na消息延迟时长,默认为0表示不延迟;

  vrrp_mcast_group4:设定组播ip地址,默认是224.0.0.18;组播地址是一个D类地址,它的范围是224.0.0.0-239.255.255.255;

  vrrp_iptables:关闭生成iptables规则;

  vrrp实例常用指令

  vrrp_instance:指定一个vrrp示例名称,并引用一个配置实例上下文配置段用大括号括起来;

  state:用于定义该vrrp实例的角色,常用的有MASTER和BACKUP两个角色,并且多个节点上同虚拟路由id的实例,只能有一个MASTER角色且优先级是最高的,其他的都为BACKUP优先级都要略小于MASTER角色的优先级;

  interface:用于指定vrrp实例的网卡名称,就是把vip配置在那个接口上;

  virtual_router_id:虚拟路由ID取值范围是0-255;

  advert_int:指定发送心跳间隔时长,默认是1秒;

  priority:指定该实例的优先级;

  authentication {…}:用于定义认证信息;

  auth_type:指定认证类型,常用认证类型有PASS和AH,PASS指简单的密码认证,AH指IPSEC认证;如果使用PASS类型,默认只会取前8个字符作为认证密码;

  auth_pass:指定认证密码;

  virtual_ipaddress {..}:用于设定虚拟ip地址的配置,用大括号括起来;定义虚拟ip的语法格式为:<IPADDR>/<MASK> brd <IPADDR> dev <STRING> scope <SCOPE> label <LABEL>;其中brd用于指定广播地址,dev用于指定接口名称,scope用于指定作用域,label用于指定别名;可以配置多个虚拟ip,通常一个实例中只配置一个虚拟ip;

  示例:在node01和node02利用keepalived配置vip192.168.0.33

  node01上的配置

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门高可用服务之Keepalived基础入门

! Configuration File for keepalived

global_defs {
   notification_email {
        root@localhost
   }
   notification_email_from node01_keepalived@localhost
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id node01
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.12.132
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 12345678
    }
    virtual_ipaddress {
        192.168.0.33/24 brd 192.168.0.255 dev ens33 label ens33:1
    }
}

View Code

  node02上的配置

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门高可用服务之Keepalived基础入门

! Configuration File for keepalived

global_defs {
   notification_email {
        root@localhost
   }
   notification_email_from node02_keepalived@localhost
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id node02
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.12.132
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 51
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 12345678
    }
    virtual_ipaddress {
        192.168.0.33/24 brd 192.168.0.255 dev ens33 label ens33:1
    }
}

View Code

  启动node01和node02上的keepalived

高可用服务之Keepalived基础入门

  提示:可以看到把node01上的keepalived启动起来以后,vip就配置在外面指定的ens33接口上;

高可用服务之Keepalived基础入门

  提示:可以看到node02上的keepalived启动起来以后,vip并没有从node01上抢过来,并且在node02上看keepalived的状态信息,清楚的看到node02以backup角色运行着,这意味着只有当master宕机以后,它才会有可能把vip抢过来;

  在node02上抓包,看看心跳信息是否是我们指定1秒一个呢?是否是在我们指定的组播域?

高可用服务之Keepalived基础入门

  提示:可以看到node01(MASTER节点)一秒一个心跳报文给指定的组播域发送通告信息,只要在组播域内地主机能够收到MASTER的通告,它们都认为MASTER还活着,一旦master没有发通告,那么backup节点就会触发重新争夺VIP;

  验证:把master keepalived停掉,看看VIP是否飘到node02上呢?

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门

  提示:可以看到当把node01上的keepalived停掉以后,对应vip会飘到node02上,并且node02会向组播域一直通告自己的vrrid 优先级 等等信息;

  验证:把node01的keepalived启动起来,vip是否会被node01抢过去呢?

高可用服务之Keepalived基础入门

  提示:默认我们没有指定是否工作在抢占模式,默认就为抢占模式,意思是只要对应的组播域有比当前VIP所在节点上的优先级高的通告,拥有VIP的节点会自动把vip让出来,让其优先级高的节点应用;

  在node02上查看keepalived的状态以及ip地址信息

高可用服务之Keepalived基础入门

  提示:从node02的keepalived的状态信息可以看到,它接收到更高优先级的通告,然后自己自动移除了VIP ,iptables规则,并工作为BACKUP角色;

  示例:配置keepalived的双主模型

  node01上的配置

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门高可用服务之Keepalived基础入门

! Configuration File for keepalived

global_defs {
   notification_email {
        root@localhost
   }
   notification_email_from node01_keepalived@localhost
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id node01
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.12.132
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 12345678
    }
    virtual_ipaddress {
        192.168.0.33/24 brd 192.168.0.255 dev ens33 label ens33:1
    }
}
vrrp_instance VI_2 {
    state BACKUP
    interface ens33
    virtual_router_id 52
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 87654321
    }
    virtual_ipaddress {
        192.168.0.34/24 brd 192.168.0.255 dev ens33 label ens33:2
    }
}

View Code

  node02上的配置

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门高可用服务之Keepalived基础入门

! Configuration File for keepalived

global_defs {
   notification_email {
        root@localhost
   }
   notification_email_from node02_keepalived@localhost
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id node02
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.12.132
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 51
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 12345678
    }
    virtual_ipaddress {
        192.168.0.33/24 brd 192.168.0.255 dev ens33 label ens33:1
    }
}
vrrp_instance VI_2 {
    state MASTER
    interface ens33
    virtual_router_id 52
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 87654321
    }
    virtual_ipaddress {
        192.168.0.34/24 brd 192.168.0.255 dev ens33 label ens33:2
    }
}

View Code

  提示:定义双主模型,通常我们会利用两个vrrp实例来配置,中心思想就是利用两个节点的两个vrrp实例,把两个实例分别在node01和node02上各配置一个实例为MASTER,对应剩下节点就为BACKUP;这样配置以后,重启keepalived,如果node01和node02都正常在线,那么对于两个vip他们会各自占一个,如果其中一台server宕机,他们都会把自身为MASTER角色的vip转移到另外的节点;

  验证:重启node01和node02上的keepalived,看看对应vip是否都会在两个节点各自一个呢?

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门

  提示:可以看到重启两个节点上的keepalived后,根据我们配置的初始化角色各自都占用了一个vip;这样我们只需在把对位的域名(如果是web服务)的A记录解析分别解析到这两个vip后,这两个vip就可以各自承担一部分请求,从而实现两个keepalived都在工作;

  验证:把node01宕机以后,看看192.168.0.33这个地址是否会飘到node02上呢?

高可用服务之Keepalived基础入门

高可用服务之Keepalived基础入门

  提示:可以看到当node01宕机以后,node02就把原来在node01上的vip抢过来应用在自身节点上;这样一来就实现了把原来访问192.168.0.33的流量转移到node02上了;同样的道理我们把node02宕机,在node02上的VIP也会转移到node01上;


喜欢 (0)