2.6 KeepAlived 配置说明
2.6.1 配置文件组成部分
/etc/keepalived/keepalived.conf配置组成
- GLOBAL CONFIGURATION
Global definitions：定义邮件配置，route_id，vrrp配置，多播地址等 - VRRP CONFIGURATION
VRRP instance(s)：定义每个vrrp虚拟路由器 - LVS CONFIGURATION
Virtual server group(s)
Virtual server(s)：LVS集群的VS和RS
2.6.2 配置语法说明
帮助
[root@centos8 ~]# man keepalived.conf2.6.2.1 全局配置
# /etc/keepalived/keepalived.conf
global_defs {
notification_email {
acassen@firewall.loc # keepalived 发生故障切换时邮件发送的目标邮箱，可以按行区分写多个
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc # 发邮件的地址
smtp_server 192.168.200.1 # 邮件服务器地址
smtp_connect_timeout 30 # 邮件服务器连接timeout
router_id LVS_DEVEL # 每个keepalived主机唯一标识，建议使用当前主机名，但多节点重名不影响
vrrp_skip_check_adv_addr # 对所有通告报文都检查，会比较消耗性能，启用此配置后，如果收到的通告报文和上一个报文是同一个路由器，则跳过检查，默认值为全检查
vrrp_strict # 严格遵守VRRP协议,启用此项后以下状况将无法启动服务:1.无VIP地址2.配置了单播邻居 3.在VRRP版本2中有IPv6地址，开启此项并且没有配置vrrp_iptables时会自动开启iptables防火墙规则，默认导致VIP无法访问,建议不加此项配置
vrrp_garp_interval 0 # gratuitous ARP messages 报文发送延迟，0表示不延迟
vrrp_gna_interval 0 # unsolicited NA messages（不请自来）消息发送延迟
vrrp_mcast_group4 224.0.0.18 # 指定组播IP地址范围: 224.0.0.0到239.255.255.255,默认值: 224.0.0.18
vrrp_iptables # 此项和vrrp_strict同时开启时，则不会添加防火墙规则,如果无配置vrrp_strict项,则无需启用此项配置
}2.6.2.2 配置虚拟路由器
vrrp_instance VI_1 { # VI_1为vrrp的实例名，一般为业务名称
state MASTER|BACKUP # 当前节点在此虚拟路由器上的初始状态，状态为MASTER或者BACKUP
interface eth0 # 绑定为当前虚拟路由器使用的物理接口，如: eth0,bond0,br0，可以和VIP不在一个网卡
virtual_router_id 51 # 每个虚拟路由器唯一标识，范围:0-255，每个虚拟路由器此值必须唯一，否则服务无法启动，同属一个虚拟路由器的多个keepalived节点必须相同,务必要确认在同一网络中此值必须唯一
priority 100 # 当前物理节点在此虚拟路由器的优先级，范围:1-254，每个keepalived主机节点此值不同
advert_int 1 # vrrp通告的时间间隔，默认1s
authentication { # 认证机制
auth_type PASS # AH为IPSEC认证(不推荐), PASS为简单密码(建议使用)
auth_pass 1111 # 预共享密钥，仅前8位有效，同一个虚拟路由器的多个keepalived节点必须一样
}
virtual_ipaddress { # 虚拟IP,生产环境可能指定上百个IP地址
<IPADDR>/<MASK> brd <IPADDR> dev <STRING> scope <SCOPE> label <LABEL>
192.168.200.16 # 指定VIP，不指定网卡，默认为eth0,注意:不指定/prefix,默认为/32
192.168.200.17/24 dev eth1 # 指定VIP的网卡，建议和interface指令指定的网卡不在一个网卡上
192.168.200.18/24 dev eth2 label eth2:1 # 指定VIP的网卡label
}
track_interface { # 配置监控网络接口，一旦出现故障，则转为FAULT状态实现地址转移
eth0
eth1
...
