Linux: 高可用性集群keepalived

#CentOS
[root@centos ~]#yum install keepalived
#ubuntu
[root@ubuntu1804 ~]#apt -y install keepalived

[root@centos8 ~]#dnf -y install keepalived
[root@centos8 ~]#dnf info keepalived
Last metadata expiration check: 0:00:24 ago on Thu 26 Mar 2020 07:28:36 PM CST.
Installed Packages
Name                 : keepalived
Version         : 2.0.10
Release         : 4.el8_0.2
Architecture : x86_64
Size                 : 1.4 M
Source             : keepalived-2.0.10-4.el8_0.2.src.rpm
Repository     : @System
From repo     : AppStream
Summary         : High Availability monitor built upon LVS, VRRP and service
pollers
URL                 : http://www.keepalived.org/
License         : GPLv2+
Description : Keepalived provides simple and robust facilities for load
balancing
                        : and high availability to Linux system and Linux based
infrastructures.
                        : The load balancing framework relies on well-known and widely used
                        : Linux Virtual Server (IPVS) kernel module providing Layer4 load
                        : balancing. Keepalived implements a set of checkers to dynamically
and
                        : adaptively maintain and manage load-balanced server pool
according
                        : their health. High availability is achieved by VRRP protocol.
VRRP is
                        : a fundamental brick for router failover. In addition, keepalived
                        : implements a set of hooks to the VRRP finite state machine
providing
                        : low-level and high-speed protocol interactions. Keepalived
frameworks
                        : can be used independently or all together to provide resilient
                        : infrastructures.
[root@centos8 ~]#systemctl start keepalived.service
[root@centos8 ~]#ps auxf |grep keepalived
root             12864     0.0     0.1     12108     1100 pts/0     S+     19:25     0:00                 | 
\_ grep --color=auto keepalive
root             12835     0.0     0.3     91444     2484 ?             Ss     19:24     0:00
/usr/sbin/keepalived -D
root             12836     0.0     0.5     91576     4212 ?             S         19:24     0:00 \_
/usr/sbin/keepalived -D
root             12837     0.0     0.5     91444     4620 ?             S         19:24     0:00 \_
/usr/sbin/keepalived -D
[root@centos8 ~]#pstree -p
......
                    ├─keepalived(12835)─┬─keepalived(12836)
                    │                                     └─keepalived(12837)
......

