keepalived的簡單使用

原理簡述

本篇主要學習keepalived配合nginx實現nginx的高可用, 也就是需要keepalived檢測到nginx宕機時停用keepalived, 備用keepalived會自動接收過來.

簡單的原理(如下圖), 主備伺服器會設定相同的vip(虛擬ip), 誰的優先順序高誰來接收vip的請求, 然後nginx和keepalived部署在同一個伺服器上面, keeplived控制機器接收到vip的請求, 交給了nginx來處理請求. nginx的功能主要是負責負載均衡, nginx的安裝設定在此不再贅述, 可以參考這個: ngix安裝與使用

keepalived功能有很多, 此篇只是最簡單的配合ngxin實現高可用的demo.

安裝

安裝常用的的指令包: yum install -y curl gcc openssl-devel libnl3-devel net-snmp-devel
安裝: yum install -y keepalived
啟動: systemctl start keepalived
重啟: systemctl restart keepalived
關閉: systemctl stop keepalived
開機自啟: systemctl enable keepalived

修改組態檔: vim /etc/keepalived/keepalived.conf

! Configuration File for keepalived

# 定義虛擬路由, 必須叫VI_1
vrrp_instance VI_1 {
    state MASTER #設定為主伺服器, 備份伺服器設定為BACKUP
    interface enp0s3 #監控的網路介面(ifconfig或者ip addr指令找出網路卡)
    priority 100 #(優先順序, 主機大一點, 備份機小一點)
    virtual_router_id 99 #同一個vrrp_instance下routerId必須是一致的

    authentication {
        auth_type PASS #vrrp認證方式主備必須一致
        auth_pass 12345 #密碼
    }

    virtual_ipaddress {
        192.168.0.99 #虛擬ip, 主從一致, 可設定多個
    }
}

另外一臺機相同方法, 相同設定(state改成BACKUP, priority調整調一下, 此例中是80)

vrrp 的主從並不是通過stat設定的MASTER和BACKUP決定的, 是通過優先順序決定的

預設紀錄檔位置: /var/log/message位置修改參考: keepalived 設定紀錄檔方法

參考1: Linux下Keepalived安裝與設定

參考2: Keepalived原理介紹和設定實踐

參考3: keepalived介紹、安裝及設定詳解

參考4: https://codor.lanzoue.com/b012qnsvc 密碼:1i77

檢查是否腦裂

使用tcpdump -i enp0s3 -nn host 224.0.0.18
或者
tcpdump -i enp0s3 | grep VRRP進行檢視, 預設的廣播通道為224.0.0.18 (我把時間刪除了, 內容是我改的)

192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
192.168.0.117 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 80, authtype simple, intvl 1s, length 20
192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
192.168.0.117 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 80, authtype simple, intvl 1s, length 20
192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
192.168.0.117 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 80, authtype simple, intvl 1s, length 20

如果結果如上, 說明出現了腦裂(主備都向外宣誓我是老大),

出現這種情況的原因是防火牆或者iptables攔截了vrrp請求, 進行放行即可.

防火牆(推薦):
```
firewall-cmd --add-rich-rule='rule protocol value="vrrp" accept' --permanent
firewall-cmd --reload
```
iptables:
```
iptables -A INPUT -s 192.168.1.0/24 -d 224.0.0.18 -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -p vrrp -j ACCEPT
```
不存在可以進行安裝, yum install iptables-services
- 參考1: Keepalived高可用切換過程
- 參考2: centos7 keepalived VRRP協定 firewalld設定
- 參考3: keepalived的腦裂問題與解決
- 參考4: 使用keepalived時iptables需要開放的協定
- 參考5: linux iptables防火牆中的工作常用命令

最後附上正常執行結果, 即只有100或者80優先順序的機器來廣播自己是老大

09:26:55.782258 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
09:26:56.782910 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
09:26:57.783787 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
09:26:58.784709 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
09:26:59.784792 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20
09:27:00.785171 IP 192.168.0.111 > 224.0.0.18: VRRPv2, Advertisement, vrid 99, prio 100, authtype simple, intvl 1s, length 20

測試ip漂移

ip漂移: 就是主備切換過程成, vip漂到真實ip上的過程. 也稱為主備切換.

測試過程就是停用master機器上面的keepalived或者關機master機器, 檢視backup機器是否正常接過來, 一般1s左右可以切換過去. 當出現腦裂情況的時候切換過程也能實現, 只是很慢大約7s左右. 具體原因未深究.

漂移過程可以通過抓包實現, 也可以通過兩給ngxin轉發到不同tomcat中的專案或網頁, 或者修改ngxin的預設網頁進行測試都可.

