目录
高可用集群
为了让vip稳定的运行，使用高可用集群
集群类型
1.负载均衡
流量的转发
2.高可用
利用储备，让生产集群可用时间达到最长
A = MTBF / (MTBF+MTTR）
99.95%:(60*24*30)*(1-0.9995)=21.6分钟 #一般按一个月停机时间统计
指标 ：99.9%, 99.99%, 99.999%,99.9999%
3.高性能
解决单个主机的运算能力达不到预期，将多台主机组合到一起
如何实现高可用
1.主/备
2.双主，节省服务器数量
3.active --> HEARTBEAT --> passive
4.active <--> HEARTBEAT <--> active
VRRP：虚拟路由冗余协议
解决问题：路由器出现问题怎么办？
keepalived-->heartbeat-->vrrp
用于路由：让外面的客户请求进来
用于服务器：让服务器出去
VRRP相关术语
虚拟路由器：Virtual Router
虚拟路由器标识：VRID(0-255)，唯一标识虚拟路由器
VIP：Virtual IP VMAC：Virutal MAC (00-00-5e-00-01-VRID)
物理路由器：
master：主设备
backup：备用设备
priority：优先级
VRRP相关技术
通告：心跳，优先级等；周期性
工作方式：抢占式，非抢占式 ，延迟抢占
安全认证：
无认证
简单字符认证：预共享密钥
MD5
工作模式：
主/备：
单虚拟路由器 一台使用，一台限制，资源浪费
主/主：
主/备（虚拟路由器1），备/主（虚拟路由器2）
都有vip，负责不同业务，互为储备，一台坏了另一台接管它的资源
keepalived简介
vrrp协议的软件实现，原生设计目的是为了实现高可用
功能：
基于vrrp协议完成地址流动
为后端进行健康检测
环境部署
使用的是rhel7
KA1
[root@ka1 ~]# vmset.sh eth0 172.25.254.10 ka1.example.org
[root@ka1 ~]# yum install keepalived -y
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
1348889677@qq.com
}
notification_email_from keepalived@example.org
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id ka1.example.org
vrrp_skip_check_adv_addr
vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
vrrp_mcast_group4 224.0.0.18
}
vrrp_instance VI_1 {
state MASTER
interface eth0
#唯一标识
virtual_router_id 100
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
}
[root@ka1 ~]# systemctl restart keepalived.service
[root@ka1 ~]# systemctl enable --now keepalived.service
#快速复制
[root@ka1 ~]# scp /etc/keepalived/keepalived.conf root@172.25.254.20:/etc/keepalived/keepalived.conf
KA2
[root@ka2 ~]# vmset.sh eth0 172.25.254.20 ka2.example.org
[root@ka2 ~]# yum install keepalived -y
vrrp_instance VI_1 {
state BACKUP
interface eth0
#唯一标识要相同
virtual_router_id 100
#优先级不能比master高
priority 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
}
#抓包命令
[root@ka2 ~]# tcpdump -i eth0 -nn host 224.0.0.18
rs1 和 2
