1 KEEPALIVED %H Keepalived: The Definitive Guide öµ FinalBSD(Kevin Kuang) ooÊcn www.sanotes.net 3 Kevin Kuang Pk c 2009 ±9Ö¤ku1"3¤k|" ù°©´¤¶3gd^|
Ù GNU Ï^ÑNy^±e§ \±2½ö?U§"Ny±´1§½ö?ÛU£\¿¤" 8¹ 1 VRRP 1 1.1 VRRPÆ{0 .......................... 1 1.2 óÅ ............................. 2 2 KEEPALIVED 3 2.1 KeepalivedOÚ¢y ..................... 3 2.1.1 õ?§ª ........................ 4 2.1.2 ¡ ......................... 4 2.1.3 WatchDog ......................... 4 2.1.4 IPVSµC......................... 4 2.2 KeepAlivedSC........................ 5 2.3 KeepAlived)....................... 6 2.3.1 Û ......................... 7 2.3.2 VRRPD ....................... 8 2.3.3 LVS .......................... 11 3 A^¢~ 15 3.1 ^KeepalivedHA ........................ 15 3.1.1 HAProxyÚwebÑÖì ............... 15 3.1.2 Keepalived ...................... 15 3.2 ^KeepalivedLVS ...................... 19 ë©z 21 1Ù VRRP Keepalived´VRRP{¢y§Ïd30Keepalivedc§·k7 k )VRRPn" )VRRPЩ#LuVRRPRFC©1" 1.1 VRRPÆ{0 3y¢ä¸¥('XInternet)§üIÏ&ÌÅ(end-host) õê¹e¿vkÔnë"éuù¹§§m´dN oÀJºÌÅXÛÀ½8ÌÅea´d§ù´¯K"Ï~ )û{kü«µ • 3ÌÅþ¦^Ä´dÆ('XRIP,OSPF) • 3ÌÅþ·´d é²w§3ÌÅþÄ´dÆ´~Ø¢S§Ï+n! o¤±9´Ä|±Ãõ¯K"@o·´dÒC©6 1"¢Sþ§ù«ª·83^"´§´dì(½ö`%@ 'default gateway)%²~¤ü:"Ò õ·´d§%Ï7 LéäâU) CØ¢^" VRRP8Ò´ )û·´dü:æ¯K VRRPÏL«¿À(election)Æ5Äò´d?ÖLAN¥J [´dì¥,VRRP´dì"ùpwå5é7§Ïkü'
¶ c:J[´dìÚVRRP´dì" VRRP´dì VRRP´dìÒ´´dì§ØLþ¡$1 VRRPDù§S 5¢yVRRPÆ ®§ù´Ôn´dì"VRRP´dì± uõ J[´dì" 1´RFC 3768 Ø´2338§XJ\U§Òw2338j 2 VRRP VRRPJ[´dì ¤¢J[§Ò´`¿Ø´¢S3§´Ü6 Ø´Ôn´d ì"J[´dìÏ~dõ(Ôn)VRRP´dìÏL,«ª|¤§ÒÐ 'ù Ôn´dìÑ¿³(pool)p¡§poolé wå5Ò ´´dì§Ù¢SÜkõ"J[´dìI£¡VRID" MASTERÚBACKUP 3VRRPJ[´d쥧kõÔnVRRP´dì§´ùõ ÔnÅì¿ØÓó2§ ´d¡MASTERKI´dó§Ù ¦Ñ´BACKUP§MASTER¿¤ØC§VRRPÆ4zVRRP´ dìë¿À§ª¼Ò´MASTER"MASTERk A3§'X PkJ[´dìIP/§·ÌÅÒ´^ùIP/·´d "PkAMASTERKI=uux'/ÚAARP ¦" 1.2 óÅ VRRPÏL¿ÀÆ5¢yJ[´dìõU§¤kƩѴ ÏLIPõÂ(multicast)£õÂ/224.0.0.18¤/ªux"J[´dì dVRID(0–255)Ú|IP/|¤§é Ly±MAC/ µ00-00-5E-00-01-{VRID} 4"¤±§3J[´d쥧Ø+X ´MASTER§é Ñ´ÓMACÚIP(¡VIP)"ràÌÅ¿Ø IÏMASTERUC ?UgC´d§é¦5`§ù«Ìl ´ß²" 3J[´d쥧kMASTERVRRP´dì¬u xVRRP2w(VRRP Advertisement message)§BACKUPجsÓMASTER§ ا`k?(priority)p"MASTERØ^£BACKUPÂØ2 w¤§õBACKUP¥`k?pù¬sÓMASTER"5"ù «sÓ´~¯(<1s)§±yÑÖëY5" ÑuS5ħVRRP¦^ \Æ?1\" 2¦+ùwå5éL¤ 3Po´kA 4ùÒ´o¡virtual router idoU´0. . . 