keepalived繫結單播地址、非搶佔模式及LVS的TCP模式的高可用
阿新 • • 發佈：2020-12-23
背景：keepalived預設是組播地址進行播放，且預設地址是224.0.0.18，如果配置多個keepalived主機，會導致虛擬IP地址存在衝突問題，這種問題怎麼解決呢？
解決辦法：就是將keepalived主機的多播地址修改為單播地址，繫結固定IP地址，避免在多播模式下，通過VRRP進行廣播地址，造成IP地址地址衝突。
vrrp_strict #嚴格遵守VRRP協議,不允許狀況，在配置單播IP地址時，此行需要刪除或者註釋掉即可。
1、沒有VIP地址
2、單播鄰居
3、在VRRP版本2中有IPv6地址
實驗一：實現keepalived單播地址配置
1、在主節點配置keepalived檔案
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
[root@centos_17~]#vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VI_1 {state MASTER
interface ens33
virtual_router_id 50
priority 100
unicast_src_ip 192.168.37.17 配置源地址的IP地址
unicast_peer {
192.168.37.7 配置從節點的目標IP地址
}
advert_int 2
authentication {
auth_type pass
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
配置完成之後重啟keepalived：
| 1 |
[root@centos_17~]#systemctl restart keepalived
|
2、在從節點配置keepalived檔案
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
[root@centos7~]#vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka2
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VI_1 {
state BACKUP
interface ens33
virtual_router_id 50
priority 80
unicast_src_ip 192.168.37.7
unicast_peer {
192.168.37.17
}
advert_int 2
authentication {
auth_type pass
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
配置完成之後重啟keepalived：
| 1 |
[root@centos_17~]#systemctl restart keepalived
|
3、驗證鎖單播IP地址效果。
此時由於綁定了雙方keepalived主機的IP地址，就只會對雙方進行廣播，避免多個keepalived的虛擬IP地址進行衝突。
實驗二：實現非搶佔模式漂移VIP
原理：關閉VIP搶佔模式，需要VIP state都為BACKUP，此時哪個keepalived的優先順序大，優先佔用哪個keepalived伺服器，當此佔用的伺服器宕機後，另一個BACKUP主機才會進行佔用，就算優先順序高的恢復了，也不能進行搶佔，除非優先順序低的伺服器宕機後，才會繼續佔用到高優先順序的keepalived伺服器上。
1、在優先順序高的keepalived主機進行配置
vim /etc/keepalived/keepalived.conf
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state BACKUP 角色必須是BACKUP
interface ens33
virtual_router_id 50
priority 100
unicast_src_ip 192.168.37.17
unicast_peer {
192.168.37.7
}
advert_int 2
nopreempt 設定為非搶佔模式
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
2、在優先順序低的keepalived主機配置
vim /etc/keepalived/keepalived.conf
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka2
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state BACKUP 角色必須是BACKUP
interface ens33
virtual_router_id 60
priority 80
unicast_src_ip 192.168.37.7
unicast_peer {
192.168.37.17
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
測試效果：
此時手動將keepalived主機優先順序高的進行宕機，VIP就會漂移到優先順序低的主機上。
| 1 |
[root@centos_17~]#systemctl stop keepalived
|
此時檢視優先順序低的主機IP地址情況：
此時就算高優先順序的主機恢復，也無法搶佔VIP地址，此時需要宕機優先順序低的主機才會佔用VIP地址。
啟動優先順序高的主機：systemctl start keepalived
停掉優先順序低的主機：systemctl stop keepalived
實戰三：實現兩個以上的Keepalived主機
背景：當公司需求量較大時，兩個keepalived已經不能滿足公司需求，此時需要配置兩臺以上的keepalived，應該怎麼配置？
實現方法如下：
1、在A主機配置keepalived
vim /etc/keepalived/keepalived.conf
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state MASTER 主節點伺服器
interface ens33
virtual_router_id 60
priority 100 優先順序為100
unicast_src_ip 192.168.37.7 繫結單播地址，防止IP地址與其他keepalived地址衝突
unicast_peer {
192.168.37.17 目標keepalived主機IP地址
192.168.37.27 目標keepalived主機IP地址
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1 新增VIP地址，也可以多新增幾個地址
}
}
|
2、在B主機配置keepalived
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state BACKUP 從節點伺服器
interface ens33
virtual_router_id 50
priority 80 優先順序為80
unicast_src_ip 192.168.37.17 繫結單播地址，源keepalived的IP地址
unicast_peer {
192.168.37.7 兩個目標的keepalived的IP地址
192.168.37.27
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
3、在C主機配置keepalived
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state BACKUP 從節點伺服器
