Keepalived超详解，里面有你最爱看的Keepalived+LVS与Keepalived+HAProxy

VRRP

vrrp：Virtual Router Redundancy Protocol

虚拟路由冗余协议（Virtual Router Redundancy Protocol，VRRP）是一种容错协议，解决静态网关单点故障。

物理层:路由器、三层交换机

软件层:keepalived

VRRP 的主要目的是在局域网中提供网关的冗余备份，确保在主网关出现故障时，备份网关能够及时接管，从而保障网络的连续性和稳定性。

VRRP 工作原理如下：

• 多个路由器组成一个 VRRP 组，在组中会选举出一个主路由器和一个或多个备份路由器。
• 主路由器负责处理数据包的转发，备份路由器处于监听状态。
• 主路由器会定期向备份路由器发送通告消息，告知自己的工作状态。 VRRP 的优点包括：
• 提高网络可靠性：避免单点故障导致的网络中断。
• 实现无缝切换：当主路由器故障时，备份路由器能够迅速接管，用户几乎无感知。

VRRP相关术语

• 虚拟路由器：Virtual Router

• 虚拟路由器标识：VRID(0-255)，唯一标识虚拟路由器

• VIP：Virtual IP

• VMAC：Virutal MAC (00-00-5e-00-01-VRID)

• 物理路由器：

  • master：主设备
  • backup：备用设备
  • priority：优先级

VRRP相关技术

• 通告：心跳，优先级等；周期性

• 工作方式：

  • 抢占式
  • 非抢占式

• 安全认证：

  • 无认证
  • 简单字符认证：预共享密钥
  • MD5

• 工作模式：

  • 主/备：单虚拟路由器
  • 主/主：主/备（虚拟路由器1），备/主（虚拟路由器2）

keepalived介绍

Keepalived 是一个用于实现高可用（High Availability）的软件。

它主要的作用是通过监测服务器的状态，来实现故障转移和负载均衡。当主服务器出现故障时，Keepalived 能够迅速将服务切换到备用服务器上，从而保证服务的连续性和稳定性。

Keepalived 基于虚拟路由冗余协议（VRRP）来工作。VRRP 可以在一组服务器中选举出一个主服务器，其他服务器作为备份。主服务器负责处理服务请求，备份服务器则处于监听状态。

Keepalived 的工作原理包括：

1. 健康检查：通过各种方式（如 TCP 连接、HTTP 请求等）监测服务器的健康状态。
2. 主备选举：根据配置和服务器状态进行主备角色的选举。
3. 故障切换：当主服务器故障时，自动将备份服务器提升为主服务器，并接管服务。

keepalived环境准备

从RHEL7.9母盘中克隆四台主机

RealServer1 eth0 172.25.254.110 RealServer1

RealServer2 eth0 172.25.254.120 RealServer2

KA1 eth0 172.25.254.10 KA1

KA2 eth0 172.25.254.20 KA2

在两台RealServer上下载httpd

# RealServer1上
[root@realserver1 ~]# yum install httpd -y
[root@realserver1 ~]# echo realserver1 - 172.25.254.110 > /var/www/html/index.html
[root@realserver1 ~]# systemctl enable --now httpd.service
# RealServer2上与RealServer1上操作相同

keepalived配置说明

配置文件目录/etc/keepalived/keepalived.conf

全局配置

global_defs {
   notification_email {
        2113273707@qq.com  #keepalived 发生故障切换时邮件发送的目标邮箱，可以按行区分写多个
   }
   notification_email_from keepalived@example.com   #发邮件的地址
   
   smtp_server 127.0.0.1  #邮件服务器地址
   
   smtp_connect_timeout 30  #邮件服务器连接超时时间
   
   router_id ka1.example.com  #每个keepalived主机唯一标识，建议使用当前主机名，但多节点重名不影响
   
   vrrp_skip_check_adv_addr   #对所有通告报文都检查，会比较消耗性能，启用此配置后，如果收到的通告报文和上一个报文是同一个路由器，则跳过检查，默认值为全检查
   
   vrrp_strict   #严格遵循vrrp协议；启用此项后以下状况将无法启动服务:1.无VIP地址 2.配置了单播邻居3.在VRRP版本2中有IPv6地址。建议不加此项配置
   
