Keepalived部署

Keepalived软件起初是专为LVS负载均衡软件设计的，用来管理并监控LVS集群系统中各个服务节点的状态，后来又加入了可以实现高可用的VRRP功能。因此，Keepalived除了能够管理LVS软件外，还可以作为其他服务（例如：Nginx、Haproxy、MySQL等）的高可用解决方案软件。

Keepalived软件主要是通过VRRP协议实现高可用功能的。VRRP是Virtual Router RedundancyProtocol(虚拟路由器冗余协议）的缩写，VRRP出现的目的就是为了解决静态路由单点故障问题的，它能够保证当个别节点宕机时，整个网络可以不间断地运行。

Keepalived高可用服务对之间的故障切换转移，是通过 VRRP (Virtual Router Redundancy Protocol ,虚拟路由器冗余协议）来实现的。

在 Keepalived服务正常工作时，主 Master节点会不断地向备节点发送（多播的方式）心跳消息，用以告诉备Backup节点自己还活看，当主 Master节点发生故障时，就无法发送心跳消息，备节点也就因此无法继续检测到来自主 Master节点的心跳了，于是调用自身的接管程序，接管主Master节点的 IP资源及服务。而当主 Master节点恢复时，备Backup节点又会释放主节点故障时自身接管的IP资源及服务，恢复到原来的备用角色。

那么，什么是VRRP呢？

VRRP ,全称 Virtual Router Redundancy Protocol ,中文名为虚拟路由冗余协议，VRRP的出现就是为了解决静态踣甶的单点故障问题，VRRP是通过一种竞选机制来将路由的任务交给某台VRRP路由器的。

1.安装Keepalived

[admin@xfyun-bj-msp1 ~]$ wget http://www.keepalived.org/software/keepalived-1.2.19.tar.gz
[admin@xfyun-bj-msp1 ~]$ tar -zxvf keepalived-1.2.19.tar.gz
[admin@xfyun-bj-msp1 ~]$ sudo yum install -y openssl openssl-devel
[admin@xfyun-bj-msp1 ~]$ ./configure --prefix=/work/admin/keepalived
[admin@xfyun-bj-msp1 ~]$ make
[admin@xfyun-bj-msp1 ~]$ make install

2.配置主机(使用单播方式通信)

[admin@xfyun-bj-msp1 ~]$ vim /work/admin/keepalived/etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
   notification_email {
      zzchen3@iflytek.com
   }
   notification_email_from zzchen3@iflytek.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id AGENT
   vrrp_skip_check_adv_addr
   #vrrp_strict
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

vrrp_script chk_haproxy {
   script "nc -w 0 0.0.0.0 8309"
   interval 3
   weight -20
   fall 3
   rise 2
}

vrrp_instance VI_92 {
    state MASTER
    interface eth0
    unicast_src_ip 172.22.123.92
    unicast_peer {
                   172.22.123.96
                 }
    virtual_router_id 99
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }

virtual_ipaddress {
    172.22.123.107 dev eth0
}

track_script {
    chk_haproxy
    }

}

3.配置备机

[admin@xfyun-bj-msp2 ~]$ vim /work/admin/keepalived/etc/keepalived/keepalived.conf

! Configuration File for keepalived

global_defs {
   notification_email {
      zzchen3@iflytek.com
   }
   notification_email_from zzchen3@iflytek.com
   smtp_server 127.0.0.1
   smtp_connect_timeout 30
   router_id AGENT
   vrrp_skip_check_adv_addr
   vrrp_garp_interval 0
   vrrp_gna_interval 0
}

vrrp_script chk_haproxy {
   script "nc -w 0 0.0.0.0 8309"
   interval 3
   weight -20 
   fall 3
   rise 2
}

vrrp_instance VI_96 {
    state BACKUP
    interface eth0
    unicast_src_ip 172.22.123.96
    unicast_peer {
                   172.22.123.92
                 }
    virtual_router_id 99
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }

    virtual_ipaddress {
        172.22.123.107 dev eth0
    }

track_script {
    chk_haproxy
    }

}

4.防火墙开放vrrp协议

1 2	vim /etc/sysconfig/iptables 新增一行：-A INPUT -p vrrp -j ACCEPT

保存后，重启iptables

5.启动服务

1	[admin@xfyun-bj-msp1 ~]$ sudo /work/admin/keepalived/sbin/keepalived -f /work/admin/keepalived/etc/keepalived/keepalived.conf

6.配置开机启动

[admin@xfyun-bj-msp1 ~]$ sudo vim /lib/systemd/system/keepalived.service
[Unit]
Description=Keepalived
After=syslog.target network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
PIDFile=/var/run/keepalived.pid
#ExecStart=/work/admin/keepalived/sbin/keepalived -D
ExecStart=/work/admin/keepalived/sbin/keepalived -f /work/admin/keepalived/etc/keepalived/keepalived.conf
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s QUIT $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

[admin@xfyun-bj-msp1 ~]$ sudo systemctl enable keepalived
[admin@xfyun-bj-msp1 ~]$ systemctl is-enabled keepalived

7.注意事项

7.1 nc命令支持

这里使用nc 命令去检测haproxy端口是否存活，从而决定vip飘移与否；

如果没有nc命令，执行下yum安装nmap-ncat

1	yum -y install nmap-ncat

7.2 在sdn网络上配置好keepalived后，跨网段不通：

在vip所在虚拟机上执行如下命令（其中mac为master的mac地址）
node1上执行

1	[admin@xfyun-bj-msp1 ~]$ curl "http://169.254.169.254/latest/meta-data/vip-takeover?vip=172.22.123.107&mac=d0:0d:0e:4a:d2:1a"

node2上执行

1	[admin@xfyun-bj-msp2 ~]$ curl "http://169.254.169.254/latest/meta-data/vip-takeover?vip=172.22.123.107&mac=d0:0d:d8:2a:8d:0d"

执行上面命令网络是通了，但vip飘移后又要重新执行一次，为此我们使用keepalived的notify_master功能
加入notify_master配置：

virtual_ipaddress {
    172.22.123.107 dev eth0
}
  notify_master "/work/admin/keepalived/notify.py"

意思是当该keepalived成为master时执行后面的脚本，然后将上面命令写入该脚本，最后别忘了添加执行权限

[admin@xfyun-bj-msp1 ~]$ vim /work/admin/keepalived/notify.py
#!/usr/bin/env python

-- coding: utf-8 --

import os

os.system('curl "http://169.254.169.254/latest/meta-data/vip-takeover?vip=172.22.123.107&mac=d0:0d:d8:2a:8d:0d"')

[admin@xfyun-bj-msp1 ~]$ chmod +x /work/admin/keepalived/notify.py