Keepalived相关配置和高可用

目录

一. Keepalived的工作原理

二. 实现单独的心跳网卡

三. keepalive一些优化

3.1 主从之间加密验证

3.2 修改心跳线发送时间

四. 添加独立日志

五. 抢占模式，非抢占模式，延迟抢占模式

六. 单播地址和多播地址

1. 单播地址（Unicast Address）

七. LVS和keepalived

八. nginx和keepalived

---

一. Keepalived的工作原理

两台机器通过keepalived，虚拟一个IP，也就是VIP(Virtual IP)。这两台机器一个是Master一个是Backup。VIP开始为Master所有，Backup为空闲状态，同时在两台keepalived之间通信相当于有一条心跳线。Master 节点负责处理所有流量，并通过心跳线定期发送 VRRP Advertisement 报文，宣告自己的状态；如果 Backup 节点在指定时间内未收到 Master 的报文，会认为 Master 失效，并选举新的 Master。

如何选出Master:

优先级大的为Master，如果优先级一样谁先启动谁是Master

二. 实现单独的心跳网卡

默认配置中用于检测心跳的网卡往往“身兼多职”

现在我想添加一个独立的网卡检测心跳

#Ubuntu和Ubuntu1添加仅主机网卡#在Ubuntu上
vim /etc/netplan/00-installer-config.yaml
#添加
ens37:dhcp4: noaddresses:- 192.168.10.105/24netplan apply#在Ubuntu1上
ens37:dhcp4: noaddresses:- 192.168.10.31/24netplan apply测试机centos7-13也需要添加网卡

 

#在Ubuntu上
vim /etc/keepalived/keepalived.confglobal_defs {router_id LVS01vrrp_mcast_group4 224.0.0.19
}vrrp_instance VI_1 {interface ens37      #ens37为检测心跳的网卡virtual_router_id 50nopreemptpriority 100advert_int 1virtual_ipaddress {192.168.52.188 dev ens33 label ens33:1  #将192.168.52.188绑定到ens33网卡上}
}systemctl restart keepalived#在Ubuntu1上
vim /etc/keepalived/keepalived.confglobal_defs {router_id LVS02vrrp_mcast_group4 224.0.0.19
}vrrp_instance VI_1 {interface ens37virtual_router_id 50nopreemptpriority 80advert_int 1virtual_ipaddress {192.168.52.188 dev ens33 label ens33:1}
}systemctl restart keepalived

#在测试机centos7-14上
cd /etc/sysconfig/network-scriptscp ifcfg-ens33 ifcfg-ens36vim ifcfg-ens36NAME=ens36
DEVICE=ens36
IPADDR=192.168.10.104
GATEWAY=192.168.10.2systemctl restart network需手动连接一下reboot

 

tcpdump -i ens36 host 224.0.0.19 -nnn
#捕获ens36网卡上所有与VRRP相关的组播流量，验证心跳线通信是否正常

 

三. keepalive一些优化

3.1 主从之间加密验证

在 VRRP（Virtual Router Redundancy Protocol）中，主从节点之间的通信默认是明文传输的，存在一定的安全风险。为了增强安全性，可以通过加密验证来保护主从节点之间的通信。

不过作用不大，仅做了解；因为密码是明文传输可以使用抓包工具查看

vim /etc/keepalived/keepalived.conf
#主从都添加authentication {auth_type PASSauth_pass 123456}systemctl restart keepalived.service

3.2 修改心跳线发送时间

主备都要改

advert_int   时间秒

在centos7-14上抓包
tcpdump -i ens36 host 224.0.0.19 -nnn

四. 添加独立日志

vim /etc/rsyslog.d/50-default.conf 
#添加local6.*     /var/log/keepalived.log

systemctl daemon-reloadcat /var/log/keepalived.log
#查看日志文件

 

五. 抢占模式，非抢占模式，延迟抢占模式

1. 抢占模式：主节点恢复后立即抢占 VIP

2. 非抢占模式：主节点恢复后不抢占 VIP

3. 延迟抢占模式：主节点恢复后等待一段时间再抢占 VIP

语法

preempt             #抢占式
nopreempt           #非抢占式
preempt_delay       #指定抢占延迟时间为#s，默认延迟300s

注意：抢占行为依赖于节点的优先级。确保主节点的优先级高于从节点。

 比如：如果配置了非抢占模式（nopreempt），即使节点 A 的优先级更高，它也不会抢占主节点角色。

六. 单播地址和多播地址

VRRP 默认使用多播地址 224.0.0.18 进行通信，端口号为 112。多播地址允许主从节点在同一个网络中自动发现彼此。

可以使用 tcpdump 抓包工具检查多播通信是否正常：

tcpdump -i eth0 host 224.0.0.18

1. 单播地址（Unicast Address）

定义：单播地址用于标识网络中的一个特定设备（主机或接口），数据包从源地址发送到目标地址，且仅有一个发送者和一个接收者。

在Ubuntu上
vim /etc/keepalived/keepalived.confunicast_src_ip 192.168.10.105unicast_peer {192.168.10.31}systemctl restart keepalived