   vrrp_garp_interval 0  #报文发送延迟，0表示不延迟
   
   vrrp_gna_interval 0  #消息发送延迟
   
   vrrp_mcast_group4 224.0.0.18  #指定组播IP地址范围：
}

虚拟路由器配置

vrrp_instance VI_1 {
    state MASTER
    
    interface eth0  #绑定为当前虚拟路由器使用的物理接口，如：eth0,可以和VIP不在一个网卡
    
    virtual_router_id 100  #每个虚拟路由器惟一标识,范围：0-255，每个虚拟路由器此值必须唯一，否则服务无法启动；同属一个虚拟路由器的多个keepalived节点必须相同；务必要确认在同一网络中此值必须唯一
    
    priority 100   #当前物理节点在此虚拟路由器的优先级，范围：1-254，值越大优先级越高,每个keepalived主机节点此值不同
    
    advert_int 1   #vrrp通告的时间间隔，默认1s
    
    authentication {   #认证机制
        auth_type PASS   #两种机制分别为AH和PASS，AH为IPSEC认证(不推荐),PASS为简单密码(建议使用)
        
        auth_pass 1111   #预共享密钥，仅前8位有效，同一个虚拟路由器的多个keepalived节点必须一样
}
    }
    virtual_ipaddress {   #虚拟IP,生产环境可能指定上百个IP地址
        172.25.254.100/24 dev eth0 label eth0:1
    }
}

在KA1和KA2上安装keepalived并编写配置文件

master

[root@ka1 ~]# yum install keepalived -y
# master端
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
global_defs {
   notification_email {
        2113273707@qq.com
   }
   notification_email_from keepalived@example.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id ka1.example.com
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.0.18
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
    }
}
[root@ka1 ~]# systemctl enable --now keepalived.service

backup

# 配置文件内容与KA几乎相同，只需要修改优先级和物理路由器为备用设备BACKUP
# backup端
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf

global_defs {
   notification_email {
        2113273707@qq.com
   }
   notification_email_from keepalived@example.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id ka1.example.com
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.0.18
}

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
    }
}

[root@ka2 ~]# systemctl enable --now keepalived.service

测试效果

此时KA2上是没有VIP的地址的

[root@ka1 ~]# tcpdump -i eth0 -nn host 224.0.0.18
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
23:22:20.747046 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
23:22:21.748445 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
23:22:22.749700 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
23:22:23.751268 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
23:22:24.752935 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
23:22:25.754504 IP 172.25.254.10 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 100, authtype simple, intvl 1s, length 20
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel

关闭KA1再查看组播信息

[root@ka1 ~]# systemctl stop keepalived.service 

[root@ka1 ~]# tcpdump -i eth0 -nn host 224.0.0.18
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
23:23:43.053463 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20
23:23:44.054427 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20
23:23:45.055252 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20
23:23:46.056030 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20
23:23:47.057263 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20
23:23:48.058277 IP 172.25.254.20 > 224.0.0.18: VRRPv2, Advertisement, vrid 100, prio 80, authtype simple, intvl 1s, length 20

开启通信功能

最开始ping VIP172.25.254.100是ping不通的，想要ping通有以下两种方法：

1. 在配置文件中添加vrrp_iptables参数

[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
global_defs {
   notification_email {
        2113273707@qq.com
   }
   notification_email_from keepalived@example.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id ka1.example.com
   vrrp_skip_check_adv_addr
   vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.0.18
   vrrp_iptables
}

2. 注释掉vrrp_strict

[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
global_defs {
   notification_email {
        2113273707@qq.com
   }
   notification_email_from keepalived@example.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id ka1.example.com
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.0.18
   #vrrp_iptables
}

启用keepalived日志

[root@ka1 ~]# vim /etc/sysconfig/keepalived
# Options for keepalived. See `keepalived --help' output and keepalived(8) and
# keepalived.conf(5) man pages for a list of all options. Here are the most
# common ones :
#
# --vrrp               -P    Only run with VRRP subsystem.
# --check              -C    Only run with Health-checker subsystem.
# --dont-release-vrrp  -V    Dont remove VRRP VIPs & VROUTEs on daemon stop.
# --dont-release-ipvs  -I    Dont remove IPVS topology on daemon stop.
# --dump-conf          -d    Dump the configuration data.
# --log-detail         -D    Detailed log messages.
# --log-facility       -S    0-7 Set local syslog facility (default=LOG_DAEMON)
#