[root@rs1 ~]# vmset.sh eth0 172.25.254.110 realserver1.example.org
[root@rs1 ~]# yum install httpd -y
[root@rs1 ~]# echo 172.25.254.110 > /var/www/html/index.html
[root@rs1 ~]# systemctl enable --now httpd 虚拟路由通讯设定
在配置文件里面，如果vip想接受访问，就都写上，或者都注释掉
vrrp_strict vrrp_iptables
日志分离
[root@ka1 ~]# vim /etc/sysconfig/keepalived
#只能是0-7，不能超过了
KEEPALIVED_OPTIONS="-D -S 6"
[root@ka1 ~]# vim /etc/rsyslog.conf
# Save boot messages also to boot.log
local7.* /var/log/boot.log
#定义采集方式
local6.* /var/log/keepal
ived.log
#先重启服务
[root@ka1 ~]# systemctl restart keepalived.service
#再重启日志
[root@ka1 ~]# systemctl restart rsyslog.service
#查看
[root@ka1 ~]# ll /var/log/keepalived.log 
独立子配置文件
当生产环境复杂时， /etc/keepalived/keepalived.conf 文件中内容过多，不易阅读和更改
将不同集群的配置，比如：不同集群的VIP配置放在独立的子配置文件中利用include 指令可以实现包含
格式
include /path/file
ka1
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
#vrrp_instance VI_1 {
# state MASTER
# interface eth0
# virtual_router_id 100
# priority 100
# advert_int 1
# authentication {
# auth_type PASS
# auth_pass 1111
# }
# virtual_ipaddress {
# 172.25.254.100/24 dev eth0 label eth0:1
# }
#}
#记得提前创建
include "/etc/keepalived/conf.d/*.conf"创建子配置文件信息
[root@ka1 ~]# mkdir -p /etc/keepalived/conf.d
[root@ka1 ~]# vim /etc/keepalived/conf.d
#为100这个vip服务的
[root@ka1 ~]# vim /etc/keepalived/conf.d/172.25.254.100.conf
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 100
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
}
[root@ka1 ~]# systemctl restart keepalived.service 非抢占模式和延迟抢占
默认抢占模式为preemt,即当高优先级的主机恢复在线后，会抢占低优先级主机的master角色，
这样会使vip在KA主机中来回飘逸，造成网络抖动
建议设置为非抢占模式nopreempt,即高优先级主机恢复后，并不会抢占低优先级主机的master角色。
非抢占模式下，如果原主机down机。vip迁移到新主机，后续发生down机时，任然会迁移回原主机
抢占模式：两台主机都设置为BAKEUP，nopreempt模式
抢占延迟参数：preempt_delay 5s
企业默认五到十分钟
单播模式设定
通告：多播，会造成网络堵塞
组播：一个ip到多个ip
单播：一个ip到一个ip
广播：一个ip随便传
在所有节点vrrp_instance语句块中设置对方主机的IP，建议设置为专用于对应心跳线网络的地址，而非使
用业务网络
unicast_src_ip <IPADDR> #指定发送单播的源IP
unicast_peer {
<IPADDR> #指定接收单播的对方目标主机IP
......
