keepalived介绍和部分案例

keepalived介绍

Keepalived的作用是检测服务器的状态，如果有一台web服务器宕机，或工作出现故障，Keepalived将检测到，并将有故障的服务器从系统中剔除，同时使用其他服务器代替该服务器的工作，当服务器工作正常后Keepalived自动将服务器加入到服务器群中，这些工作全部自动完成，不需要人工干涉，需要人工做的只是修复故障的服务器。
vrrp 协议的软件实现，原生设计目的为了高可用 ipvs服务

功能：

基于vrrp协议完成地址流动
为vip地址所在的节点生成ipvs规则(在配置文件中预先定义)
为ipvs集群的各RS做健康状态检测
基于脚本调用接口完成脚本中定义的功能，进而影响集群事务，以此支持nginx、haproxy等服务

一、安装keepalived

sh
#!/bin/bash
#********************************************************************
#Author:            zhangwei
#QQ:                200957079
#Date:              2020-10-23
#FileName:          install_keepalived.sh
#URL:               http://www.ztunan.top
#Description:       The test script
#Copyright (C):     2020 All rights reserved
#********************************************************************
#注意:这里需要提前更改操作系统的网卡名为eth0格式，否则keepalived会起不来~~~
KEEPALIVED_VERSION=2.0.20
INSTALL_DIR=/usr/local/keepalived
CPUS=`lscpu |awk '/^CPU\(s\)/{print $2}'`
. /etc/os-release

color () {
    RES_COL=60
    MOVE_TO_COL="echo -en \\033[${RES_COL}G"
    SETCOLOR_SUCCESS="echo -en \\033[1;32m"
    SETCOLOR_FAILURE="echo -en \\033[1;31m"
    SETCOLOR_WARNING="echo -en \\033[1;33m"
    SETCOLOR_NORMAL="echo -en \E[0m"
    echo -n "$1" && $MOVE_TO_COL
    echo -n "["
    if [ $2 = "success" -o $2 = "0" ] ;then
        ${SETCOLOR_SUCCESS}
        echo -n $"  OK  "    
    elif [ $2 = "failure" -o $2 = "1"  ] ;then 
        ${SETCOLOR_FAILURE}
        echo -n $"FAILED"
    else
        ${SETCOLOR_WARNING}
        echo -n $"WARNING"
    fi
    ${SETCOLOR_NORMAL}
    echo -n "]"
    echo 
}


install_keepalived () {
    if [ $ID = 'centos' -o $ID = 'rocky' ];then
            yum install -y gcc curl openssl-devel libnl3-devel net-snmp-devel
        elif [ $ID = 'ubuntu' ];then
            apt update
            apt install -y make gcc ipvsadm build-essential pkg-config automake autoconf libipset-dev libnl-3-dev libnl-genl-3-dev libssl-dev libxtables-dev libip4tc-dev libip6tc-dev libipset-dev libmagic-dev libsnmp-dev libglib2.0-dev libpcre2-dev libnftnl-dev libmnl-dev libsystemd-dev
        else
            color "不支持此操作系统，退出!" 1
            exit
        fi
    if [ ! -f  keepalived-${KEEPALIVED_VERSION}.tar.gz ] ;then
            wget https://keepalived.org/software/keepalived-${KEEPALIVED_VERSION}.tar.gz
        fi
    tar xf keepalived-${KEEPALIVED_VERSION}.tar.gz
    cd keepalived-${KEEPALIVED_VERSION}
     ./configure --prefix=${INSTALL_DIR} --disable-fwmark
    make -j $CPUS
    make install
    
    mkdir /etc/keepalived
    
}

start_service () {
        cp ${INSTALL_DIR}/etc/keepalived/keepalived.conf /etc/keepalived
        sed -i 's/vrrp_strict/#vrrp_strict/' /etc/keepalived/keepalived.conf
        systemctl daemon-reload
        systemctl enable --now keepalived.service
        systemctl is-active keepalived.service
        if [ $? -eq 0 ] ;then 
        color "keepalived 安装成功!" 0  
    else 
        color "keepalived 安装失败!" 1
        exit 1
    fi   
}