KEEPALIVED_OPTIONS="-D -S 6"


[root@ka1 ~]# vim /etc/rsyslog.conf
---------------省略---------------
# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log
local6.*                                                /var/log/keepalived.log
---------------省略---------------

[root@ka1 ~]# systemctl restart keepalived.service
[root@ka1 ~]# systemctl restart rsyslog.service
[root@ka1 ~]# ll /var/log/keepalived.log 
-rw------- 1 root root 12614 Aug 12 00:54 /var/log/keepalived.log

实现独立子配置文件

当生产环境复杂时， /etc/keepalived/keepalived.conf 文件中内容过多，不易管理。将不同集群的配置，比如：不同集群的VIP配置放在独立的子配置文件中利用include 指令可以实现包含子配置文件

将原来的主配置文件的虚拟路由部分注释掉，添加include "/etc/keepalived/conf.d/*.conf"，重新写一个子配置文件

[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived

global_defs {
   notification_email {
        2113273707@qq.com
   }
   notification_email_from keepalived@example.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id ka1.example.com
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 224.0.0.18
   #vrrp_iptables
}

#vrrp_instance VI_1 {
#    state MASTER
#    interface eth0
#    virtual_router_id 100
#    priority 100
#    advert_int 1
#    authentication {
#        auth_type PASS
#        auth_pass 1111
#    }
#    virtual_ipaddress {
#       172.25.254.100/24 dev eth0 label eth0:1
#    }
#}

include "/etc/keepalived/conf.d/*.conf"


[root@ka1 ~]# mkdir -p /etc/keepalived/conf.d

[root@ka1 ~]# vim /etc/keepalived/conf.d/172.25.254.100.conf
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
       172.25.254.100/24 dev eth0 label eth0:1
    }
}

[root@ka1 ~]# systemctl restart keepalived.service

[root@ka1 ~]# systemctl restart keepalived.service

实验效果与写在主配置文件中相同

keepalived企业应用实例

抢占模式和非抢占模式

非抢占模式

nopreempt

默认为抢占模式preempt，即当高优先级的主机恢复在线后，会抢占低先级的主机的master角色，这样会使vip在KA主机中来回漂移，造成网络抖动，建议设置为非抢占模式 nopreempt ，即高优先级主机恢复后，并不会抢占低优先级主机的master角色。

非抢占模块下,如果原主机down机, VIP迁移至的新主机, 后续也发生down时,仍会将VIP迁移回原主机。

# KA1主机配置非抢占模式

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    nopreempt
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
}

# KA2上的非抢占模式与KA1相同，加上nopreempt参数即可

延迟抢占模式

preempt_delay

抢占延迟模式，即优先级高的主机恢复后，不会立即抢回VIP，而是延迟一段时间（默认300s）再抢回VIP。

preempt_delay # #指定抢占延迟时间为#s，默认延迟300s

# KA1主机配置抢占延迟模式

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
}

# KA2上的非抢占模式与KA1相同，加上preempt_delay 5s参数即可

VIP单播模式

默认keepalived主机之间利用多播相互通告消息，会造成网络拥塞，可以替换成单播，减少网络流量。

在所有节点vrrp_instance语句块中设置对方主机的IP，建议设置为专用于对应心跳线网络的地址，而非使用业务网络

unicast_src_ip #指定发送单播的源IP

unicast_peer {

#指定接收单播的对方目标主机IP

…

}

#启用 vrrp_strict 时，不能启用单播,否则服务无法启动

# KA1配置组播变单播

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }
}

# KA2配置组播变单播

vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 80
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
    }
    unicast_src_ip 172.25.254.20
    unicast_peer {
        172.25.254.10
    }

}

测试

此时VIP在KA1上，可以利用抓包工具抓到从KA1传给KA2的流量

现在关掉KA1再做测试

KA1上抓包停止，KA2上抓包


此时VIP跑到KA2上，重新开启KA1后，VIP又会重新回到KA1上

keepalived通知脚本配置

邮件配置

安装邮件发送工具mailx，KA1和KA2都需要安装

[root@KA1 ~]# dnf install mailx -y

QQ邮箱配置

# KA1上
[root@ka1 ~]# vim /etc/mail.rc
# For Linux and BSD, this should be set.
set bsdcompat
set from=2113273707@qq.com  #自己的QQ邮箱
set smtp=smtp.qq.com
set smtp-auth-user=2113273707@qq.com
set smtp-auth-password=dkaokzgldsvubjdd  #在网页QQ邮箱中申请自己的授权码
set smtp-auth=login
set ssl-verify=ignore

