day38-keepalive高可用

01.keepalived 高可用介绍

02.配置基础架构

负载均衡
LB01  10.0.0.5  负载均衡  worpdress
LB02  10.0.0.6  负载均衡  wordpress
...

03.配置 keepalived

LB01安装部署
[root@lb01:~]#yum -y install keepalived
[root@lb01:~]#cat /etc/keepalived/keepalived.conf
global_defs {                   #全局配置
    router_id lb01              #标识身份->名称
}

vrrp_instance VI_1 {
    state MASTER                #标识角色状态
    interface ens33              #网卡绑定接口
    virtual_router_id 50        #虚拟路由id
    priority 150                #优先级
    advert_int 1                #监测间隔时间
    authentication {            #认证
        auth_type PASS          #认证方式
        auth_pass 1111          #认证密码
    }
    virtual_ipaddress {
        10.0.0.3                #虚拟的VIP地址
    }
}
[root@lb01:~]#systemctl start keepalived
[root@lb01:~]#systemctl enable keepalived

测试hosts解析虚拟IP地址
10.0.0.3  www.wp.com

配置LB02
[root@lb02:~]#yum -y install keepalived
[root@lb02:~]#cat /etc/keepalived/keepalived.conf
global_defs {                   #全局配置
    router_id lb02              #标识身份->名称
}

vrrp_instance VI_1 {
    state BACKUP                #标识角色状态
    interface ens33              #网卡绑定接口
    virtual_router_id 50        #虚拟路由id
    priority 100                #优先级
    advert_int 1                #监测间隔时间
    authentication {            #认证
        auth_type PASS          #认证方式
        auth_pass 1111          #认证密码
    }
    virtual_ipaddress {
        10.0.0.3                #虚拟的VIP地址
    }
}


启动服务
[root@lb02:~]#systemctl start keepalived
[root@lb02:~]#systemctl enable keepalived



主和备的区别: 3个位置
主:
router_id lb01
state MASTER
priority 150
备:
router_id lb02
state BACKUP
priority 100

04.测试 vip 漂移

停止主服务器服务,看IP地址是否漂移到备份服务器
[root@lb01:~]#systemctl stop keepalived
[root@lb01:~]#ip add|grep 10.0.0.3
[root@lb01:~]#

LB02查看IP:
[root@lb02:~]#ip add|grep 10.0.0.3
    inet 10.0.0.3/32 scope global ens33
[root@lb02:~]#

05.keepalived 集成 nginx 服务

keepalived的日志是系统日志:
[root@lb01:~]#tail -f /var/log/messages



1.脚本检查Nginx服务是否正常运行，如果挂掉，会自动杀死keepalived

-------------------判断nginx是否运行中----------------
[root@lb01:~]#systemctl start nginx
[root@lb01:~]#systemctl status nginx &>/dev/null
[root@lb01:~]#echo $?		# 如果nginx运行则返回0
0

[root@lb01:~]#systemctl stop nginx
[root@lb01:~]#systemctl status nginx &>/dev/null
[root@lb01:~]#echo $?		# 如果nginx未运行返回非0的结果
3
-----------------------------------------------------------

[root@lb01:~]#netstat -tnulp|grep nginx|wc -l
2
[root@lb01:~]#systemctl stop nginx
[root@lb01:~]#netstat -tnulp|grep nginx
[root@lb01:~]#netstat -tnulp|grep nginx|wc -l
0
[root@lb01:~]#systemctl start nginx
[root@lb01:~]#netstat -tnulp|grep nginx|wc -l
2
----------------------------------------------------------

[root@lb01:~]#systemctl stop nginx
[root@lb01:~]#ps axu|grep nginx|wc -l
1
[root@lb01:~]#ps axu|grep nginx
root        9360  0.0  0.0 213136   888 pts/1    R+   11:40   0:00 grep nginx
[root@lb01:~]#systemctl start nginx
[root@lb01:~]#ps axu|grep nginx|wc -l
3
-------------------------------------------------------------
[root@lb01:~]#curl -I 127.0.0.1
HTTP/1.1 200 OK
Server: nginx/1.26.1
Date: Fri, 16 Aug 2024 03:41:35 GMT
Content-Type: text/html
Content-Length: 739
Last-Modified: Tue, 13 Aug 2024 02:59:14 GMT
Connection: keep-alive
ETag: "66bacc02-2e3"
Accept-Ranges: bytes