install_keepalived
start_service

二、配置文件说明

全局配置

sh
#/etc/keepalived/keepalived.conf
global_defs {
 	notification_email {
 	root@localhost #keepalived 发生故障切换时邮件发送的目标邮箱，可以按行区分写
多个
 	root@wangxiaochun.com
  	29308620@qq.com
 }
 	notification_email_from keepalived@localhost  #发邮件的地址
 	smtp_server 127.0.0.1     #邮件服务器地址
 	smtp_connect_timeout 30   #邮件服务器连接timeout
 	router_id ka1.example.com #每个keepalived主机唯一标识，建议使用当前主机名，如果多节点重
名可能会影响切换脚本执行
 	vrrp_skip_check_adv_addr  #对所有通告报文都检查，会比较消耗性能，启用此配置后，如果收到的通告报文和上一个报文是同一个路由器，则跳过检查，默认值为全检查
 	vrrp_strict #严格遵守VRRP协议,启用此项后以下状况将无法启动服务:1.无VIP地址 2.配置了单播邻居 3.在VRRP版本2中有IPv6地址，开启动此项并且没有配置vrrp_iptables时会自动开启iptables防火
墙规则，默认导致VIP无法访问,建议不加此项配置
 	vrrp_garp_interval 0 #gratuitous ARP messages 报文发送延迟，0表示不延迟
 	vrrp_gna_interval 0  #unsolicited NA messages （不请自来）消息发送延迟
 	vrrp_mcast_group4 224.0.0.18 #指定组播IP地址范围：224.0.0.0到239.255.255.255,默认
值：224.0.0.18
	vrrp_iptables        #此项和vrrp_strict同时开启时，则不会添加防火墙规则,如果无配置vrrp

配置虚拟路由器

sh
vrrp_instance <STRING> { #<String>为vrrp的实例名,一般为业务名称配置参数
 ......
 }
#配置参数：
state MASTER|BACKUP#当前节点在此虚拟路由器上的初始状态，状态为MASTER或者BACKUP
interface IFACE_NAME #绑定为当前虚拟路由器使用的物理接口，如：eth0,bond0,br0,可以和VIP不
在一个网卡
virtual_router_id VRID #每个虚拟路由器唯一标识，范围：0-255，每个虚拟路由器此值必须唯一，否则服务无法启动，同属一个虚拟路由器的多个keepalived节点必须相同,务必要确认在同一网络中此值必须唯一
priority 100 #当前物理节点在此虚拟路由器的优先级，范围：1-254，每个keepalived主机节点此值不同,数值越大，优先级越高
advert_int 1 #vrrp通告的时间间隔，默认1s

authentication { #认证机制
 	auth_type AH|PASS   #AH为IPSEC认证(不推荐),PASS为简单密码(建议使用)
 	auth_pass <PASSWORD> #预共享密钥，仅前8位有效，同一个虚拟路由器的多个keepalived节点必
须一样
}
virtual_ipaddress { #虚拟IP,生产环境可能指定上百个IP地址
 <IPADDR>/<MASK> brd <IPADDR> dev <STRING> scope <SCOPE> label <LABEL>
 
 	192.168.200.100 #指定VIP，不指定网卡，默认为eth0,注意：不指定/prefix,默认为/32
 	192.168.200.101/24 dev eth1   #指定VIP的网卡，建议和interface指令指定的网卡不在一个
网卡
 	192.168.200.102/24 dev eth2 label eth2:1 #指定VIP的网卡label
}
track_interface { #配置监控网络接口，一旦出现故障，则转为FAULT状态实现地址转移
 	eth0
 	eth1
 …
} 


#示例
global_defs {
   notification_email {
     acassen@firewall.loc
     failover@firewall.loc
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 192.168.200.1
   smtp_connect_timeout 30
   router_id LVS_DEVEL #######与备机必须不一致############
   vrrp_skip_check_adv_addr
   vrrp_strict #开启限制，会自动生效防火墙设置，导致无访问VIP
   vrrp_garp_interval 0
   vrrp_gna_interval 0
   vrrp_mcast_group4 230.1.1.1 #     ---与备机必须一致，多播地址
}
vrrp_instance VI_1 {
   state MASTER  #########与备机必须不一致###########，备机为BACKUP
   interface eth0
   virtual_router_id 80 #修改此行   ---与备机必须一致，表示在同一个集群中，
   priority 100   ########与备机必须不一致，设抢占模式优先级，数值越大优先级越高##############
   advert_int 1
   authentication {
       auth_type PASS
       auth_pass 1111   #          ---与备机必须一致,通信密码
   }
   virtual_ipaddress {
        192.168.200.16
        192.168.200.17
        192.168.200.18
   }
}