[root@ka1 ~]# echo hahahahahaha | mail -s test 2113273707@qq.com  #查看自己的QQ邮箱是否会接收到信息，如果可以则成功

# KA2上也需要做同样的内容

创建通知脚本

[root@ka1 ~]# vim /etc/keepalived/mail.sh
#!/bin/bash
mail_dest='2113273707@qq.com'
send_message()
{
  mail_subj="$HOSTNAME to be $1 vip move"
  mail_mess="`date +%F\ %T`: vrrp move $HOSTNAME change $1"
  echo "$mail_mess" | mail -s "$mail_sub" $mail_dest
}

case $1 in
  master)
  send_message master
  ;;
  backup)
  send_message backup
  ;;
  fault)
  send_message fault
  ;;
  *)
  ;;
esac

# 给脚本赋予权限
[root@ka1 ~]# chmod +x /etc/keepalived/mail.sh
# 执行脚本观察QQ邮箱
[root@ka1 ~]# /etc/keepalived/mail.sh master


# 编辑配置文件实行脚本的调用
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
=================省略==================
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }
   notify_master "/etc/keepalived/mail.sh master"
   notify_backup "/etc/keepalived/mail.sh backup"
   notify_fault "/etc/keepalived/mail.sh fault"
}
=================省略==================

# 重启服务
[root@ka1 ~]# systemctl restart keepalived.service

#KA2也需要跟KA1做同样的操作

# 最后停掉KA1的keepalived，然后在自己的QQ邮箱中查看是否发了邮件

实现master/master的Keepalived双主架构

双主架构用途：

master/slave的单主架构，同一时间只有一个Keepalived对外提供服务，此主机繁忙，而另一台主机却很空闲，利用率低下，可以使用master/master的双主架构，解决此问题。

即将两个或以上VIP分别运行在不同的keepalived服务器，以实现服务器并行提供web访问的目的，提高服务器资源利用率。

# KA1主机
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf
=================省略==================
vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }

}
vrrp_instance VI_2 {
    state MASTER
    interface eth0
    virtual_router_id 200
    priority 80
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.200/24 dev eth0 label eth0:2
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }
}
=================省略==================

#KA2上
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf
=================省略==================
vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 80
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
    }
    unicast_src_ip 172.25.254.20
    unicast_peer {
        172.25.254.10
    }
}
vrrp_instance VI_2 {
    state MASTER
    interface eth0
    virtual_router_id 200
    priority 100
    #advert_int 1
    #nopreempt
    preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.200/24 dev eth0 label eth0:2
   }
   unicast_src_ip 172.25.254.20
   unicast_peer {
        172.25.254.10
   }
}
=================省略==================

此时两台Keepalived主机上都分别有一个VIP

Keepalived+LVS

实现IPVS的高可用

虚拟服务器配置

virtual_server IP port { #VIP和PORT
delay_loop <INT> #检查后端服务器的时间间隔
lb_algo rr|wrr|lc|wlc|lblc|sh|dh #定义调度方法
lb_kind NAT|DR|TUN #集群的类型,注意要大写
persistence_timeout <INT> #持久连接时长
protocol TCP|UDP|SCTP #指定服务协议,一般为TCP
sorry_server <IPADDR> <PORT> #所有RS故障时，备用服务器地址
real_server <IPADDR> <PORT> { #RS的IP和PORT
weight <INT> #RS权重
notify_up <STRING>|<QUOTED-STRING> #RS上线通知脚本
notify_down <STRING>|<QUOTED-STRING> #RS下线通知脚本
HTTP_GET|SSL_GET|TCP_CHECK|SMTP_CHECK|MISC_CHECK { ... } #定义当前主机健康状
态检测方法
}
}
#注意:括号必须分行写,两个括号写在同一行,如: }} 会出错