}
}范例：
[root@centos8 ~]# vim /etc/keepalived/keepalived.conf
[root@centos8 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
notification_email {
acassen@firewall.loc
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc
smtp_server 192.168.200.1
smtp_connect_timeout 30
router_id LVS_DEVEL
vrrp_skip_check_adv_addr
vrrp_strict # 开启限制，会自动生成防火墙设置，导致无法访问VIP
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 80 # 修改此行
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.200.16
192.168.200.17
192.168.200.18
}
}
[root@centos8 ~]# systemctl restart keepalived.service
[root@centos8 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:0c:29:19:bf:73 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.8/24 brd 10.0.0.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet 192.168.200.16/32 scope global eth0
valid_lft forever preferred_lft forever
inet 192.168.200.17/32 scope global eth0
valid_lft forever preferred_lft forever
inet 192.168.200.18/32 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fe19:bf73/64 scope link
valid_lft forever preferred_lft forever
# 以下为2.0.20版本，会自动生成防火墙策略，导致无法访问VIP。2.1.2和2.2.2版本有bug，不会生成防火墙策略
[root@centos7 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 158 packets, 12796 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 192.168.200.18
0 0 DROP all -- * * 0.0.0.0/0 192.168.200.17
0 0 DROP all -- * * 0.0.0.0/0 192.168.200.16
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 155 packets, 15732 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 192.168.200.18 0.0.0.0/0
0 0 DROP all -- * * 192.168.200.17 0.0.0.0/0
4 336 DROP all -- * * 192.168.200.16 0.0.0.0/0
[root@centos7 ~]# ping 192.168.200.16
PING 192.168.200.16 (192.168.200.16) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 192.168.200.16 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3013ms
[root@centos7 ~]# 2.6.2.3 启用keepalived日志功能
[root@centos8 ~]# vim /etc/sysconfig/keepalived
KEEPALIVED_OPTIONS="-D -S 6" # 在此行添加-S参数
# 用为6没有使用，需要去定义
[root@centos8 ~]# vim /etc/rsyslog.conf
local6.* /var/log/keepalived.log
[root@centos8 ~]# systemctl restart keepalived.service rsyslog.service
# centos8的2.1.2版本有问题 不能生成日志
# 下面用centos7的2.0.20版本演示
[root@centos7 ~]# vim /usr/local/keepalived/etc/sysconfig/keepalived
KEEPALIVED_OPTIONS="-D -S 6"
[root@centos7 ~]# vim /etc/rsyslog.conf
local6.* /var/log/keepalived.log
[root@centos7 ~]# systemctl restart rsyslog.service keepalived.service
[root@centos7 ~]# tail -f /var/log/keepalived.log
Aug 16 20:13:39 centos7 Keepalived_vrrp[11646]: Sending gratuitous ARP on eth0 for 192.168.200.18
Aug 16 20:13:39 centos7 Keepalived_vrrp[11646]: Sending gratuitous ARP on eth0 for 192.168.200.16
Aug 16 20:13:39 centos7 Keepalived_vrrp[11646]: Sending gratuitous ARP on eth0 for 192.168.200.17
Aug 16 20:13:39 centos7 Keepalived_vrrp[11646]: Sending gratuitous ARP on eth0 for 192.168.200.18
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: HTTP_CHECK on service [192.168.200.2]:tcp:1358 failed after 3 retry.
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: Removing service [192.168.200.2]:tcp:1358 to VS [10.10.10.2]:tcp:1358
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: Lost quorum 1-0=1 > 0 for VS [10.10.10.2]:tcp:1358
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: Adding sorry server [192.168.200.200]:tcp:1358 to VS [10.10.10.2]:tcp:1358
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: Removing alive servers from the pool for VS [10.10.10.2]:tcp:1358
Aug 16 20:13:39 centos7 Keepalived_healthcheckers[11645]: Remote SMTP server [192.168.200.1]:25 connected.
2.6.2.4 实现独立子配置文件
当生产环境复杂时，/etc/keepalived/keepalived.conf文件中内容过多，不易管理，可以将不同集群的配置，比如：不同集群的VIP配置放在独立的子配置文件中
利用include指令可以实现包含子配置文件
格式：
include /path/file例：
[root@centos8 ~]# mkdir /etc/keepalived/conf.d
[root@centos8 ~]# vim /etc/keepalived/keepalived.conf
[root@centos8 ~]# cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
notification_email {
acassen@firewall.loc
failover@firewall.loc
sysadmin@firewall.loc
}
notification_email_from Alexandre.Cassen@firewall.loc
smtp_server 192.168.200.1
smtp_connect_timeout 30
router_id LVS_DEVEL
vrrp_skip_check_adv_addr
vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
}
include /etc/keepalived/conf.d/*.conf
[root@centos8 ~]# vim /etc/keepalived/conf.d/cluster1.conf
[root@centos8 ~]# cat /etc/keepalived/conf.d/cluster1.conf
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 80
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 111111
}
virtual_ipaddress {
192.168.200.16
192.168.200.17
192.168.200.18
}
}
[root@centos8 ~]# systemctl restart keepalived.service
[root@centos8 ~]# hostname -I
10.0.0.8 192.168.200.16 192.168.200.17 192.168.200.18
Comments | NOTHING