[root@ubuntu1804 ~]#apt install keepalived -y
[root@ubuntu1804 ~]#dpkg -s keepalived
Package: keepalived
Status: install ok installed
Priority: extra
Section: admin
Installed-Size: 824
Maintainer: Ubuntu Developers <[email protected]>
Architecture: amd64
Version: 1:1.3.9-1ubuntu0.18.04.2
Depends: iproute2, libc6 (>= 2.27), libglib2.0-0 (>= 2.26.0), libip4tc0 (>=
1.6.0+snapshot20161117), libip6tc0 (>= 1.6.0+snapshot20161117), libnl-3-200 (>=
3.2.27), libnl-genl-3-200 (>= 3.2.7), libnl-route-3-200 (>= 3.2.7), libsnmp30
(>= 5.7.3+dfsg-1.8ubuntu3.1~dfsg), libssl1.1 (>= 1.1.0), libxtables12 (>=
1.6.0+snapshot20161117)
Recommends: ipvsadm
Conffiles:
/etc/dbus-1/system.d/org.keepalived.Vrrp1.conf 6b020ff46c6425d3a9cfa179814d7253
/etc/default/keepalived 6b2e3432e4ae31b444058ba2b0d1f06a
/etc/init.d/keepalived 0312972e0718331b4c90b3b98e623624
Description: Failover and monitoring daemon for LVS clusters
keepalived is used for monitoring real servers within a Linux
Virtual Server (LVS) cluster. keepalived can be configured to
remove real servers from the cluster pool if it stops responding,
as well as send a notification email to make the admin aware of
the service failure.
.
In addition, keepalived implements an independent Virtual Router
Redundancy Protocol (VRRPv2; see rfc2338 for additional info)
framework for director failover.
.
You need a kernel >= 2.4.28 or >= 2.6.11 for keepalived.
See README.Debian for more information.
Homepage: http://keepalived.org
Original-Maintainer: Alexander Wirt <[email protected]>
[root@ubuntu1804 ~]#dpkg -L keepalived
/.
/etc
/etc/dbus-1
/etc/dbus-1/system.d
/etc/dbus-1/system.d/org.keepalived.Vrrp1.conf
/etc/default
/etc/default/keepalived
/etc/init.d
/etc/init.d/keepalived
/etc/keepalived
/lib
/lib/systemd
/lib/systemd/system
/lib/systemd/system/keepalived.service
/usr
/usr/bin
/usr/bin/genhash
/usr/sbin
/usr/sbin/keepalived
/usr/share
/usr/share/dbus-1
/usr/share/dbus-1/interfaces
/usr/share/dbus-1/interfaces/org.keepalived.Vrrp1.Instance.xml
/usr/share/dbus-1/interfaces/org.keepalived.Vrrp1.Vrrp.xml
/usr/share/doc
/usr/share/doc/keepalived
/usr/share/doc/keepalived/AUTHOR
/usr/share/doc/keepalived/CONTRIBUTORS
/usr/share/doc/keepalived/README
/usr/share/doc/keepalived/TODO
/usr/share/doc/keepalived/changelog.Debian.gz
/usr/share/doc/keepalived/copyright
/usr/share/doc/keepalived/keepalived.conf.SYNOPSIS.gz
/usr/share/doc/keepalived/samples
/usr/share/doc/keepalived/samples/client.pem
/usr/share/doc/keepalived/samples/dh1024.pem
/usr/share/doc/keepalived/samples/keepalived.conf.HTTP_GET.port
/usr/share/doc/keepalived/samples/keepalived.conf.IPv6
/usr/share/doc/keepalived/samples/keepalived.conf.SMTP_CHECK
/usr/share/doc/keepalived/samples/keepalived.conf.SSL_GET
/usr/share/doc/keepalived/samples/keepalived.conf.fwmark
/usr/share/doc/keepalived/samples/keepalived.conf.inhibit
/usr/share/doc/keepalived/samples/keepalived.conf.misc_check
/usr/share/doc/keepalived/samples/keepalived.conf.misc_check_arg
/usr/share/doc/keepalived/samples/keepalived.conf.quorum
/usr/share/doc/keepalived/samples/keepalived.conf.sample
/usr/share/doc/keepalived/samples/keepalived.conf.status_code
/usr/share/doc/keepalived/samples/keepalived.conf.track_interface
/usr/share/doc/keepalived/samples/keepalived.conf.virtual_server_group
/usr/share/doc/keepalived/samples/keepalived.conf.virtualhost
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.localcheck
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.lvs_syncd
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.routes
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.rules
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.scripts
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.static_ipaddress
/usr/share/doc/keepalived/samples/keepalived.conf.vrrp.sync
/usr/share/doc/keepalived/samples/root.pem
/usr/share/doc/keepalived/samples/sample.misccheck.smbcheck.sh
/usr/share/doc/keepalived/samples/sample_notify_fifo.sh
/usr/share/man
/usr/share/man/man1
/usr/share/man/man1/genhash.1.gz
/usr/share/man/man5
/usr/share/man/man5/keepalived.conf.5.gz
/usr/share/man/man8
/usr/share/man/man8/keepalived.8.gz
/usr/share/snmp
/usr/share/snmp/mibs
/usr/share/snmp/mibs/KEEPALIVED-MIB.txt
/usr/share/snmp/mibs/VRRP-MIB.txt
/usr/share/snmp/mibs/VRRPv3-MIB.txt
[root@ubuntu1804 ~]#cp /usr/share/doc/keepalived/samples/keepalived.conf.sample
/etc/keepalived/keepalived.conf
[root@ubuntu1804 ~]#systemctl start keepalived.service
[root@ubuntu1804 ~]#systemctl status keepalived.service
● keepalived.service - Keepalive Daemon (LVS and VRRP)
    Loaded: loaded (/lib/systemd/system/keepalived.service; enabled; vendor
preset: enabled)
    Active: active (running) since Thu 2020-03-26 19:33:48 CST; 1min 9s ago
Process: 3208 ExecStart=/usr/sbin/keepalived $DAEMON_ARGS (code=exited,
status=0/SUCCESS)
Main PID: 3209 (keepalived)
    Tasks: 3 (limit: 1084)
    CGroup: /system.slice/keepalived.service
                    ├─3209 /usr/sbin/keepalived
                    ├─3210 /usr/sbin/keepalived
                    └─3211 /usr/sbin/keepalived
Mar 26 19:34:04 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Timeout
connecting server [192.168.200.2]:tcp:1358.
Mar 26 19:34:10 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Timeout
connecting server [192.168.200.2]:tcp:1358.
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Timeout
connecting server [192.168.200.2]:tcp:1358.
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Check on
service [192.168.200.2]:tcp:1358 failed after 3 retry.
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Removing
service [192.168.200.2]:tcp:1358 to VS [10.10.10.2]:tc
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Lost
quorum 1-0=1 > 0 for VS [10.10.10.2]:tcp:1358
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Adding
sorry server [192.168.200.200]:tcp:1358 to VS [10.10.10.
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Removing
alive servers from the pool for VS [10.10.10.2]:tcp:13
Mar 26 19:34:16 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Remote
SMTP server [192.168.200.1]:25 connected.
Mar 26 19:34:37 ubuntu1804.me.org Keepalived_healthcheckers[3210]: Error
reading data from remote SMTP server [192.168.200.1]:25.
[root@ubuntu1804 ~]#ps auxf |grep keepalived
root             3224     0.0     0.1     14428     1040 pts/0     S+     19:34     0:00         |     \_
grep --color=auto keepalived
root             3209     0.0     0.3     91812     2996 ?             Ss     19:33     0:00
/usr/sbin/keepalived
root             3210     0.0     0.5     96100     5276 ?             S         19:33     0:00 \_
/usr/sbin/keepalived
root             3211     0.0     0.5     96152     5420 ?             S         19:33     0:00 \_
/usr/sbin/keepalived