应用层监测

# 应用层检测：HTTP_GET|SSL_GET
HTTP_GET|SSL_GET {
url {
path <URL_PATH> #定义要监控的URL
status_code <INT> #判断上述检测机制为健康状态的响应码，一般为 200
}
connect_timeout <INTEGER> #客户端请求的超时时长, 相当于haproxy的timeout server
nb_get_retry <INT> #重试次数
delay_before_retry <INT> #重试之前的延迟时长
connect_ip <IP ADDRESS> #向当前RS哪个IP地址发起健康状态检测请求
connect_port <PORT> #向当前RS的哪个PORT发起健康状态检测请求
bindto <IP ADDRESS> #向当前RS发出健康状态检测请求时使用的源地址
bind_port <PORT> #向当前RS发出健康状态检测请求时使用的源端口
}

TCP监测

# 传输层检测：TCP_CHECK
TCP_CHECK {
connect_ip <IP ADDRESS> #向当前RS的哪个IP地址发起健康状态检测请求
connect_port <PORT> #向当前RS的哪个PORT发起健康状态检测请求
bindto <IP ADDRESS> #发出健康状态检测请求时使用的源地址
bind_port <PORT> #发出健康状态检测请求时使用的源端口
connect_timeout <INTEGER> #客户端请求的超时时长
#等于haproxy的timeout server
}

Keepalived+lvs案例实现

# 在两台后端RealServer上安装httpd
[root@realserver1 ~]# yum install httpd -y
[root@realserver1 ~]# echo realserver1 - 172.25.254.110 > /var/www/html/index.html
[root@realserver1 ~]# systemctl enable --now httpd.service 

# 配置环回IP地址
[root@realserver1 ~]# ip a a 172.25.254.100/32 dev lo

# 禁止ARP响应
[root@realserver1 ~]# vim /etc/sysctl.d/arp.conf
net.ipv4.conf.all.arp_ignore=1
net.ipv4.conf.all.arp_announce=2
net.ipv4.conf.lo.arp_ignore=1
net.ipv4.conf.lo.arp_announce=2

[root@realserver1 ~]# sysctl --p
[root@realserver1 ~]# sysctl --system

# RealServer2也做同样的配置

# 在两台Keepalived主机上安装ipvsadm
#KA1
[root@ka1 ~]# yum install ipvsadm -y

# 在Keepalived配置文件中配置Keepalived
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf

=================省略==================
virtual_server 172.25.254.100 80 {
    delay_loop 6
    lb_algo wrr
    lb_kind DR
    #persistence_timeout 50
    protocol TCP

    real_server 172.25.254.110 80 {
        weight 1
        HTTP_GET {
            url {
              path /
             status_code 200
            }
            connect_timeout 3
            nb_get_retry 2
            delay_before_retry 2
        }
    }
    real_server 172.25.254.120 80 {
        weight 1
        HTTP_GET {
            url {
              path /
              status_code 200
            }
            connect_timeout 3
            nb_get_retry 2
            delay_before_retry 2
        }
    }
}
------------省略--------------

# KA2
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf 
=================省略==================
virtual_server 172.25.254.100 80 {
    delay_loop 6
    lb_algo wrr
    lb_kind DR
    #persistence_timeout 50
    protocol TCP

    real_server 172.25.254.110 80 {
        weight 1
        HTTP_GET {
            url {
              path /
             status_code 200
            }
            connect_timeout 3
            nb_get_retry 2
            delay_before_retry 2
        }
    }
    real_server 172.25.254.120 80 {
        weight 1
        HTTP_GET {
            url {
              path /
              status_code 200
            }
            connect_timeout 3
            nb_get_retry 2
            delay_before_retry 2
        }
    }
}
=================省略==================
# 重启服务，在测试端进行访问测试结果
# 检查一下lvs策略
[root@ka1 ~]# systemctl restart keepalived.service 
[root@ka1 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:80 wrr
  -> 172.25.254.110:80            Route   1      0          0         
  -> 172.25.254.120:80            Route   1      0          0        
  
  
[root@test ~]# while true; do curl 172.25.254.100; sleep 0.5; done
realserver1 - 172.25.254.110
realserver2 - 172.25.254.120
realserver1 - 172.25.254.110
realserver2 - 172.25.254.120
realserver1 - 172.25.254.110
realserver2 - 172.25.254.120
realserver1 - 172.25.254.110
realserver2 - 172.25.254.120