#抓包观察
tcpdump -i eth0 -nn host 230.1.1.1

三、抢占模式和非抢占模式

默认为抢占模式 preempt，即当高优先级的主机恢复在线后，会抢占低先级的主机的master角色，造成网络抖动，建议设置为非抢占模式 nopreempt ，即高优先级主机恢复后，并不会抢占低优先级主机的 master 角色

抢占延迟模式 preempt_delay

抢占延迟模式，即优先级高的主机恢复后，不会立即抢回VIP，而是延迟一段时间（默认300s）再抢回 VIP

注意：需要各keepalived服务器state为BACKUP,并且不要启用 vrrp_strict

sh
preempt_delay #     #指定抢占延迟时间为#s，默认延迟300s

#例
#ka1主机配置
vrrp_instance VI_1 {
 state BACKUP     #都为BACKUP
 interface eth0
 virtual_router_id 66
 priority 100 #优先级高
 advert_int 1
 preempt_delay 60    #抢占延迟模式，默认延迟300s
 
#ka2主机配置
vrrp_instance VI_1 {
 state BACKUP       #都为BACKUP
 interface eth0
 virtual_router_id 66
 priority 80 #优先级低
 advert_int 1

非抢占模式 nopreempt

注意: 非抢占模式下,如果原主机down机, VIP迁移至的新主机, 后续新主机也发生down时,仍会将VIP迁移回原主机

注意：要关闭 VIP抢占，必须将各 Keepalived 服务器 state 配置为 BACKUP

sh
#例：
#ha1主机配置
vrrp_instance VI_1 {
 state BACKUP     #都为BACKUP
 interface eth0
 virtual_router_id 66
 priority 100   #优先级高
 advert_int 1
 nopreempt         #添加此行，设为nopreempt
 
#ha2主机配置
vrrp_instance VI_1 {
 state BACKUP         #都为BACKUP
 interface eth0
 virtual_router_id 66
 priority 80       #优先级低
  advert_int 1
  #nopreempt   #生产中ka2主机是抢占式，不添加此行,否则会导致ka1即使优先级降低，也不会切换至ka2

四、VIP 单播配置

默认keepalived主机之间利用多播相互通告消息，会造成网络拥塞，可以替换成单播，减少网络流量注意：启用 vrrp_strict 时，不能启用单播

sh
#在所有节点vrrp_instance语句块中设置对方主机的IP，建议设置为专用于对应心跳线网络的地址，而非使用业务网络
unicast_src_ip <IPADDR>  #指定发送单播的源IP
unicast_peer {
   <IPADDR>     #指定接收单播的对方目标主机IP
   ......
}

#例：
#master 主机配置
[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
   notification_email {
     acassen@firewall.loc
        failover@firewall.loc
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 192.168.200.1
   smtp_connect_timeout 30
   router_id ka1.wang.org
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}
vrrp_instance VI_1 {
   state MASTER
   interface eth0
   virtual_router_id 66
   priority 100
   advert_int 1
   authentication {
       auth_type PASS
       auth_pass 123456
   }
   virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
   }
   unicast_src_ip 10.0.0.8     #本机IP
   unicast_peer{
   10.0.0.18 #指向对方主机IP
   10.0.0.28 #如果有多个keepalived,再加其它节点的IP
   }
}