[root@centos7 ~]#yum install gcc curl openssl-devel libnl3-devel net-snmp-devel
[root@centos7 ~]#wget https://keepalived.org/software/keepalived-2.0.20.tar.gz
[root@centos7 ~]#tar xvf keepalived-2.0.20.tar.gz -C /usr/local/src
[root@centos7 ~]#cd /usr/local/src/keepalived-2.0.20/

#选项--disable-fwmark 可用于禁用iptables规则,可访止VIP无法访问,无此选项默认会启用
ipatbles规则
[root@centos7 keepalived-2.0.20]#./configure --prefix=/usr/local/keepalived #--disable-fwmark
[root@centos7 keepalived-2.0.20]#make && make install

[root@centos7 keepalived-2.0.20]#cd
[root@centos7 ~]#/usr/local/keepalived/sbin/keepalived -v
Keepalived v2.0.20 (01/22,2020)
Copyright(C) 2001-2020 Alexandre Cassen, <[email protected]>
Built with kernel headers for Linux 3.10.0
Running on Linux 3.10.0-1062.el7.x86_64 #1 SMP Wed Aug 7 18:08:02 UTC 2019
configure options: --prefix=/usr/local/keepalived
Config options: LVS VRRP VRRP_AUTH OLD_CHKSUM_COMPAT FIB_ROUTING
System options: PIPE2 SIGNALFD INOTIFY_INIT1 VSYSLOG EPOLL_CREATE1
IPV6_ADVANCED_API LIBNL3 RTA_ENCAP RTA_EXPIRES RTA_PREF FRA_SUPPRESS_PREFIXLEN
FRA_TUN_ID RTAX_CC_ALGO RTAX_QUICKACK FRA_OIFNAME IFA_FLAGS IP_MULTICAST_ALL
NET_LINUX_IF_H_COLLISION LIBIPTC_LINUX_NET_IF_H_COLLISION LIBIPVS_NETLINK
VRRP_VMAC IFLA_LINK_NETNSID CN_PROC SOCK_NONBLOCK SOCK_CLOEXEC O_PATH GLOB_BRACE
INET6_ADDR_GEN_MODE SO_MARK SCHED_RESET_ON_FORK

#默认会自动生成unit文件
[root@centos7 ~]#cat /usr/lib/systemd/system/keepalived.service
[Unit]
Description=LVS and VRRP High Availability Monitor
After=network-online.target syslog.target
Wants=network-online.target
[Service]
Type=forking
PIDFile=/run/keepalived.pid
KillMode=process
EnvironmentFile=-/usr/local/keepalived/etc/sysconfig/keepalived
ExecStart=/usr/local/keepalived/sbin/keepalived $KEEPALIVED_OPTIONS
ExecReload=/bin/kill -HUP $MAINPID
[Install]
WantedBy=multi-user.target
[root@centos7 ~]#cat /usr/local/keepalived/etc/sysconfig/keepalived
# Options for keepalived. See `keepalived --help' output and keepalived(8) and
# keepalived.conf(5) man pages for a list of all options. Here are the most
# common ones :
#
# --vrrp                             -P     Only run with VRRP subsystem.
# --check                         -C     Only run with Health-checker subsystem.
# --dont-release-vrrp -V     Dont remove VRRP VIPs & VROUTEs on daemon stop.
# --dont-release-ipvs -I     Dont remove IPVS topology on daemon stop.
# --dump-conf                 -d     Dump the configuration data.
# --log-detail                 -D     Detailed log messages.
# --log-facility             -S     0-7 Set local syslog facility (default=LOG_DAEMON)
#
KEEPALIVED_OPTIONS="-D"