# 模拟故障
#第一台RS1故障，自动切换至RS2
[root@realserver1 ~]# systemctl stop httpd #当RS1故障
[root@realserver1 ~]# while true; do curl 172.25.254.100; sleep 0.5; done
#全部流浪被定向到RS2中
realserver2 - 172.25.254.120
realserver2 - 172.25.254.120
realserver2 - 172.25.254.120
realserver2 - 172.25.254.120
realserver2 - 172.25.254.120
realserver2 - 172.25.254.120

#RS1策略被踢出保留RS2的lvs策略
[root@ka1 ~]# ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  172.25.254.100:80 wrr   
  -> 172.25.254.120:80            Route   1      0          0        

Keepalived+HAProxy

在做此实验之前要将之前做Keepalived+LVS的设定都给删掉（环回地址，LVS策略，ARP响应），将实验环境还原

# 在两台后端RealServer上删掉环回地址
[root@realserver1 ~]# ip a d 172.25.254.100/32 dev lo

# 开启ARP响应
[root@realserver1 ~]# vim /etc/sysctl.d/arp.conf
net.ipv4.conf.all.arp_ignore=0
net.ipv4.conf.all.arp_announce=0
net.ipv4.conf.lo.arp_ignore=0
net.ipv4.conf.lo.arp_announce=0

# 注释掉在Keepalived主机上的LVS策略部分

# 两台keepalived主机上安装HAProxy
[root@ka1 ~]# yum install haproxy -y

#在两个ka1和ka2两个节点启用内核参数
[root@ka1 ~]# vim /etc/sysctl.conf
net.ipv4.ip_nonlocal_bind = 1
[root@ka1 ~]# sysctl -p

# 在两个ka1和ka2实现haproxy的配置
[root@ka1 ~]# vim /etc/haproxy/haproxy.cfg

=================省略==================
isten webcluster
    bind 172.25.254.100:80
    mode http
    balance roundrobin
    server web1 172.25.254.110:80 check inter 3 fall 2 rise 5
    server web2 172.25.254.120:80 check inter 3 fall 2 rise 5


# 编写脚本监测HAProxy状态
[root@ka1 ~]# vim /etc/keepalived/test.sh
#!/bin/bash
killall -0 haproxy

# 给脚本执行权限
[root@ka1 ~]# chmod +x /etc/keepalived/test.sh

# 在ka1中配置keepalived
[root@ka1 ~]# vim /etc/keepalived/keepalived.conf 

=================省略==================
vrrp_script check_haproxy {
        script "/etc/keepalived/test.sh"
        interval 1
        weight -30
        fall 2
        rise 2
        timeout 2
}

vrrp_instance VI_1 {
    state MASTER
    interface eth0
    virtual_router_id 100
    priority 100
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }
   track_script {
      check_haproxy
   }

}

vrrp_instance VI_2 {
    state MASTER
    interface eth0
    virtual_router_id 200
    priority 80
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.200/24 dev eth0 label eth0:2
   }
   unicast_src_ip 172.25.254.10
   unicast_peer {
        172.25.254.20
   }
}

=================省略==================

# 在KA2上配置Keepalived
[root@ka2 ~]# vim /etc/keepalived/keepalived.conf

=================省略==================
vrrp_script check_haproxy {
        script "/etc/keepalived/test.sh"
        interval 1
        weight -30
        fall 2
        rise 2
        timeout 2
}


vrrp_instance VI_1 {
    state BACKUP
    interface eth0
    virtual_router_id 100
    priority 80
    advert_int 1
    #nopreempt
    #preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.100/24 dev eth0 label eth0:1
    }
    unicast_src_ip 172.25.254.20
    unicast_peer {
        172.25.254.10
    }
}
vrrp_instance VI_2 {
    state MASTER
    interface eth0
    virtual_router_id 200
    priority 100
    #advert_int 1
    #nopreempt
    preempt_delay 5s
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        172.25.254.200/24 dev eth0 label eth0:2
   }
   unicast_src_ip 172.25.254.20
   unicast_peer {
        172.25.254.10
   }
   track_script {
      check_haproxy
   }

}
=================省略==================

# 重启服务进行测试
# 方法跟上面Keepalived+LVS相同，这里就不做演示