至此位置簡單使用就完成了, 下面介紹幾個功能設定

VRRP指令碼

簽到keepalived的組態檔夾: cd /etc/keepalived/

建立一個指令碼檔案: vim nginx_check.sh

#!/bin/bash
count=`ps -C nginx --no-header |wc -l`
if [ $count -eq 0 ];then
		killall keepalived
fi

賦予執行許可權: chmode +x nginx_check.sh
引入指令碼: vim keepalived.conf

與vrrp_instance同級, 其中
- chk_nginx: 指令碼名稱, 自定義的
- script: 指令碼位置
- interval: 執行間隔
- weight: 權重, 如果是負數, 當執行失敗時候會影響vrrp_instance中的優先順序priority, 因為主備切換是通過優先順序的高低的進行切換的, 所以也可以通過這個優先順序來進行主動控制主備切換. 而指令碼中的內容可以很靈活地實現很多功能. 此個demo中只是簡單實現檢測到ngxin關閉後自動關閉keepalived, 也可以實現檢測啟動後進行開啟, 然後延遲2s後檢視是否啟動成功, 未成功再進行關閉keepalived或者降低優先順序(配合右鍵通知).
```
vrrp_script chk_nginx {
	script "/etc/keepalived/nginx_check.sh"
	interval 2
	#weight -30
}
```
設定到vrrp_instance中, 與authentication和virtual_ipaddress同級
```
track_script {
	chk_nginx
}
```

修改後的組態檔

! Configuration File for keepalived

vrrp_script chk_nginx {
    script "/etc/keepalived/nginx_check.sh"
    interval 2
    #weight -30
}

vrrp_instance VI_1 {
    state MASTER
    interface enp0s3
    priority 100
    advert_int 1
    virtual_router_id 99
    authentication {
        auth_type PASS
        auth_pass 221531
    }

    track_script {
        chk_nginx
    }

    virtual_ipaddress {
        192.168.0.99
    }
}

測試

正常啟動時候, 手動關閉nginx, 檢視keepalived的狀態.
參考:
- 參考1: keepalived之vrrp_script詳解
- 參考2: Keepalived 的主備切換怎麼做

郵件設定

郵件功能是linux上面的mail指令.

安裝mail: yum -y install mailx

編輯組態檔(設定傳送人資訊): vim /etc/mail.rc, 在末尾處新增

set [email protected]
set smtp=smtp.163.com
set [email protected]
set smtp-auth-password=KJFHTOSXZQPNFAIU  #郵箱需要開啟POP3/SMTP服務並設定金鑰
set smtp-auth=login
set ssl-verify=ignore

測試mail功能: echo test mail | mail -s testa 收件人[email protected]
- -s 後面是主題的意思
- echo test maill 中的test mail 是郵件正文.
- 最後跟著收件人

設定到keepalived中, 方法1

建立指令碼 vim mail_send.sh(記得賦予執行許可權)

可以使用./mail_send.sh master進行測試

#!/bin/bash
contact='收件人郵箱@qq.com'
notify() {
  	  mailsubject="$(hostname) to be $1, vip  轉移"
  	  mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be $1"
  	  echo "$mailbody" | mail -s "$mailsubject" $contact
}
case $1 in
  	  master)
  			  notify master
  			  ;;
  	  backup)
  			  notify backup
  			  ;;
  	  fault)
  			  notify fault
  			  ;;
  	  *)
  			  echo "Usage: $(basename $0) {master|backup|fault}"
  			  exit 1
  			  ;;
esac

修改組態檔: vim keepalived.conf

vrrp_instance下與authentication同級處

notify_master "/etc/keepalived/mail_send.sh master"
notify_backup "/etc/keepalived/mail_send.sh backup"
notify_fault "/etc/keepalived/mail_send.sh fault"

整體組態檔

! Configuration File for keepalived

vrrp_script chk_nginx {
    script "/etc/keepalived/nginx_check.sh"
    interval 2
    #weight -30
}

vrrp_instance VI_1 {
    state MASTER
    interface enp0s3
    priority 100
    advert_int 1
    virtual_router_id 99
    # 當進入master/backup/fault狀態時觸發指令碼, 可攜帶引數
    notify_master "/etc/keepalived/mail_send.sh master"
    notify_backup "/etc/keepalived/mail_send.sh backup"
    notify_fault "/etc/keepalived/mail_send.sh fault"
    authentication {
        auth_type PASS
        auth_pass 221531
    }

    track_script {
        chk_nginx
    }

    virtual_ipaddress {
        192.168.0.99
    }
}

設定到keepalived中, 方法2

指令碼內容, 下面這個是漂移到master時, 另外建立backup和fault

#!/bin/bash
contacts='收件人郵箱1, 收件人郵箱2'
ip a > ipa_temp.txt

echo "$(date +'%F %T'): Keepalived instance I became MASTER on $(hostname).    --- from master" | mail -s "Master Keepalived notification" -a ipa_temp.txt "$contacts"