Keepalived 实现 VRRP-李佳程的个人主页

1、实现master/slave的 Keepalived 单主架构

MASTER配置

# vim /etc/keepalived/keepalived.conf
global_defs {
  notification_email {
  root@localhost #keepalived 发生故障切换时邮件发送的对象，可以按行区分写多个
  }
  notification_email_from keepalived@localhost
  smtp_server 127.0.0.1
  smtp_connect_timeout 30
  router_id ka1.example.com
  vrrp_skip_check_adv_addr #所有报文都检查比较消耗性能，此配置为如果收到的报文和上一个报文是同一个路由器则跳过检查报文中的源地址
  #vrrp_strict #严格遵守VRRP协议,禁止状况:1.无VIP地址,2.配置了单播邻居,3.在VRRP版本2中有IPv6地址
  vrrp_garp_interval 0 #ARP报文发送延迟
  vrrp_gna_interval 0 #消息发送延迟
  vrrp_mcast_group4 224.0.0.18 #默认组播IP地址，可指定组播范围：224.0.0.0到
239.255.255.255
}
vrrp_instance VI_1 {
  state MASTER           #在另一个结点上为BACKUP
  interface eth0
  virtual_router_id 66 #每个虚拟路由器必须唯一，同属一个虚拟路由器的多个keepalived节点必须相同
  priority 100           #在另一个结点上为80
  advert_int 1
  authentication {
    auth_type PASS       #预共享密钥认证，同一个虚拟路由器的keepalived节点必须一样
    auth_pass 12345678
  }
  virtual_ipaddress {
     192.168.1.63 dev eth0 label eth0:0
  }
}

BACKUP配置

# 配置文件和master基本一致，只需修改三行
# vim /etc/keepalived/keepalived.conf
global_defs {
  notification_email {
  root@localhost #keepalived
  }
  notification_email_from keepalived@localhost
  smtp_server 127.0.0.1
  smtp_connect_timeout 30
  router_id ka2.example.com                   # 修改此行
  vrrp_skip_check_adv_addr
  #vrrp_strict
  vrrp_garp_interval 0
  vrrp_gna_interval 0
  vrrp_mcast_group4 224.0.0.18
}
vrrp_instance VI_1 {
  state BACKUP                   # 修改此行
  interface eth0
  virtual_router_id 66
  priority 80                    # 修改此行
  advert_int 1
  authentication {
    auth_type PASS
    auth_pass 12345678
  }
  virtual_ipaddress {
     192.168.1.63 dev eth0 label eth0:0
  }
}

2、抢占模式和非抢占模式

非抢占模式 nopreempt

默认为抢占模式 preempt，即当高优先级的主机恢复在线后，会抢占低先级的主机的master角色，造成网络抖动，建议设置为非抢占模式 nopreempt ，即高优先级主机恢复后，并不会抢占低优先级主机的master 角色

注意：非抢占模式下，如果原主机down机，VIP迁移至的新主机，后续新主机也发生down时，仍会将VIP迁移回原主机。

注意：要关闭 VIP抢占，必须将各 Keepalived 服务器 state 配置为 BACKUP

# ha1主机配置
vrrp_instance VI_1 {
  state BACKUP     #都为BACKUP
  interface eth0
  virtual_router_id 66
  priority 100   #优先级高
  advert_int 1
  nopreempt         #添加此行，设为nopreempt
# ha2主机配置
vrrp_instance VI_1 {
  state BACKUP         #都为BACKUP
  interface eth0
  virtual_router_id 66
  priority 80       #优先级低
  advert_int 1
  #nopreempt   #生产中ka2主机是抢占式，不添加此行,否则会导致ka1即使优先级降低，也不会
切换至ka2

抢占延迟模式 preempt_delay

抢占延迟模式，即优先级高的主机恢复后，不会立即抢回VIP，而是延迟一段时间（默认300s）再抢回VIP

preempt_delay #     #指定抢占延迟时间为#s，默认延迟300s

注意：需要各keepalived服务器state为BACKUP，并且不要启用 vrrp_strict

# ka1主机配置
vrrp_instance VI_1 {
  state BACKUP     #都为BACKUP
  interface eth0
  virtual_router_id 66
  priority 100 #优先级高
  advert_int 1
  preempt_delay 60    #抢占延迟模式，默认延迟300s
# ka2主机配置
vrrp_instance VI_1 {
  state BACKUP       #都为BACKUP
  interface eth0
  virtual_router_id 66
  priority 80 #优先级低
  advert_int 1

3、VIP 单播配置

默认keepalived主机之间利用多播相互通告消息，会造成网络拥塞，可以替换成单播，减少网络流量

注意：启用 vrrp_strict 时，不能启用单播

# 在所有节点vrrp_instance语句块中设置对方主机的IP，建议设置为专用于对应心跳线网络的地址，而非使用业务网络
unicast_src_ip <IPADDR>  #指定发送单播的源IP
unicast_peer {
   <IPADDR>     #指定接收单播的对方目标主机IP
   ......
}

# master 主机配置
# vim /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
  notification_email {
    acassen@firewall.loc
    failover@firewall.loc
    sysadmin@firewall.loc
  }
  notification_email_from Alexandre.Cassen@firewall.loc
  smtp_server 192.168.200.1
  smtp_connect_timeout 30
  router_id ka1.wang.org
  vrrp_skip_check_adv_addr
  #vrrp_strict
  vrrp_garp_interval 0
  vrrp_gna_interval 0
}
vrrp_instance VI_1 {
  state MASTER
  interface eth0
  virtual_router_id 66
  priority 100
  advert_int 1
  authentication {
    auth_type PASS
    auth_pass 123456
  }
  virtual_ipaddress {
    192.168.1.65/24 dev eth0 label eth0:1
  }
  unicast_src_ip 192.168.1.61     #本机IP
  unicast_peer{
    192.168.1.62 #指向对方主机IP
    192.168.1.63 #如果有多个keepalived,再加其它节点的IP
  }
}