255 5ù`² oIstate§kIpriorityù 1Ù KEEPALIVED KeepalivedOÚ¢y,{ü§´kاÙÌÒ ãù " 2.1 KeepalivedOÚ¢y Keepalived´pݬzO^§ è(qéN´ wÑù:§p¡k check core libipfwc libipvs-2.4 libipvs-2.6 vrrp ùo 8¹" 4 KEEPALIVED core keepalivedØ%§S§'XÛ)Û§?§éĶ vrrp Keepalivedvrrpdf?§±9'è" check keepalivedhealthcheckerf?§8¹§) ¤kèxu ª±9éA)Û§LVS)Û3ùp¡ libipfwc iptables(ipchains)¥§Ì^5LVS¥firewall-mark" libipvs* ´¦^LVSI^" 2.1.1 õ?§ª keepalivedæ^ õ?§Oª§z?§KIØÓõU§· 3¦^LVSÅìþÏ~±wù?§µ 111 Keepalived < I?§:S+n§if?§ 112 \_ Keepalived < VRRPf?§ 113 \_ Keepalived < healthcheckerf?§ k ·-1ëê5Ømé, ?§§'XØ$1LVSÅìþ§m éVRRPÒ± (–P), XJ$1healthcheckerf?§,¦^–C" 2.1.2 ¡ ¤¢¡Ò´é©?ÈÚ)Û§Keepalived© )Û',a§¿Ø´gÚÚ)Û¤k§3^,¬ ÿâ)ÛA§3z¬p¡Ñ±wXXX parser.cù© §Ò´ù^" 2.1.3 WatchDog ù«µeJø éf?§(VRRPÚhealthchecker)i. 2.1.4 IPVSµC Keepalivedp¡¤kéLVS'ö¿Ø¦^ipvsadmù ^rà§S§ ´¦^IPVSJø¼ê?§ö§ù èÑ 3check/ipwrapper.c¥" 2.2 KeepAlivedSC 5 2.2 KeepAlivedSC SCKeepalivedÚSCÙ¦m ^§~{ü§configure§make§make installÒ±t½§´·´I{ü`²eùöL§µ ./configure --prefix=/ \ --mandir=/usr/local/share/man \ --with-kernel-dir=/usr/src/kernels/2.6.9-67.EL-smp-i686/ make make install `²Xeµ 1. prefix ù½/j§ù©¬8¹e§Bö" 2. mandir ùLinuxXÚ%@man8¹e§Bw" 3. with-kernel-dir ù´ëê§ùëê¿ØL«·r :XJ^LVS§âIù ½§ÄK´ØI§
XJ¦ ^netlink§Ilink watch.cù © Keepalived??Sا ´¦^SØ èp¡Þ©§Ò ´include8¹" 3confiure(1§±e¡Ñѵ Keepalived configuration ------------------------ Keepalived version : 1.1.15 Compiler : gcc Compiler flags : -g -O2 Extra Lib : -lpopt -lssl -lcrypto Use IPVS Framework : Yes IPVS sync daemon support : Yes Use VRRP Framework : Yes Use LinkWatch : Yes Use Debug flags : No 5¿ Use IPVS Framework IPVSµe—=LVSØ%èµe§XJØ ¦^LVS§±3configure½ëêdisable-lvs§ù{§ùpw Ò´No Ø´Yes" 6 KEEPALIVED IPVS sync daemon support IPVSÓÚ?§§éw,§XJc¡@ ´No{§@oùp½´No§,XJc¡ù´Yes–=¦ ^LVS§ ئ^LVSÓÚ?§(sync daemon), ±3configure ÿ½disable-lvs-syncd" Use VRRP Framework VRRPµe§ùÄþ´7L§Keepalived Ø%?§vrrpd" Use LinkWatch ¤¢LinkwatchV¿g´ÏLÂSØuÑ'u kG&E5äkG§Ï´SØuÑ&E§ù3^ ràIÓPù &E=§'3^ràÏLÙ¦ª5 ¢ywå5¬] §Keepalived3kL20¬¹eí¦ ^"1 { ó§XJئ^LVSõU§@owUse VRRP Frame- workYesÒ±§§7LkUse IPVS FrameworkYes§Ù¦Ñ ´optional" SCÄÒùo{ü§´\Uk¦¯§.3=pe1Keepalivedº Keepalived(ejµwww.keepalived.org 2.3 KeepAlived) Keepalived¤kÑ3©p¡§|±' õ"©naµ 1. Û(Global Configuration) 2. VRRPD 3. LVS é²w§ÛÒ´ékeepalivedå§Ø+´Ä¦ ^LVS"VRRPD´keepalivedØ%§LVS3¦^keepalived5 Ú+nLVSI¦^§XJ=¦^keepalived5HA2§LVS ´ØI" ©Ñ´±¬(block)/ª|§z¬Ñ3{Ú} S"#Ú!mÞ1Ñ´5º" 1I link watch.cù © § d © 3LinuxSØ è ¥ § ´ » a q/usr/src/kernels/2.6.9-67.EL-smp-i686/net/core/ link watch.c 2'X`éHAProxyHA½öÙ¦aqHA 2.3 KeepAlived) 7 2.3.1 Û Û)üf§=¤¢µÛ½Â(global definition)Ú· /´d(static ipaddress/routes) ۽ ۽ÂÌkeepalivedÏÅÚI£µ global_defs { notification_email { admin@example.com } notification_email_from admin@example.com smtp_server 127.0.0.1 stmp_connect_timeout 30 router_id my_hostname } • notification email½keepalived3u)¯('X)§Iu xemailé§±kõ§z1" • smtp *½uxemailsmtpÑÖì§XJ/mé sendmail{§ ±¦^þ¡%@" • route id$1keepalivedÅìI£" ·/Ú´d ¤¢·(static)Ò´`جvrrpd instancem/' Cz§VIPÒ Ø´static§¬Xvrrpd V\/íØ"ù±^5ÑÖì ·IP//´d§,XJÑÖìp¡®²kù §ùpÒ ØI " static_ipaddress { 192.168.1.1/24 brd + dev eth0 scope global 8 KEEPALIVED ... } static_routes { src $SRC_IP to $DST_IP dev $SRC_DEVICE ... src $SRC_IP to $DST_IP via $GW dev $SRC_DEVICE } z1IP§ù Ñ´Linuxeipù·-ëê§'Xþ ¡192.168.1.1/24 brd + dev eth0 scope global§keepalivedª¬ ¦^ip addr add 192.168.1.1/24 brd + dev eth0 scope global5V\§¤ ±ùpÑÎÜip·-5K" ùÒ´ÛãÜ" 2.3.2 VRRPD VRRPD)2Ü©:VRRPÓÚ|(synchroization group)ÚVRRP¢ ~(VRRP Instance)" VRRP Sync Groups(s) ئ^Sync Group{,XJÅì(½ö`router)küã§ S ,zãméVRRP¢~§bVRRPuS §@o Ñy¯K§VRRPD@gCE,èx§@oجu xMasterÚBackup§l ¯K"Sync groupÒ´ )ûù ¯K§±rü¢~Ñ?Sync Group§ù{§groupp¡? Û¢~Ñy¯KѬu)" vrrp_sync_group VG_1 { group { inside_network # ùp´¢~¶('XVI_1) outside_network , } notify_master /path/to/to_master.sh notify_backup /path_to/to_backup.sh notify_fault "/path/fault.sh VG_1" 2.3 KeepAlived) 9 notify /path/to/notify.sh smtp_alert } • notify master ½Master§1§ù±D \ëê(ÚÒÚå)§Ù¦2aí" • notify-k3ëê§ù ëêdkeepalivedJøµ$1(GROUP—INSTANCE),$2(group½ öinstance¶i),$3(MASTER—BACKUP—FAULT) • smtp alter ¦^global defsp¡½Âe/ÚsmtpÑÖì3 uxeÏ" VRRP¢~(instance) VRRP¢~ÒL«3þ¡mé VRRPƧù¢~`² VRRP A5§'XÌl!VRID§±3zinterfaceþmé¢ ~"VRRP¢~̽Âvrrp sync groupp¡z|¤£IP" vrrp_instance inside_network { state MASTER interface eth0 dont_track_primary track_interface { eth0 eth1 } mcast_src_ip garp_master_delay 10 virtual_router_id 51 priority 100 advert_int 1 authentication { auth_type PASS autp_pass 1234 10 KEEPALIVED } virtual_ipaddress { #/ brd dev scope label