[root@ha1-centos8 ~]#hostname -I
10.0.0.8 10.0.0.10 

#slave 主机配置
[root@ka2-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
   notification_email {
     acassen@firewall.loc
     failover@firewall.loc
     sysadmin@firewall.loc
   }
   notification_email_from Alexandre.Cassen@firewall.loc
   smtp_server 192.168.200.1
   smtp_connect_timeout 30
   router_id ka2.wang.org
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}
vrrp_instance VI_1 {
   state SLAVE
   interface eth0
   virtual_router_id 66
   priority 80
   advert_int 1
   authentication {
       auth_type PASS
       auth_pass 123456
   }
   virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
   }
   unicast_src_ip 10.0.0.18       #本机IP
   unicast_peer {
   10.0.0.8 #指向对方主机IP
   }
}
[root@ka2-centos8 ~]#hostname -I
10.0.0.18

五、 Keepalived 通知脚本配置

当keepalived的状态变化时，可以自动触发脚本的执行，比如：发邮件通知用户默认以用户keepalived_script身份执行脚本，如果此用户不存在，以root执行脚本可以用下面指令指定脚本执行用户的身份

通知脚本类型

当前节点成为主节点时触发的脚本


notify_master <STRING>|<QUOTED-STRING>

当前节点转为备节点时触发的脚本


notify_backup <STRING>|<QUOTED-STRING>

当前节点转为“失败”状态时触发的脚本


notify_fault <STRING>|<QUOTED-STRING>

通用格式的通知触发机制，一个脚本可完成以上三种状态的转换时的通知


notify <STRING>|<QUOTED-STRING>

当停止VRRP时触发的脚本


notify_stop <STRING>|<QUOTED-STRING>

脚本的调用方法：在 vrrp_instance VI_1 语句块的末尾加下面行


notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"

脚本，以下脚本支持RHEL和Ubuntu系统

sh
#!/bin/bash
#
#********************************************************************
#Author:           zhangwei
#QQ:               200957079
#Date:             2020-02-31
#FileName:         notify.sh
#URL:               http://www.ztunan.top
#Description:       The test script
#Copyright (C):     2020 All rights reserved
#********************************************************************
contact='root@wangxiaochun.com'
email_send='29308620@qq.com'
email_passwd='dgezyimkdswwbhea'
email_smtp_server='smtp.qq.com'
. /etc/os-release
msg_error() {
  echo -e "\033[1;31m$1\033[0m"
}
msg_info() {
  echo -e "\033[1;32m$1\033[0m"
}
msg_warn() {
  echo -e "\033[1;33m$1\033[0m"
}
color () {
    RES_COL=60
    MOVE_TO_COL="echo -en \\033[${RES_COL}G"
    SETCOLOR_SUCCESS="echo -en \\033[1;32m"
    SETCOLOR_FAILURE="echo -en \\033[1;31m"
    SETCOLOR_WARNING="echo -en \\033[1;33m"
    SETCOLOR_NORMAL="echo -en \E[0m"
    echo -n "$1" && $MOVE_TO_COL
    echo -n "["
    if [ $2 = "success" -o $2 = "0" ] ;then
        ${SETCOLOR_SUCCESS}
        echo -n $" OK "    
    elif [ $2 = "failure" -o $2 = "1" ] ;then
        ${SETCOLOR_FAILURE}
        echo -n $"FAILED"
    else
        ${SETCOLOR_WARNING}
        echo -n $"WARNING"
    fi
    ${SETCOLOR_NORMAL}
    echo -n "]"
    echo
}
install_sendemail () {
    if [[ $ID =~ rhel|centos|rocky ]];then
       rpm -q sendemail &> /dev/null || yum install -y sendemail
    elif [ $ID = 'ubuntu' ];then
       dpkg -l |grep -q sendemail || { apt update; apt install -y libiosocket-ssl-perl libnet-ssleay-perl sendemail ; }
    else
       color "不支持此操作系统，退出!" 1
        exit
    fi
}
send_email () {
   local email_receive="$1"
   local email_subject="$2"
   local email_message="$3"
   sendemail -f $email_send -t $email_receive -u $email_subject -m $email_message -s $email_smtp_server -o message-charset=utf-8 -o tls=yes -xu $email_send -xp $email_passwd
   [ $? -eq 0 ] && color "邮件发送成功!" 0 || color "邮件发送失败!" 1
}
notify() {
    if [[ $1 =~ ^(master|backup|fault)$ ]];then
        mailsubject="$(hostname) to be $1, vip floating"
        mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be $1"
        send_email "$contact" "$mailsubject" "$mailbody"
   else
        echo "Usage: $(basename $0) {master|backup|fault}"
        exit 1
   fi
}
install_sendemail
notify $1