#默认无法启动
[root@centos7 ~]#systemctl start keepalived.service
Job for keepalived.service failed because the control process exited with error
code. See "systemctl status keepalived.service" and "journalctl -xe" for
details.
#查看日志，可以看到是因为缺少配置文件导致无法启动
[root@centos7 ~]#journalctl -xe
-- Subject: Unit keepalived.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit keepalived.service has begun starting up.
Mar 29 00:38:17 centos7.me.org Keepalived[1123]: Starting Keepalived v2.0.20
(01/22,2020)
Mar 29 00:38:17 centos7.me.org Keepalived[1123]: Running on Linux 3.10.0-
1062.el7.x86_64 #1 SMP Wed Aug 7
Mar 29 00:38:17 centos7.me.org Keepalived[1123]: Command line:
'/usr/local/keepalived/sbin/keepalived' '-D
Mar 29 00:38:17 centos7.me.org Keepalived[1123]: Unable to find
configuration file /etc/keepalived/keepali     #默认配置文件路径
Mar 29 00:38:17 centos7.me.org Keepalived[1123]: Stopped Keepalived v2.0.20
(01/22,2020)
Mar 29 00:38:17 centos7.me.org systemd[1]: keepalived.service: control
process exited, code=exited status=
Mar 29 00:38:17 centos7.me.org systemd[1]: Failed to start LVS and VRRP High
Availability Monitor.
-- Subject: Unit keepalived.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit keepalived.service has failed.
--
-- The result is failed.
Mar 29 00:38:17 centos7.me.org systemd[1]: Unit keepalived.service entered
failed state.
Mar 29 00:38:17 centos7.me.org systemd[1]: keepalived.service failed.
Mar 29 00:38:17 centos7.me.org polkitd[565]: Unregistered Authentication
Agent for unix-process:1117:11546

#创建配置文件
[root@centos7 ~]#mkdir /etc/keepalived
[root@centos7 ~]#cp /usr/local/keepalived/etc/keepalived/keepalived.conf /etc/keepalived

#再次启动成功
[root@centos7 ~]#systemctl enable --now keepalived.service
Created symlink from /etc/systemd/system/multi-
user.target.wants/keepalived.service to
/usr/lib/systemd/system/keepalived.service.
[root@centos7 ~]#systemctl status keepalived.service
● keepalived.service - LVS and VRRP High Availability Monitor
    Loaded: loaded (/usr/lib/systemd/system/keepalived.service; disabled; vendor
preset: disabled)
    Active: active (running) since Sun 2020-03-29 00:44:33 CST; 4s ago
Process: 1191 ExecStart=/usr/local/keepalived/sbin/keepalived
$KEEPALIVED_OPTIONS (code=exited, status=0/SUCCESS)
    CGroup: /system.slice/keepalived.service
                    ├─1192 /usr/local/keepalived/sbin/keepalived -D
                    ├─1193 /usr/local/keepalived/sbin/keepalived -D
                    └─1194 /usr/local/keepalived/sbin/keepalived -D
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.18
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.16
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.17
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.18
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.16
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.17
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.18
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.16
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.17
Mar 29 00:44:37 centos7.me.org Keepalived_vrrp[1194]: Sending gratuitous ARP
on eth0 for 192.168.200.18
[root@centos7 ~]#ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
            valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
            valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
group default qlen 1000
    link/ether 00:0c:29:32:80:38 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.7/24 brd 10.0.0.255 scope global noprefixroute eth0
            valid_lft forever preferred_lft forever
    inet 192.168.200.16/32 scope global eth0
            valid_lft forever preferred_lft forever
    inet 192.168.200.17/32 scope global eth0
            valid_lft forever preferred_lft forever
     inet 192.168.200.18/32 scope global eth0
            valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe32:8038/64 scope link
            valid_lft forever preferred_lft forever
[root@centos7 ~]#hostname -I
10.0.0.7 192.168.200.16 192.168.200.17 192.168.200.18
[root@centos7 ~]#ping 192.168.200.16
PING 192.168.200.16 (192.168.200.16) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 192.168.200.16 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1000ms

#默认生成iptables规则,无法访问VIP,编译时可以加--disable-fwmark禁用生成iptables规则
[root@centos7 ~]#iptables -vnL
Chain INPUT (policy ACCEPT 860 packets, 46129 bytes)
pkts bytes target         prot opt in         out         source                             destination

        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.18         
        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.17         
        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.16         
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target         prot opt in         out         source                             destination

Chain OUTPUT (policy ACCEPT 1737 packets, 1188K bytes)
pkts bytes target         prot opt in         out         source                             destination

        4     336 DROP             all     -- *         *             192.168.200.18             0.0.0.0/0 

        0         0 DROP             all     -- *         *             192.168.200.17             0.0.0.0/0 

        0         0 DROP             all     -- *         *             192.168.200.16             0.0.0.0/0 

[root@centos7 ~]#vim /etc/keepalived/keepalived.conf
#注释下面一行
#vrrp_strict

#重启动不生效，有bug
[root@centos7 ~]#systemctl restart keepalived.service
[root@centos7 ~]#ping 192.168.200.16
PING 192.168.200.16 (192.168.200.16) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 192.168.200.16 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 999ms
[root@centos7 ~]#iptables -vnL
Chain INPUT (policy ACCEPT 1219 packets, 67647 bytes)
pkts bytes target         prot opt in         out         source                             destination

        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.18         
        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.17         
        0         0 DROP             all     -- *         *             0.0.0.0/0                 
    192.168.200.16         
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target         prot opt in         out         source                             destination