# slave 主机配置
# vim  /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
  notification_email {
    acassen@firewall.loc
    failover@firewall.loc
    sysadmin@firewall.loc
  }
  notification_email_from Alexandre.Cassen@firewall.loc
  smtp_server 192.168.200.1
  smtp_connect_timeout 30
  router_id ka2.wang.org
  vrrp_skip_check_adv_addr
  #vrrp_strict
  vrrp_garp_interval 0
  vrrp_gna_interval 0
}
vrrp_instance VI_1 {
  state SLAVE
  interface eth0
  virtual_router_id 66
  priority 80
  advert_int 1
  authentication {
    auth_type PASS
    auth_pass 123456
  }
  virtual_ipaddress {
    192.168.1.65/24 dev eth0 label eth0:1
  }
  unicast_src_ip 192.168.1.62       #本机IP
  unicast_peer {
    192.168.1.61 #指向对方主机IP
  }
}

4、Keepalived 通知脚本配置

当keepalived的状态变化时，可以自动触发脚本的执行，比如：发邮件通知用户
默认以用户keepalived_script身份执行脚本，如果此用户不存在，以root执行脚本
可以用下面指令指定脚本执行用户的身份

global_defs {
  ......
  script_user <USER>
  ......
}

4.1、通知脚本类型

当前节点成为主节点时触发的脚本

notify_master <STRING>|<QUOTED-STRING>

当前节点转为备节点时触发的脚本

notify_backup <STRING>|<QUOTED-STRING>

当前节点转为“失败”状态时触发的脚本

notify_fault <STRING>|<QUOTED-STRING>

通用格式的通知触发机制，一个脚本可完成以上三种状态的转换时的通知

notify <STRING>|<QUOTED-STRING>

当停止VRRP时触发的脚本

notify_stop <STRING>|<QUOTED-STRING>

4.2、脚本的调用方法

在 vrrp_instance VI_1 语句块的末尾加下面行

notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"

4.3、实现 Keepalived 状态切换的通知脚本

支持RHEL和Ubuntu系统

# 在所有 keepalived节点配置如下
# vim /etc/keepalived/notify.sh

#!/bin/bash
contact='root@lijiach.com'
email_send='252409868@qq.com'
email_passwd=''
email_smtp_server='smtp.qq.com'

. /etc/os-release

msg_error() {
  echo -e "\033[1;31m$1\033[0m"
}

msg_info() {
  echo -e "\033[1;32m$1\033[0m"
}

msg_warn() {
  echo -e "\033[1;33m$1\033[0m"
}

color () {
    RES_COL=60
    MOVE_TO_COL="echo -en \\033[${RES_COL}G"
    SETCOLOR_SUCCESS="echo -en \\033[1;32m"
    SETCOLOR_FAILURE="echo -en \\033[1;31m"
    SETCOLOR_WARNING="echo -en \\033[1;33m"
    SETCOLOR_NORMAL="echo -en \E[0m"
    echo -n "$1" && $MOVE_TO_COL
    echo -n "["
    if [ $2 = "success" -o $2 = "0" ] ;then
        ${SETCOLOR_SUCCESS}
        echo -n $" OK "
    elif [ $2 = "failure" -o $2 = "1" ] ;then
        ${SETCOLOR_FAILURE}
        echo -n $"FAILED"
    else
        ${SETCOLOR_WARNING}
        echo -n $"WARNING"
    fi
    ${SETCOLOR_NORMAL}
    echo -n "]"
    echo
}

install_sendemail () {
    if [[ $ID =~ rhel|centos|rocky ]];then
       rpm -q sendemail &> /dev/null || yum install -y sendemail
    elif [ $ID = 'ubuntu' ];then
       dpkg -l |grep -q sendemail || { apt update; apt install -y libio-socket-ssl-perl libnet-ssleay-perl sendemail ; }
    else
        color "不支持此操作系统，退出!" 1
        exit
    fi
}



send_email () {
    local email_receive="$1"
    local email_subject="$2"
    local email_message="$3"
    sendemail -f $email_send -t $email_receive -u $email_subject -m
 $email_message -s $email_smtp_server -o message-charset=utf-8 -o tls=yes -xu
 $email_send -xp $email_passwd
    [ $? -eq 0 ] && color "邮件发送成功!" 0 || color "邮件发送失败!" 1
}

notify() {
    if [[ $1 =~ ^(master|backup|fault)$ ]];then
        mailsubject="$(hostname) to be $1, vip floating"
        mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be
$1"
        send_email "$contact" "$mailsubject" "$mailbody"
    else
        echo "Usage: $(basename $0) {master|backup|fault}"
        exit 1
    fi
}

install_sendemail
notify $1

# chmod a+x /etc/keepalived/notify.sh

# vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
  ......
  virtual_ipaddress {
    192.168.1.65 dev eth0 label eth0:1
  }
  notify_master "/etc/keepalived/notify.sh master"
  notify_backup "/etc/keepalived/notify.sh backup"
  notify_fault "/etc/keepalived/notify.sh fault"
}

# 模拟master故障
# killall keepalived