后续操作

sh
[root@ka1 ~]#chmod a+x /etc/keepalived/notify.sh
[root@ka1 ~]#vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
 ......
 virtual_ipaddress {
   10.0.0.10 dev eth0 label eth0:1
 }
 notify_master "/etc/keepalived/notify.sh master"
 notify_backup "/etc/keepalived/notify.sh backup"
 notify_fault "/etc/keepalived/notify.sh fault"
}
#模拟master故障
[root@ka1-centos8 ~]#killall keepalived

六、实现keepalived和lvs的高可用

虚拟服务器配置结构

c
virtual_server IP port {
   ...
 real_server {
 ...
 }
 real_server {
 ...
 }
 …
}

Virtual Server （虚拟服务器）的定义格式

sh
virtual_server IP port     #定义虚拟主机IP地址及其端口
virtual_server fwmark int #ipvs的防火墙打标，实现基于防火墙的负载均衡集群
virtual_server group string #使用虚拟服务器组

虚拟服务器配置

sh
virtual_server IP port {    #VIP和PORT
 delay_loop <INT> 
    #检查后端服务器的时间间隔
 lb_algo rr|wrr|lc|wlc|lblc|sh|dh #定义调度方法
 lb_kind NAT|DR|TUN 
    #集群的类型,注意要大写
 persistence_timeout <INT> 
    #持久连接时长
 protocol TCP|UDP|SCTP 
    #指定服务协议,一般为TCP
 sorry_server <IPADDR> <PORT> 
    #所有RS故障时，备用服务器地址
 real_server <IPADDR> <PORT> {          
    #RS的IP和PORT
 	weight <INT>   #RS权重
 	notify_up <STRING>|<QUOTED-STRING>  
        #RS上线通知脚本
 	notify_down <STRING>|<QUOTED-STRING> 
        #RS下线通知脚本
 	HTTP_GET|SSL_GET|TCP_CHECK|SMTP_CHECK|MISC_CHECK { ... } 
    #定义当前主机健康状态检测方法
 }
}
#注意:括号必须分行写,两个括号写在同一行,如: }} 会出错

实例

nginx
virtual_server 10.0.0.10 80 {
 delay_loop 3
 lb_algo rr
 lb_kind DR
 protocol TCP
 #persistence_timeout 120   #会话保持时间
 sorry_server 127.0.0.1 80
 	real_server 10.0.0.7 80 {
 	weight 1
 		HTTP_GET {
 		url {
 			path /monitor.html
 			status_code 200
 }
 connect_timeout 1
 nb_get_retry 3
 delay_before_retry 1
 }
 }
 	real_server 10.0.0.17 80 {
 weight 1
       HTTP_GET {
 		url {
 			path /
 			status_code 200
 }
 connect_timeout 1
 nb_get_retry 3
 delay_before_retry 1
 }
   }
}

健康性检查、应用层监测

sh
#应用层检测：HTTP_GET|SSL_GET,也可使用tcp监测，但是不如http来的准确
HTTP_GET|SSL_GET {
 url {
   path <URL_PATH> #定义要监控的URL
   status_code <INT> #判断上述检测机制为健康状态的响应码，一般为 200
 }
 connect_timeout <INTEGER> #客户端请求的超时时长, 相当于haproxy的timeout server
 nb_get_retry <INT> #重试次数
 delay_before_retry <INT> #重试之前的延迟时长
 connect_ip <IP ADDRESS> #向当前RS哪个IP地址发起健康状态检测请求
 connect_port <PORT> #向当前RS的哪个PORT发起健康状态检测请求
 bindto <IP ADDRESS> #向当前RS发出健康状态检测请求时使用的源地址
 bind_port <PORT> #向当前RS发出健康状态检测请求时使用的源端口
}