Chain OUTPUT (policy ACCEPT 2282 packets, 1233K bytes)
pkts bytes target         prot opt in         out         source                             destination

        4     336 DROP             all     -- *         *             192.168.200.18             0.0.0.0/0 

        0         0 DROP             all     -- *         *             192.168.200.17             0.0.0.0/0 

        4     336 DROP             all     -- *         *             192.168.200.16             0.0.0.0/0 


#无法关闭进程
[root@centos7 ~]#systemctl stop keepalived.service
[root@centos7 ~]#ps aux|grep keepalived
root             1383     0.0     0.1     69672     1020 ?             Ss     00:57     0:00
/usr/local/keepalived/sbin/keepalived -D
root             1384     0.0     0.2     69804     2308 ?             S         00:57     0:00
/usr/local/keepalived/sbin/keepalived -D
root             1385     0.0     0.1     69672     1308 ?             S         00:57     0:00
/usr/local/keepalived/sbin/keepalived -D
root             1392     0.0     0.0 112712     964 pts/0     R+     00:59     0:00 grep --
color=auto keepalived
[root@centos7 ~]#killall keepalived
[root@centos7 ~]#systemctl start keepalived.service
[root@centos7 ~]#ping 192.168.200.16
PING 192.168.200.16 (192.168.200.16) 56(84) bytes of data.
64 bytes from 192.168.200.16: icmp_seq=1 ttl=64 time=0.093 ms
^C
--- 192.168.200.16 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.093/0.093/0.093/0.000 ms
[root@centos7 ~]#iptables -vnL
Chain INPUT (policy ACCEPT 125 packets, 8493 bytes)
pkts bytes target         prot opt in         out         source                             destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target         prot opt in         out         source                             destination

Chain OUTPUT (policy ACCEPT 135 packets, 20190 bytes)
pkts bytes target         prot opt in         out         source                             destination

man keepalived.conf

[root@ka1-centos8 ~]#vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
    root@localhost #keepalived 发生故障切换时邮件发送的对象，可以按行区分写多个
}
    notification_email_from keepalived@localhost
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id ka1.example.com
    vrrp_skip_check_adv_addr #所有报文都检查比较消耗性能，此配置为如果收到的报文和上一个报文是同一个路由器则跳过检查报文中的源地址
    #vrrp_strict #严格遵守VRRP协议,禁止状况:1.无VIP地址,2.配置了单播邻居,3.在VRRP版本2中有IPv6地址
    vrrp_garp_interval 0 #ARP报文发送延迟
    vrrp_gna_interval 0 #消息发送延迟
    vrrp_mcast_group4 224.0.0.18 #默认组播IP地址，可指定组播范围：224.0.0.0到239.255.255.255
}
vrrp_instance VI_1 {
    state MASTER                     #在另一个结点上为BACKUP
    interface eth0
    virtual_router_id 66 #每个虚拟路由器必须唯一，同属一个虚拟路由器的多个keepalived节点必须相同
    priority 100                     #在另一个结点上为80
    advert_int 1
    authentication {
    auth_type PASS             #预共享密钥认证，同一个虚拟路由器的keepalived节点必须一样
    auth_pass 12345678
}
    virtual_ipaddress {
            10.0.0.10 dev eth0 label eth0:0
    }
}

#配置文件和master基本一致，只需修改三行
[root@ka2-centos8 ~]#vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
    root@localhost
}
    notification_email_from keepalived@localhost
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id ka2.example.com                 #修改此行
    vrrp_skip_check_adv_addr
    #vrrp_strict
    vrrp_garp_interval 0
    vrrp_gna_interval 0
    vrrp_mcast_group4 224.0.0.18
}
vrrp_instance VI_1 {
    state BACKUP #修改此行
    interface eth0
    virtual_router_id 66
    priority 80 #修改此行
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 12345678
    }
    virtual_ipaddress {
        10.0.0.10 dev eth0 label eth0:0
    }
}

tcpdump -i eth0 -nn host 224.0.0.18

#ha1主机配置
vrrp_instance VI_1 {
    state BACKUP         #都为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100     #优先级高
    advert_int 1
    nopreempt                 #添加此行，都为nopreempt

#ha2主机配置
vrrp_instance VI_1 {
    state BACKUP                 #都为BACKUP
    interface eth0
    virtual_router_id 66
    priority 80             #优先级低
    advert_int 1
    nopreempt     #添加此行，都为nopreempt

preempt_delay #         #指定抢占延迟时间为#s，默认延迟300s

#ha1主机配置
vrrp_instance VI_1 {
    state BACKUP         #都为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #优先级高
    advert_int 1
    preempt_delay 60         #抢占延迟模式，默认延迟300s