interface ens33
virtual_router_id 50
priority 60 優先順序為60，要比前兩個的主機優先順序都要低
unicast_src_ip 192.168.37.27 繫結單播地址，源地址
unicast_peer {
192.168.37.7 兩個keepalived的目標地址
192.168.37.17
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
|
測試效果：
將A主機的keepalived宕機，可以觀察此時的B主機成為MASTER主機，VIP地址就會漂移到B主機上。
當B主機的keepalived也宕機之後，此時的VIP就會漂移到C主機從節點的keepalived伺服器上
同理：當優先順序高的keepalived伺服器恢復後，VIP地址就又會漂移回去。
實戰四：實現TCP模式keepalived及LVS-DR模式高可用（此用法多於HTTP用法）
引數含義：
| 1 2 3 4 5 6 7 8 9 10 11 12 13 |
delay_loop<INT>：檢查後端伺服器的時間間隔
lb_algorr|wrr|lc|wlc|lblc|sh|dh：定義排程方法
lb_kindNAT|DR|TUN：叢集的型別
persistence_timeout<INT>：持久連線時長
protocol TCP|UDP|SCTP：指定服務協議
sorry_server<IPADDR> <PORT>：所有RS故障時，備用伺服器地址
real_server<IPADDR> <PORT>
{
weight <INT> RS權重
notify_up<STRING>|<QUOTED-STRING> RS上線通知指令碼
notify_down<STRING>|<QUOTED-STRING> RS下線通知指令碼
HTTP_GET|SSL_GET|TCP_CHECK|SMTP_CHECK|MISC_CHEC K { ... }：定義當前主機的健康狀態檢測方法
}
|
HTTP監測含義
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
HTTP_GET|SSL_GET：應用層檢測
HTTP_GET|SSL_GET {
url{
path <URL_PATH>：定義要監控的URL
status_code<INT>：判斷上述檢測機制為健康狀態的響應碼
}
connect_timeout<INTEGER>：連線請求的超時時長
nb_get_retry<INT>：重試次數
delay_before_retry<INT>：重試之前的延遲時長
connect_ip<IP ADDRESS>：向當前RS哪個IP地址發起健康狀態檢測請求
connect_port<PORT>：向當前RS的哪個PORT發起健康狀態檢測請求
bindto<IP ADDRESS>：發出健康狀態檢測請求時使用的源地址
bind_port<PORT>：發出健康狀態檢測請求時使用的源埠
}
|
TCP監測
傳輸層檢測TCP_CHECK
| 1 2 3 4 5 6 7 |
TCP_CHECK {
connect_ip<IP ADDRESS>：向當前RS的哪個IP地址發起健康狀態檢測請求
connect_port<PORT>：向當前RS的哪個PORT發起健康狀態檢測請求
bindto<IP ADDRESS>：發出健康狀態檢測請求時使用的源地址
bind_port<PORT>：發出健康狀態檢測請求時使用的源埠
connect_timeout<INTEGER>：連線請求的超時時長
}
|
1、在A主機修改keepalived配置檔案
vim /etc/keepalived/keepalived.conf
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka2
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state MASTER
interface ens33
virtual_router_id 50
priority 100
unicast_src_ip 192.168.37.7
unicast_peer {
192.168.37.17
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
include /etc/keepalived/conf/*.conf 定義一個單獨管理的目錄，定義keepalived配置檔案
|
在A主機定義LVS-DR模式配置檔案
如果後期keepalived的配置檔案修改過大，我們可以呼叫include，新建一個目錄，並在此目錄下進行存放配置檔案。
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
[root@centos7keepalived]#mkdir conf
[root@centos7keepalived]#vim conf/tcp.conf
virtual_server 192.168.37.100 80 { VIP地址
delay_loop 6
lb_algo wrr 權重輪詢
lb_kind DR DR模式
protocol TCP
sorry_server 192.168.37.47 80 配置後端sorry伺服器，當兩個keepalived主機都宕機之後，就在此主機進行顯示資訊。
real_server 192.168.37.27 80 { 後端RS1伺服器IP地址
weight 1
TCP_CHECK {
connect_timeout 5
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
real_server 192.168.37.37 80 { 後端RS2伺服器
weight 1
TCP_CHECK {
connect_timeout 5
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
}
|
2、在B主機修改keepalived配置檔案
vim /etc/keepalived/keepalived.conf
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
global_defs {
notification_email {
[email protected]
}
notification_email_from [email protected]
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1
vrrp_skip_check_adv_addr
vrrp_iptables
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VIP_1 {
state BACKUP
interface ens33
virtual_router_id 50
priority 80
unicast_src_ip 192.168.37.17
unicast_peer {
192.168.37.7
}
advert_int 2
authentication {
auth_type PASS
auth_pass 123456
}
virtual_ipaddress {
192.168.37.100 dev ens33 label ens33:1
}
}
include /etc/keepalived/conf/*.conf
|
在B主機定義LVS-DR模式的配置檔案
新建conf目錄，並在此目錄下新建一個配置檔案
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