健康性检查、TCP传输层监测

sh
TCP_CHECK {
     connect_ip <IP ADDRESS> #向当前RS的哪个IP地址发起健康状态检测请求
     connect_port <PORT> #向当前RS的哪个PORT发起健康状态检测请求
     bindto <IP ADDRESS> #发出健康状态检测请求时使用的源地址
     bind_port <PORT> #发出健康状态检测请求时使用的源端口
     connect_timeout <INTEGER> #客户端请求的超时时长, 等于haproxy的timeout server  
}

七、实现单主的 LVS-DR 模式

准备web服务器并使用脚本绑定VIP至web服务器lo网卡

sh
#!/bin/bash
#Author:zhangwei
#Date:2020-08-13
vip=10.0.0.10
mask='255.255.255.255'
dev=lo:1
rpm -q httpd &> /dev/null || yum -y install httpd &>/dev/null
service httpd start &> /dev/null && echo "The httpd Server is Ready!"
echo "<h1>`hostname`</h1>" > /var/www/html/index.html
case $1 in
start)
    echo 1 > /proc/sys/net/ipv4/conf/all/arp_ignore
    echo 1 > /proc/sys/net/ipv4/conf/lo/arp_ignore
    echo 2 > /proc/sys/net/ipv4/conf/all/arp_announce
    echo 2 > /proc/sys/net/ipv4/conf/lo/arp_announce
   ifconfig $dev $vip netmask $mask #broadcast $vip up
    #route add -host $vip dev $dev
    echo "The RS Server is Ready!"
   ;;
stop)
   ifconfig $dev down
    echo 0 > /proc/sys/net/ipv4/conf/all/arp_ignore
    echo 0 > /proc/sys/net/ipv4/conf/lo/arp_ignore
    echo 0 > /proc/sys/net/ipv4/conf/all/arp_announce
    echo 0 > /proc/sys/net/ipv4/conf/lo/arp_announce
    echo "The RS Server is Canceled!"
   ;;
*)
    echo "Usage: $(basename $0) start|stop"
    exit 1
   ;;
esac

两台web上执行，bash lvs_dr_rs.sh start

配置keepalived

sh
#ka1节点的配置
[root@ka1-centos8 ~]#cat   /etc/keepalived/keepalived.conf
! Configuration File for keepalived
 global_defs {
 notification_email {
 root@localhost
 }
 notification_email_from keepalived@localhost
 smtp_server 127.0.0.1
 smtp_connect_timeout 30
 router_id ka1.zhang.org
 vrrp_mcast_group4 224.0.100.10
 }
vrrp_instance VI_1 {
 state MASTER
 interface eth0
 virtual_router_id 66
 priority 100
 advert_int 1
 authentication {
 auth_type PASS
 auth_pass 123456
 }
 virtual_ipaddress {
 10.0.0.10/24 dev eth0 label eth0:1
 }
 notify_master "/etc/keepalived/notify.sh master"
 notify_backup "/etc/keepalived/notify.sh backup"
 notify_fault "/etc/keepalived/notify.sh fault"
   }
virtual_server 10.0.0.10 80 {
 delay_loop 3
 lb_algo rr
 lb_kind DR
 protocol TCP
 sorry_server 127.0.0.1 80
 real_server 10.0.0.7 80 {
 weight 1
 HTTP_GET {               #应用层检测
 url {
 path /
 status_code 200
 }
 connect_timeout 1
 nb_get_retry 3
 delay_before_retry 1
 }
 }
 real_server 10.0.0.17 80 {
 weight 1
       TCP_CHECK {              #另一台主机使用TCP检测
       connect_timeout 5
       nb_get_retry 3
       delay_before_retry 3
             connect_port 80
 }
   }
}