#ha2主机配置
vrrp_instance VI_1 {
    state BACKUP             #都为BACKUP
    interface eth0
    virtual_router_id 66
    priority 80 #优先级低
    advert_int 1

notify_master <STRING>|<QUOTED-STRING>

notify_backup <STRING>|<QUOTED-STRING>

notify_fault <STRING>|<QUOTED-STRING>

notify <STRING>|<QUOTED-STRING>

notify_stop <STRING>|<QUOTED-STRING>

notify_master "/etc/keepalived/notify.sh master"
notify_backup "/etc/keepalived/notify.sh backup"
notify_fault "/etc/keepalived/notify.sh fault"

[root@ka1-centos8 ~]#cat /etc/keepalived/notify.sh
#!/bin/bash
#
contact='[email protected]'
notify() {
    mailsubject="$(hostname) to be $1, vip floating"
    mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be $1"
    echo "$mailbody" | mail -s "$mailsubject" $contact
}
case $1 in
master)
    notify master
    ;;
backup)
    notify backup
    ;;
fault)
    notify fault
    ;;
*)
    echo "Usage: $(basename $0) {master|backup|fault}"
    exit 1
;;
esac

[root@centos8 ~]# vim /etc/mail.rc
#在最后面添加下面行
set from[email protected]
set smtp=smtp.qq.com
set [email protected]
set smtp-auth-password=esvnhbnqocirbicf
set smtp-auth=login
set ssl-verify=ignore

[root@centos8 ~]#vi /etc/mail.rc
set from[email protected] #之前设置好的邮箱地址
set smtp=smtp.163.com #邮件服务器
set [email protected] #之前设置好的邮箱地址
set smtp-auth-password=yyy #授权码
set smtp-auth=login #默认login即可

[root@centos8 ~]# yum -y install mailx
[root@centos8 ~]# echo "Test Mail"| mail -s Warning [email protected]

#在所有 keepalived节点配置如下
[root@ka1-centos8 ~]#cat /etc/keepalived/notify.sh
#!/bin/bash
#
contact='[email protected]'
notify() {
    mailsubject="$(hostname) to be $1, vip floating"
    mailbody="$(date +'%F %T'): vrrp transition, $(hostname) changed to be $1"
    echo "$mailbody" | mail -s "$mailsubject" $contact
}
case $1 in
master)
notify master
;;
backup)
notify backup
;;
fault)
notify fault
;;
*)
echo "Usage: $(basename $0) {master|backup|fault}"
exit 1
;;
esac

[root@ka1-centos8 ~]#chmod a+x /etc/keepalived/notify.sh
[root@ka1-centos8 ~]#vim /etc/keepalived/keepalived.conf
vrrp_instance VI_1 {
    ......
    virtual_ipaddress {
        10.0.0.10 dev eth0 label eth0:1
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
}

#模拟master故障
[root@ka1-centos8 ~]#killall keepalived

vrrp_script <SCRIPT_NAME> {
    script <STRING>|<QUOTED-STRING>     #此脚本返回值为非0时，会触发下面OPTIONS执行
    OPTIONS
}

track_script {
    SCRIPT_NAME_1
    SCRIPT_NAME_2
}

[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
    global_defs {
        notification_email {
            root@localhost
        }
        notification_email_from kaadmin@localhost
        smtp_server 127.0.0.1
        smtp_connect_timeout 30
        router_id ka1.me.org #在另一个节点为ka2.me.org
        vrrp_mcast_group4 224.0.100.100
    }
vrrp_script check_down {
    script "[ ! -f /etc/keepalived/down ]" #/etc/keepalived/down存在时返回非0，触发权重-30
    interval 1
    weight -30
    fall 3
    rise 2
    timeout 2
}
vrrp_instance VI_1 {
    state MASTER #在另一个节点为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #在另一个节点为80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_down                     #调用前面定义的脚本
    }
}