}
#启用 vrrp_strict 时，不能启用单播,否则服务无法启动
r1
[rot@ks1 ~]# vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 100
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
unicast_src_ip 172.25.254.10
unicast_peer {
172.25.254.20
}
}
[root@ks1 ~]# systemctl restart keepalived.service r2
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 100
priority 80
advert_int 1
#preempt_delay 5s
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev ens33 label ens33:1
}
unicast_src_ip 172.25.254.20
unicast_peer {
172.25.254.10
}
}
[root@ka2 ~]# systemctl restart keepalived.service 测试
[root@ka1 ~]# tcpdump -i eth0 -nn src host 172.25.254.10 and dst 172.25.254.20
#通知没有vip的主机，我还活着
#-i 监视网课
#-nn不做解析
邮件通知
配置邮件
[root@ka1 ~]# yum install mailx -y
[root@ka1 ~]# vim /etc/mail.rc
# For Linux and BSD, this should be set.
set bsdcompat
set from=1348889677@qq.com
set smtp=smtp.qq.com
set smtp-auth-user=1348889677@qq.com
set smtp-auth-password=isjatjwmcxtxbefj
set smtp-auth=login
set ssl-verify=ignore
#-s 标题
[root@ka1 ~]# echo hello world | mail -s test 1348889677@qq.com脚本调度
[root@ka1 ~]# vim /etc/mail.rc
#!/bin/bash
mail_dest='1348889677@qq.com'
mail_send()
{
mail_subj="$HOSTNAME to be $1 vip 转移"
mail_mess="`date +%F\ %T`: vrrp 转移,$HOSTNAME 变为 $1"
echo "$mail_mess" | mail -s "$mail_subj" $mail_dest
}
case $1 in
master)
mail_send master
;;
backup)
mail_send backup
;;
fault)
mail_send fault
;;
*)
exit 1
;;
esac
[root@ka1 ~]# vim /etc/keepalived/mail.sh
[root@ka1 ~]# chmod +x /etc/keepalived/mail.sh
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
#VI末尾
notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"
[root@ka1 ~]# systemctl restart keepalived.service
[root@ka1 ~]# /etc/keepalived/mail.sh fault双主架构（互为储备）
master/slave的单主架构，同一时间只有一个Keepalived对外提供服务，此主机繁忙，而另一台主机却很空闲，利用率低下，可以使用master/master的双主架构，解决此问题。
master/master 的双主架构：
即将两个或以上VIP分别运行在不同的keepalived服务器，以实现服务器并行提供web访问的目的，提高服务器资源利用率
[root@ks1 ~]# vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 100
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
unicast_src_ip 172.25.254.10
unicast_peer {
172.25.254.20
}
}
unicast_src_ip 172.25.254.10
unicast_peer {
172.25.254.20
}
}
vrrp_instance VI_2 {
state BCAKUP
interface eth0
virtual_router_id 200
priority 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.200/24 dev eth0 label eth0:2
}
unicast_src_ip 172.25.254.10
unicast_peer {
172.25.254.20
}
}
[root@ks1 ~]# systemctl restart keepalived.service 
20
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 100
priority 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
unicast_src_ip 172.25.254.20
unicast_peer {
172.25.254.10
}
}
vrrp_instance VI_2 {
state MASTER
interface eth0
virtual_router_id 200
priority 100
advert_int 1
#preempt_delay 5s
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.200/24 dev eth0 label eth0:2
}
unicast_src_ip 172.25.254.20
unicast_peer {
172.25.254.10
}
}
[root@ka2 ~]# systemctl restart keepalived.service 
当其中一台down了
lvs+keepalived
rs1 和 2
[root@realserver2 ~]# cd /etc/sysconfig/network-scripts/
[root@realserver2 network-scripts]# vim ifcfg-lo
DEVICE=lo
IPADDR0=127.0.0.1
NETMASK0=255.0.0.0
IPADDR1=172.25.254.100
NETMASK1=255.255.255.255
NETWORK=127.0.0.0
# If you're having problems with gated making 127.0.0.0/8 a martian,
# you can change this to something else (255.255.255.255, for example)
BROADCAST=127.255.255.255
ONBOOT=yes
NAME=loopback
[root@realserver2 ~]# vim /etc/sysctl.d/arp.conf
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_announce=2
net.ipv4.conf.all.arp_ignore=1
net.ipv4.conf.lo.arp_announce=2
net.ipv4.conf.lo.arp_ignore=1
#检查是否生效
[root@realserver2 ~]# sysctl --system
net.ipv4.conf.all.arp_announce = 2
net.ipv4.conf.all.arp_ignore = 1
net.ipv4.conf.lo.arp_announce = 2
net.ipv4.conf.lo.arp_ignore = 1
#复制到110，记得让它生效在110里面