#ka2节点的配置，配置和ka1基本相同，只需修改三行
[root@ka2-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
 global_defs {
 notification_email {
 root@localhost
 }
 notification_email_from keepalived@localhost
 smtp_server 127.0.0.1
 smtp_connect_timeout 30
 router_id ka2.zhang.org             #修改此行
 vrrp_mcast_group4 224.0.100.10
 }
vrrp_instance VI_1 {
 state BACKUP #修改此行
 interface eth0
 virtual_router_id 66
 priority 80 #修改此行
 advert_int 1
 authentication {
 auth_type PASS
 auth_pass 123456
 }
 virtual_ipaddress {
 10.0.0.10/24 dev eth0 label eth0:1
 }
 notify_master "/etc/keepalived/notify.sh master"
 notify_backup "/etc/keepalived/notify.sh backup"
 notify_fault "/etc/keepalived/notify.sh fault"
   }
virtual_server 10.0.0.10 80 {
	delay_loop 3
 lb_algo rr
 lb_kind DR
 protocol TCP
 sorry_server 127.0.0.1 80
 real_server 10.0.0.7 80 {
 weight 1
 HTTP_GET {
 url {
 path /
 status_code 200
 }
 connect_timeout 1
 nb_get_retry 3
 delay_before_retry 1
 }
 }
 real_server 10.0.0.17 80 {
 weight 1
       TCP_CHECK {
       connect_timeout 5
       nb_get_retry 3
       delay_before_retry 3
             connect_port 80
 }
   }
}

访问测试结果

c
#第一台RS1故障，自动切换至RS2
[root@rs1 ~]#chmod 0 /var/www/html/index.html
[root@centos6 ~]#curl 10.0.0.10
<h1>rs2.zhang.org</h1>
[root@centos6 ~]#curl 10.0.0.10
<h1>rs2.zhang.org</h1>
[root@ka1-centos8 ~]#dnf -y install ipvsadm
[root@ka1-centos8 ~]#ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.0.0.10:80 rr
  -> 10.0.0.17:80                 Route   1      0          3

后端RS服务器都故障，启动Sorry Server

sh
[root@rs2 ~]#systemctl stop httpd
[root@centos6 ~]#curl 10.0.0.10
Sorry Server on ka1
[root@ka1-centos8 ~]#ipvsadm -Ln
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
  -> RemoteAddress:Port           Forward Weight ActiveConn InActConn
TCP  10.0.0.10:80 rr
  -> 127.0.0.1:80                 Route   1      0          0  
#ka1故障，自动切换至ka2
[root@ka1-centos8 ~]#killall keepalived
[root@centos6 ~]#curl 10.0.0.10
Sorry Server on ka2
#恢复都有后端 RS
[root@rs1 ~]#chmod 644 /var/www/html/index.html
[root@rs2 ~]#systemctl start httpd
[root@centos6 ~]#curl 10.0.0.10
<h1>rs1.zhang.org</h1>
[root@centos6 ~]#curl 10.0.0.10
<h1>rs2.zhang.org</h1>
[root@ka1-centos8 ~]#hostname -I
10.0.0.8
[root@ka2-centos8 ~]#hostname -I
10.0.0.18 10.0.0.10
#恢复ka1服务器，又抢占回原来的VIP
[root@ka1-centos8 ~]#systemctl start keepalived.service
[root@ka1-centos8 ~]#hostname -I
10.0.0.8 10.0.0.10
[root@ka2-centos8 ~]#hostname -I
10.0.0.18
[root@centos6 ~]#curl 10.0.0.10
<h1>rs1.zhang.org</h1>
[root@centos6 ~]#curl 10.0.0.10
<h1>rs2.zhang.org</h1>

八、实现keepalived+haproxy高可用nginx

VRRP script

vrrp_script：自定义资源监控脚本，vrrp实例根据脚本返回值，公共定义，可被多个实例调用，定义在vrrp实例之外的独立配置块，一般放在global_defs设置块之后,是和global_defs平级的语句块通常此脚本用于监控指定应用的状态。一旦发现应用的状态异常，则触发对MASTER节点的权重减至低于SLAVE节点，从而实现VIP切换到SLAVE 节点

当 keepalived_script 用户存在时,会以此用户身份运行脚本,否则默认以root运行脚本注意: 此定义脚本的语句块一定要放在下面调用此语句vrrp_instance语句块的前面

sh
#定义脚本
vrrp_script <SCRIPT_NAME> {
 script <STRING>|<QUOTED-STRING>   #此脚本返回值为非0时，会触发下面OPTIONS执行
 OPTIONS
}
#调用脚本，track_script：调用vrrp_script定义的脚本去监控资源，定义在VRRP实例之内，调用事先定义的vrrp_script