[root@ka1-centos8 ~]#touch /etc/keepalived/down
[root@ka1-centos8 ~]#tail -f /var/log/messages
Mar 28 19:47:03 ka1-centos8 Keepalived_vrrp[7200]: Script `check_down` now
returning 1
Mar 28 19:47:05 ka1-centos8 Keepalived_vrrp[7200]: VRRP_Script(chk_down) failed
(exited with status 1)
Mar 28 19:47:05 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Changing effective
priority from 100 to 70
Mar 28 19:47:07 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Master received advert
from 10.0.0.18 with higher priority 80, ours 70
Mar 28 19:47:07 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Entering BACKUP STATE
Mar 28 19:47:07 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) removing VIPs.
[root@rs1 ~]#tcpdump -i eth0 -nn 224.0.100.100
19:42:09.578203 IP 10.0.0.8 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 100, authtype simple, intvl 1s, length 20
19:42:10.579304 IP 10.0.0.8 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 70, authtype simple, intvl 1s, length 20
[root@ka1-centos8 ~]#rm -f /etc/keepalived/down
[root@ka1-centos8 ~]#tail -f /var/log/messages
Mar 28 19:47:45 ka1-centos8 Keepalived_vrrp[7200]: Script `check_down` now
returning 0
Mar 28 19:47:46 ka1-centos8 Keepalived_vrrp[7200]: VRRP_Script(check_down)
succeeded
Mar 28 19:47:46 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Changing effective
priority from 70 to 100
Mar 28 19:47:46 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) received lower
priority (80) advert from 10.0.0.18 - discarding
Mar 28 19:47:47 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) received lower
priority (80) advert from 10.0.0.18 - discarding
Mar 28 19:47:48 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) received lower
priority (80) advert from 10.0.0.18 - discarding
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Receive advertisement
timeout
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Entering MASTER STATE
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) setting VIPs.
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: Sending gratuitous ARP on
eth0 for 10.0.0.10
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: (VI_1) Sending/queueing
gratuitous ARPs on eth0 for 10.0.0.10
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: Sending gratuitous ARP on
eth0 for 10.0.0.10
Mar 28 19:47:49 ka1-centos8 Keepalived_vrrp[7200]: Sending gratuitous ARP on
eth0 for 10.0.0.10
[root@rs1 ~]#tcpdump -i eth0 -nn 224.0.100.100
19:49:16.199462 IP 10.0.0.18 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 80, authtype simple, intvl 1s, length 20
19:49:17.199897 IP 10.0.0.18 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 80, authtype simple, intvl 1s, length 20
19:49:17.810376 IP 10.0.0.8 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 100, authtype simple, intvl 1s, length 20
19:49:18.811048 IP 10.0.0.8 > 224.0.100.100: VRRPv2, Advertisement, vrid 66,
prio 100, authtype simple, intvl 1s, length 20

#在两个节点都配置nginx反向代理
[root@ka1-centos8 ~]#vim /etc/nginx/nginx.conf
http {
upstream websrvs {
server 10.0.0.7:80 weight=1;
server 10.0.0.17:80 weight=1;
}
server {
listen 80;
location /{
proxy_pass http://websrvs/;
}
}
}

#在两个节点都配置实现nginx反向代理高可用
[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
    global_defs {
        notification_email {
            root@localhost
        }
        notification_email_from kaadmin@localhost
        smtp_server 127.0.0.1
        smtp_connect_timeout 30
        router_id ka1.me.org #在另一个节点为ka2.me.org
        vrrp_mcast_group4 224.0.100.100
    }
vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
    #script "/usr/bin/killall -0 nginx"     此写法支持
    #script "/usr/bin/killall -0 nginx &>/dev/null" 不支持&>此写法
    interval 1
    weight -30
    fall 3
    rise 5
    timeout 2
}
vrrp_instance VI_1 {
    state MASTER #在另一个节点为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #在另一个节点为80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_nginx
    }
}
[root@ka1-centos8 ~]# yum install psmisc -y
[root@ka1-centos8 ~]# cat /etc/keepalived/check_nginx.sh
#!/bin/bash
/usr/bin/killall -0 nginx || systemctl restart nginx
[root@ka1-centos8 ~]# chmod a+x /etc/keepalived/check_nginx.sh

vim /etc/keepalived/notify.sh
!/bin/bash
contact='root@localhost'
notify() {
mailsubject="$(hostname) to be     $1:vip floating"
mailbody="$(date +'%F %T'):vrrp transition,$(hostname) change to be $1"
echo $mailbody | mail -s "$mailsubject" $contract
}
case $1 in
master)
notify master
systemctl start nginx
;;
backup)
notify backup
systemctl restart nginx
;;
fault)
notify fault
;;
*)
echo "Usage: $(basename $0) {master|backup|fault}"
esac

#在两个节点都配置nginx反向代理
[root@ka1-centos8 ~]vim /etc/nginx/nginx.conf
http {
upstream websrvs {
server 10.0.0.7:80 weight=1;
server 10.0.0.17:80 weight-1;
}
upstream websrvs2 {
server 10.0.0.27:80 weight=1;
server 10.0.0.37:80 weight-1;
}
server {
listen 80;
server_name www.a.com;
 location /{
proxy_pass http://webservs/;
}
}
server {
listen 80;
server_name www.b.com;
location /{
proxy_pass http://webservs2/;
}
}
}

#在两个节点都配置实现双主模式的nginx反向代理高可用
[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    notification_email {
        root@localhost
    }
    notification_email_from kaadmin@localhost
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id ka1.me.org #在另一个节点为ka2.me.org
    vrrp_mcast_group4 224.100.100.100
}
vrrp_script check_nginx {
    script "/etc/keepalived/check_nginx.sh"
    #script "/usr/bin/killall -0 nginx"
    interval 1
    weight -30
    fall 3
    rise 5
    timeout 2
}
vrrp_instance VI_1 {
    state MASTER #在另一个节点为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #在另一个节点为80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_nginx
    }
}
vrrp_instance VI_2 {
    state BACKUP #在另一个节点为MASTER
    interface eth0
    virtual_router_id 88
    priority 80 #在另一个节点为100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.20/24 dev eth0 label eth0:2
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_nginx
    }
}
[root@ka1-centos8 ~]# yum install psmisc -y
[root@ka1-centos8 ~]# cat /etc/keepalived/check_nginx.sh