在Ubuntu1上vim /etc/keepalived/keepalived.confunicast_src_ip 192.168.10.31unicast_peer {192.168.10.105}systemctl restart keepalived

 

在测试机centos7-14上
#抓包
tcpdump -i ens36 host 192.168.10.31 -nnn

七. LVS和keepalived

以下操作是在二的配置基础上进行 

#Ubuntu
vim /etc/keepalived/keepalived.confglobal_defs {router_id LVS02vrrp_mcast_group4 244.0.0.19
}vrrp_instance VI_1 {interface ens37virtual_router_id 50preempt_delay 30priority 80advert_int 1unicast_src_ip 192.168.10.31unicast_peer {192.168.10.105}authentication {auth_type PASSauth_pass 123456
}virtual_ipaddress {192.168.52.188/24 dev ens33 label ens33:1}
}virtual_server 192.168.52.188 80  {delay_loop 6lb_algo rrlb_kind DRpersistence_timeout 0protocol TCPreal_server 192.168.52.103 80 {weight 1HTTP_GET {url {path /status_code  200}connect_timeout 3retry 3delay_before_retry 3}}real_server 192.168.52.104 80 {weight 1HTTP_GET {url {path /status_code  200}connect_timeout 3retry 3delay_before_retry 3}}}#Ubuntu1
vim /etc/keepalived/keepalived.confglobal_defs {router_id LVS02vrrp_mcast_group4 244.0.0.19
}vrrp_instance VI_1 {interface ens37virtual_router_id 50preempt_delay 30priority 80advert_int 1unicast_src_ip 192.168.10.31unicast_peer {192.168.10.105}authentication {auth_type PASSauth_pass 123456
}virtual_ipaddress {192.168.52.188/24 dev ens33 label ens33:1}
}virtual_server 192.168.52.188 80  {delay_loop 6lb_algo rrlb_kind DRpersistence_timeout 0protocol TCPreal_server 192.168.52.103 80 {weight 1HTTP_GET {url {path /status_code  200}connect_timeout 3retry 3delay_before_retry 3}}real_server 192.168.52.104 80 {weight 1HTTP_GET {url {path /status_code  200}connect_timeout 3retry 3delay_before_retry 3}}}

#centos7-13
yum install httpd -ycd /var/www/htmlecho 7-1 > index.htmlsystemctl start httpd#centos7-14
yum install httpd -ycd /var/www/htmlecho 7-2 > index.htmlsystemctl start httpd

Ubuntu中
systemctl restart keepalivedipvsadm -Ln

centos7-13和centos7-14ifconfig lo:0 192.168.52.188 netmask 255.255.255.255vim /etc/sysctl.confnet.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.default.arp_ignore = 1
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2sysctl -proute add -host 192.168.52.188 dev lo:0

centos7-11vim /etc/sysctl.confnet.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.ens33.send_redirects = 0sysctl -p

ubuntu和Ubuntu1vim /etc/sysctl.confnet.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.ens33.send_redirects = 0sysctl -p

在centos7-11上curl 192.168.52.188

断开Ubuntu（主服务器）的连接

八. nginx和keepalived

Ubuntu和Ubuntu1killall -0 keepalivedecho $?apt install nginx -yvim /etc/keepalived/keepalived.conf
删除systemctl restart keepalivedUbuntu中
vim /etc/nginx/sites-enabled/defaultupstream web {
server 192.168.52.103;
server 192.168.52.104;
}proxy_pass http://web;systemctl restart nginxscp /etc/nginx/sites-available/default 192.168.52.31:/etc/nginx/sites-available/defaultyes010918centos7-11systemctl stop httpdcurl 192.168.52.188

Ubuntu1systemctl restart nginxcurl 192.168.52.188

Ubuntusystemctl stop nginxsystemctl start nginxvim /etc/keepalived/keepalived.confvrrp_script check_down {script  "/etc/keepalived/ng.sh"   interval 1weight -30fall  3rise 2timeout 2
}track_script {check_down}

Ubuntucd /etc/keepalived/vim ng.sh#!/bin/bash
killall -0 nginxchmod +x    /etc/keepalived/ng.shUbuntu1
vim /etc/keepalived/keepalived.confvrrp_script check_down {script  "/etc/keepalived/ng.sh"   interval 1weight -30fall  3rise 2timeout 2
}track_script {check_down}vim ng.sh#!/bin/bash
killall -0 nginxkillall -0 nginx

Ubuntu和Ubuntu1
systemctl restart keepalived#在测试机centos7-11上curl 192.168.52.188

#模拟Ubuntu故障
systemctl stop nginxcurl 192.168.52.188