track_script {
 SCRIPT_NAME_1
 SCRIPT_NAME_2
}

定义 VRRP script

c
vrrp_script <SCRIPT_NAME> { #定义一个检测脚本，在global_defs 之外配置
     script <STRING>|<QUOTED-STRING> #shell命令或脚本路径
     interval <INTEGER> #间隔时间，单位为秒，默认1秒
     timeout <INTEGER> #超时时间
     weight <INTEGER:-254..254> #默认为0,如果设置此值为负数，当上面脚本返回值为非0时，会将此值与本节点权重相加可以降低本节点权重，即表示fall. 如果是正数，当脚本返回值为0，会将此值与本节点权重相加可以提高本节点权重，即表示 rise.通常使用负值
     fall <INTEGER>       #执行脚本连续几次都失败,则转换为失败，建议设为2以上
     rise <INTEGER>       #执行脚本连续几次都成功，把服务器从失败标记为成功
     user USERNAME [GROUPNAME] #执行监测脚本的用户或组      
     init_fail         #设置默认标记为失败状态，监测成功之后再转换为成功状态
}

ka+ha实现nginx高可用，也可用于mysql等服务,且用于mysql双主后不会出现两个数据库同时写入问题，用户访问只能根据VIP同时访问一个数据库

c
nginx1:10.0.0.135
nginx2:10.0.0.139
ka+ha1:10.0.0.138
ka+ha2:10.0.0.130

#ka1的global不用管
ka1的keepalived配置：
cat /etc/keepalived/conf.d/haproxy.conf
vrrp_script check_haproxy {
   script "/etc/keepalived/conf.d/check_haproxy.sh"
   interval 1
   weight -30
   fall 3
   rise 2
   timeout 2
}

vrrp_instance VI_1 {
 state MASTER
 interface eth0
 virtual_router_id 66
 priority 100
 advert_int 1
 authentication {
 auth_type PASS
 auth_pass 123456
 }
 virtual_ipaddress {
 10.0.0.250 dev eth0 label eth0:1
 }
 track_interface {
 eth0
 }
 #notify_master "/etc/keepalived/notify.sh master"
 #notify_backup "/etc/keepalived/notify.sh backup"
 #notify_fault "/etc/keepalived/notify.sh fault"
 track_script {
         check_haproxy 
 }
}

ka1的haproxy配置：
cat /etc/haproxy.cfg
listen nginx
    bind 10.0.0.250:80                                                                                                      
    mode tcp 
    server web1 10.0.0.135:80 check
    server web2 10.0.0.139:80 check
    
ka2的keepalived配置：
cat haproxy.conf 
vrrp_script check_haproxy {
   script "/etc/keepalived/conf.d/check_haproxy.sh"
   interval 1
   weight -30
   fall 3
   rise 2
   timeout 2
}

vrrp_instance VI_1 {
 state BACKUP
 interface eth0
 virtual_router_id 66
 priority 80
 advert_int 1
 authentication {
 auth_type PASS
 auth_pass 123456
 }
 virtual_ipaddress {
 10.0.0.250 dev eth0 label eth0:1
 }
 track_interface {
 eth0
 }
 #notify_master "/etc/keepalived/notify.sh master"
 #notify_backup "/etc/keepalived/notify.sh backup"
 #notify_fault "/etc/keepalived/notify.sh fault"
track_script {
 check_haproxy
 }
}

ka2的haproxy配置和ka1的haproxy一致。
check_haproxy.sh脚本也一致
#!/bin/bash
killall -0 haproxy || systemctl restart haproxy 
#实现haproxy故障自愈，killall -0 haproxy对服务发出检测信号，如果为真则退出，为假则重启haproxy服务，最后script检查脚本最后执行结果，为真则不做操作，为假则VIP漂移到ka2上继续提供服务。

######注意#######
1、脚本需给执行权限，
2、内核参数修改net.ipv4.ip_nonlocal_bind = 1 ；sysctl -p默认haproxy上没有VIP无法绑定地址加端口，修改后即可绑定上VIP
3、yum install psmisc -y 安装
功能：
	fuser 显示使用指定文件或者文件系统的进程的PID。
	killall 杀死某个名字的进程，它向运行指定命令的所有进程发出信号。
	pstree 树型显示当前运行的进程。

目录