[root@lb01:~]#echo $?
0
[root@lb01:~]#systemctl stop nginx
[root@lb01:~]#curl -I 127.0.0.1
curl: (7) Failed to connect to 127.0.0.1 port 80: Connection refused
[root@lb01:~]#echo $?
7
---------------------------------------------------------------------

检测脚本:
----------------------------- 有问题的脚本。
[root@lb01:~]#cat check_web.sh
#1.查看Nginx状态
systemctl status nginx &>/dev/null

#2.根据返回的结果判断nginx是否存在

if [ $? -ne 0 ];then
   systemctl stop keepalived
fi
-----------------------------

执行成功的脚本:
[root@lb01:~]#cat check_web.sh
#!/bin/sh
ng_port=`netstat -tnulp|grep nginx|wc -l`

#1.判断Nginx是否存活,如果不存活则尝试启动Nginx

if [ $ng_port -eq 0 ];then
   systemctl restart nginx
   sleep 2
      ng_port=`netstat -tnulp|grep nginx|wc -l`
      if [ $ng_port -eq 0 ];then
          systemctl stop keepalived
      fi
fi

[root@lb01:~]#chmod +x check_web.sh

sh check_web.sh 执行看看报错么

keepalive在系统日志查看
tail -f /var/log/messages


集成到keepalived服务中
[root@lb01:~]#cat /etc/keepalived/keepalived.conf
global_defs {                   #全局配置
    router_id lb01              #标识身份->名称
}

vrrp_script check_web {			# 调用脚本
    script "/root/check_web.sh"
    interval 5
}

vrrp_instance VI_1 {
    state MASTER                #标识角色状态
    interface ens33              #网卡绑定接口
    virtual_router_id 50        #虚拟路由id
    priority 150                #优先级
    advert_int 1                #监测间隔时间
    authentication {            #认证
        auth_type PASS          #认证方式
        auth_pass 1111          #认证密码
    }
    virtual_ipaddress {
        10.0.0.3                #虚拟的VIP地址
    }
     track_script {			    # 调用脚本
       check_web
     }
}

systemctl restart keepalived

06.模拟脑裂

LB01和LB02开启firewalld
systemctl start firewalld

测试放行80和443端口:
[root@lb02:~]#firewall-cmd --add-port={443/tcp,80/udp}
success
[root@lb02:~]#firewall-cmd --add-service=http
success
[root@lb02:~]#firewall-cmd --add-service=https
success

解决脑裂:
杀死一个keepalived,查找原因。
服务器硬件
网络
软件 防火墙 安全策略

07.配置非抢占式

在负载均衡两台服务器配置相同的情况下使用非抢占式。
LB01的配置
[root@lb01:~]#cat /etc/keepalived/keepalived.conf
global_defs {                   #全局配置
    router_id lb01              #标识身份->名称
}

vrrp_script check_web {
    script "/root/check_web.sh"
    interval 5
}

vrrp_instance VI_1 {
    state BACKUP               #标识角色状态			# 修改为BACKUP
    interface ens33              #网卡绑定接口
    virtual_router_id 50        #虚拟路由id
    priority 150                #优先级
    advert_int 1                #监测间隔时间
    nopreempt										# 添加一条不抢占

    authentication {            #认证
        auth_type PASS          #认证方式
        auth_pass 1111          #认证密码
    }
    virtual_ipaddress {
        10.0.0.3                #虚拟的VIP地址
    }
     track_script {
       check_web
     }
}


LB02配置:
[root@lb02:~]#cat /etc/keepalived/keepalived.conf
global_defs {                   #全局配置
    router_id lb02              #标识身份->名称
}

vrrp_instance VI_1 {
    state BACKUP                #标识角色状态
    interface ens33              #网卡绑定接口
    virtual_router_id 50        #虚拟路由id
    priority 100                #优先级
    advert_int 1                #监测间隔时间
    nopreempt			              # 添加一条配置不抢占
    authentication {            #认证
        auth_type PASS          #认证方式
        auth_pass 1111          #认证密码
    }
    virtual_ipaddress {
        10.0.0.3                #虚拟的VIP地址
    }
}

周末: 恢复快照
01.BACKUP
02.通过虚拟IP地址访问 www.wp.com www.zh.com phpmyadmin

Ansible自动化部署。