#!/bin/bash
/usr/bin/killall -0 nginx
[root@ka1-centos8 ~]# chmod a+x /etc/keepalived/check_nginx.sh
#在两个ka1和ka2先实现haproxy的配置
[root@ka1 ~]#cat /etc/haproxy/haproxy.cfg
listen me_http
    bind 10.0.0.10:80
    server web1 10.0.0.7:80 check
    server web2 10.0.0.17:80 check
listen stats
    mode http
    bind 10.0.0.8:9999
    stats enable
    log global
    stats uri         /haproxy-status
    stats auth     haadmin:123456
#在两个ka1和ka2两个节点启用内核参数
[root@ka1，2 ~]#vim /etc/sysctl.conf
net.ipv4.ip_nonlocal_bind = 1
[root@ka1，2 ~]#sysctl -p

[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    notification_email {
        root@localhost
    }
    notification_email_from kaadmin@localhost
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id ka1.me.org #在另一个节点为ka2.me.org
    vrrp_mcast_group4 224.0.100.100
}
vrrp_script check_haproxy { #定义脚本
    script "/etc/keepalived/check_haproxy.sh"
    interval 1
    weight -30
    fall 3
    rise 2
    timeout 2
}
vrrp_instance VI_1 {
    state MASTER #在另一个节点为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #在另一个节点为80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_haproxy #调用上面定义的脚本
    }
}
[root@ka1-centos8 ~]# yum install psmisc -y
[root@ka1-centos8 ~]# cat /etc/keepalived/check_haproxy.sh

#!/bin/bash
/usr/bin/killall -0 haproxy || systemctl restart haproxy
[root@ka1-centos8 ~]# chmod a+x /etc/keepalived/check_haproxy.sh

#先实现MySQL的双主架构
[root@ka1-centos8 ~]#vim /etc/my.cnf.d/mariadb-server.cnf
[mysqld]
server-id=8
log-bin
auto_increment_offset=1                 #开始点
auto_increment_increment=2             #增长幅度 
#在ka2第二个节点创建连接MySQL查看同步状态的授权用户
[root@ka2-centos8 ~]#mysql -uroot -p123456
MariaDB [(none)]> grant replication slave on *.* to repluser@'10.0.0.%'
identified by '123456';
#实现MySQL的健康性检测脚本1
[root@ka1-centos8 ~]#vi /etc/keepalived/check_mysql.sh
#!/bin/bash
slave_is=( $(mysql -uroot -p123456 -h10.0.0.18 -e "show slave status\G" | grep
"Slave_.*_Running:" | awk '{print $2}') )
if [ "${slave_is[0]}" = "Yes" -a "${slave_is[1]}" = "Yes" ];then
exit 0
else
exit 1
fi
#实现MySQL的健康性检测脚本2
[root@ka1-centos8 ~]#vi /etc/keepalived/check_mysql.sh
mysqladmin -uroot -p123456     ping &> /dev/null
#实现MySQL的健康性检测脚本3
[root@ka1-centos8 ~]#vi /etc/keepalived/check_mysql.sh
mysql     -uroot -p123456 -e 'status' &> /dev/null
#实现MySQL的健康性检测脚本4
[root@ka1-centos8 ~]#vi /etc/keepalived/check_mysql.sh
systemctl is-active mariadb &> /dev/null

#配置keepalived调用上面脚本
[root@ka1-centos8 ~]#cat /etc/keepalived/keepalived.conf
! Configuration File for keepalived
global_defs {
    notification_email {
        root@localhost
    }
    notification_email_from kaadmin@localhost
    smtp_server 127.0.0.1
    smtp_connect_timeout 30
    router_id ka1.me.org #在另一个节点为ka2.me.org
    vrrp_mcast_group4 224.0.100.100
}
vrrp_script check_mysql { #只需在第一个节点上实现脚本
    script "/etc/keepalived/check_mysql.sh"
    interval 1
    weight -30
    fall 3
    rise 2
    timeout 2
}
vrrp_instance VI_1 {
    state MASTER #在另一个节点为BACKUP
    interface eth0
    virtual_router_id 66
    priority 100 #在另一个节点为80
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 123456
    }
    virtual_ipaddress {
        10.0.0.10/24 dev eth0 label eth0:1
    }
    track_interface {
        eth0
    }
    notify_master "/etc/keepalived/notify.sh master"
    notify_backup "/etc/keepalived/notify.sh backup"
    notify_fault "/etc/keepalived/notify.sh fault"
    track_script {
        check_mysql #只需在第一个节点上实现脚本
    }
}