[root@realserver2 ~]#scp /etc/sysctl.d/arp.conf root@172.25.254.110:/etc/sysctl.d/arp.conf
ka1
virtual_server 172.25.254.100 80 {
delay_loop 6
lb_algo wrr
lb_kind DR
protocol TCP
real_server 172.25.254.110 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 172.25.254.110 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 172.25.254.120 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}20
virtual_server 172.25.254.100 80 {
delay_loop 6
lb_algo wrr
lb_kind DR
protocol TCP
real_server 172.25.254.110 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 172.25.254.110 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
real_server 172.25.254.120 80 {
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 3
nb_get_retry 3
delay_before_retry 3
}
}
}
HAProxy+keepalived
谁的haproxy出问题，就飘vip
原理：haproxy挂了，就降低优先级
如何利用keepalived检查其他程序的状态？
keepalived利用 VRRP Script 技术，可以调用外部的辅助脚本进行资源监控，并根据监控的结果实现优先 动态调整，从而实现其它应用的高可用性功能
vrrp script调用脚本
track_script：
调用vrrp_script定义的脚本去监控资源，定义在VRRP实例之内，调用事先定义的 vrrp_script
track_script {
SCRIPT_NAME_1
SCRIPT_NAME_2
}
KA1
[root@ka1 ~]# cat /etc/keepalived/test.sh
#!/bin/bash
[ ! -f /mnt/lee ]
[root@ka1 ~]# vim /etc/keepalived/test.sh
vrrp_script check_file {
script "/etc/keepalived/test.sh"
interval 1
weight -30
fall 2
rise 2
timeout 2
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 100
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100/24 dev eth0 label eth0:1
}
unicast_src_ip 172.25.254.10
unicast_peer {
172.25.254.20
}
track_script {
check_file
}
}
[root@ka1 ~]# touch /mnt/lee
[root@ka1 ~]# chmod +x /etc/keepalived/test.sh
[root@ka1 ~]# systemctl restart keepalived.service 
HAProxy+keepalived高可用
控制vip的飘逸
keepalived出问题也不会影响访问
用脚本去检测，在使用weight更改优先级
KA1
[root@ka1 ~]# yum install haproxy -y
#打开内核参数，否则haproxy起不来
[root@ka1 ~]# vim /etc/sysctl.conf
[root@ka1 ~]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1
#注意要注释掉vrrp协议，否则会由冲突
[root@ka1 ~]# vim /etc/haproxy/haproxy.cfg
listen webcluster
bind *:80
mode http
balance roundrobin
server web1 172.25.254.110:80 check inter 3 fall 2 rise 5
server web2 172.25.254.120:80 check inter 3 fall 2 rise 5
[root@ka1 ~]# cat /etc/keepalived/test.sh
#!/bin/bash
killall -0 haproxyKA2
[root@ka1 ~]# yum install haproxy -y
#打开内核参数，否则haproxy起不来
[root@ka2 ~]# vim /etc/sysctl.conf
[root@ka2 ~]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1
[root@ka1 ~]# vim /etc/haproxy/haproxy.cfg
listen webcluster
bind *:80
mode http
balance roundrobin
server web1 172.25.254.110:80 check inter 3 fall 2 rise 5
server web2 172.25.254.120:80 check inter 3 fall 2 rise 5
[root@ka1 ~]# cat /etc/keepalived/test.sh
#!/bin/bash
killall -0 haproxyrs
[root@realserver1 ~]# systemctl restart network
Job for network.service failed because the control process exited with error code. See "systemctl status network.service" and "journalctl -xe" for details.
[root@realserver1 ~]# nmcli connection show
NAME UUID TYPE DEVICE
eth0 5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03 ethernet eth0
virbr0 0675fa0c-3989-45c3-bdf8-014f2e31edaf bridge virbr0
ens33 c96bc909-188e-ec64-3a96-6a90982b08ad ethernet --
[root@realserver1 ~]# nmcli connection delete ens33 #删除没用的ens33
Connection 'ens33' (c96bc909-188e-ec64-3a96-6a90982b08ad) successfully deleted.
[root@realserver1 ~]# systemctl restart network
[root@realserver1 ~]# ip a #查看上个实验添加的环回地址是否还在，在就删除掉
[root@realserver1 ~]# ip a d 172.25.254.100/32 dev lo #删除环回
[root@realserver1 ~]# ip a
[root@realserver1 ~]# vim /etc/sysctl.d/arp.conf
net.ipv4.conf.all.arp_ignore=0
net.ipv4.conf.all.arp_announce=0
net.ipv4.conf.lo.arp_ignore=0
net.ipv4.conf.lo.arp_announce=0
[root@realserver1 ~]# sysctl --system
#停止和启动ka1的服务，轮询依旧不变
[root@realserver1 ~]# while true; do curl 172.25.254.100;sleep 1; done
1642
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