[root@centos_17keepalived]#mkdir conf
[root@centos_17keepalived]#vim conf/tcp.conf
virtual_server 192.168.37.100 80 {
delay_loop 6
lb_algo wrr
lb_kind DR
protocol TCP
sorry_server 192.168.37.47 80 定義sorry server的後端主機，當兩個keepalived主機宕機後，就會提示此資訊。
real_server 192.168.37.27 80 {
weight 1
TCP_CHECK {
connect_timeout 5
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
real_server 192.168.37.37 80 {
weight 1
TCP_CHECK {
connect_timeout 5
nb_get_retry 3
delay_before_retry 3
connect_port 80
}
}
}
|
3、後端伺服器RS1上修改配置
在RS1繫結VIP地址及lo迴環網絡卡
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 |
[root@centos27~]#vim lvs_dr_rs.sh
#!/bin/bash
#Author:wangxiaochun
#Date:2017-08-13
vip=192.168.37.100 繫結VIP地址
mask='255.255.255.255'
dev=lo:1 繫結在lo迴環網絡卡上
rpm -q httpd &> /dev/null || yum -y install httpd &>/dev/null
service httpd start &> /dev/null && echo "The httpd Server is Ready!"
echo "<h1>`hostname`</h1>" > /var/www/html/index.html
case $1 in
start)
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
ifconfig $dev $vip netmask $mask #broadcast $vip up
#route add -host $vip dev $dev
echo "The RS Server is Ready!"
;;
stop)
ifconfig $dev down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
echo "The RS Server is Canceled!"
;;
*)
echo "Usage: $(basename $0) start|stop"
exit 1
;;
esac
|
執行指令碼：
| 1 |
[root@centos27~]#bash lvs_dr_rs.sh start
|
4、在RS2後端伺服器上修改配置
修改RS2的配置指令碼，繫結VIP地址及lo迴環網絡卡
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
#!/bin/bash
#Author:wangxiaochun
#Date:2017-08-13
vip=192.168.37.100
mask='255.255.255.255'
dev=lo:1
rpm -q httpd &> /dev/null || yum -y install httpd &>/dev/null
service httpd start &> /dev/null && echo "The httpd Server is Ready!"
echo "<h1>`hostname`</h1>" > /var/www/html/index.html
case $1 in
start)
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
ifconfig $dev $vip netmask $mask #broadcast $vip up
#route add -host $vip dev $dev
echo "The RS Server is Ready!"
;;
stop)
ifconfig $dev down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
echo "The RS Server is Canceled!"
;;
*)
echo "Usage: $(basename $0) start|stop"
exit 1
;;
esac
|
執行以上指令碼
| 1 |
[root@centos37~]#bash lvs_dr_rs.sh start
|
4、在sorry後端伺服器上修改配置
修改sorry後端伺服器配置指令碼，繫結VIP地址及lo迴環網絡卡
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
#!/bin/bash
#Author:wangxiaochun
#Date:2017-08-13
vip=192.168.37.100
mask='255.255.255.255'
dev=lo:1
rpm -q httpd &> /dev/null || yum -y install httpd &>/dev/null
service httpd start &> /dev/null && echo "The httpd Server is Ready!"
echo "<h1>`hostname`</h1>" > /var/www/html/index.html
case $1 in
start)
echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
ifconfig $dev $vip netmask $mask #broadcast $vip up
#route add -host $vip dev $dev
echo "The RS Server is Ready!"
;;
stop)
ifconfig $dev down
echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
echo "The RS Server is Canceled!"
;;
*)
echo "Usage: $(basename $0) start|stop"
exit 1
;;
esac
|
執行以上指令碼
| 1 |
[root@centos47~]#bash lvs_dr_rs.sh start
|
5、測試效果：
將RS1和RS2及sorry後端伺服器新增測試頁面，並啟動httpd服務：systemctl start httpd
| 1 2 3 4 5 6 7 8 |
[root@cenots277~]#yum install httpd
[root@cenots27~]#cd /var/www/html
[root@cenots27html]#cat index.html
<h1>cenots27</h1>
[root@cenots37html]#cat index.html
<h1>cenots37</h1>
[root@cenots37html]#cat index.html
sorry server !!
|
客戶端訪問LVS的VIP地址，此時LVS將排程到後端伺服器，進行輪詢訪問。
當後端RS1和RS2後端伺服器宕機後，此時就會顯示sorry server資訊。
https://www.cnblogs.com/struggle-1216/p/12098241.html