高可用是指2臺(tái)機(jī)器啟動(dòng)著完全相同的業(yè)務(wù)系統(tǒng)，一臺(tái)機(jī)器宕機(jī)后，另一臺(tái)可以快速啟用，用戶是無感知的。高可用硬件通常使用F5，軟件通常使用keepalived。keepalived軟件是基于VRRP協(xié)議實(shí)現(xiàn)的，VRRP虛擬路由冗余協(xié)議，主要用于解決單點(diǎn)故障。
目錄
VRRP實(shí)現(xiàn)原理
Keepalived核心概念
Keepalived安裝配置
Keepalived測(cè)試搶占式和非搶占式???????
Keepalived故障腦裂
一、常見故障原因
二、腦裂故障測(cè)試
三、腦裂故障解決方案
Keepalived與Nginx
一、腳本編寫并增加權(quán)限
二???????、腳本測(cè)試
三、在配置文件內(nèi)中調(diào)用此腳本
VRRP實(shí)現(xiàn)原理
咱們拿公司路由器舉例，路由器故障后，網(wǎng)關(guān)無法轉(zhuǎn)發(fā)報(bào)文，所有人無法上網(wǎng)了怎么辦？
一般我們會(huì)選擇增加一臺(tái)路由器，但是我們主路由器故障后，用戶需要手動(dòng)指向備用路由器，如果用戶多的話修改起來會(huì)非常麻煩，另外我們的主路由器修好后，主路由器用不用；主路由器故障后我們把備用路由器的網(wǎng)關(guān)配置改成主路由器是否可以，等等，涉及問題很多。
實(shí)際上，我們?nèi)绻麊渭兩闲薷木W(wǎng)關(guān)配置，是行不通的，我們的PC第一次通過ARP廣播尋找到主路由器的MAC地址和IP地址，會(huì)將信息寫到ARP的緩存表，那么PC在之后的連接中都是根據(jù)緩存表信息去連接，在進(jìn)行數(shù)據(jù)包轉(zhuǎn)發(fā)，即使我們修改了IP，但是Mac地址是唯一的，PC的數(shù)據(jù)包依舊會(huì)發(fā)給主路由器（除非PC的ARP緩存表過期，再次發(fā)起ARP廣播的時(shí)候才能獲取新的備用路由器的MAC的地址和IP地址）
那么我們就需要VRRP了，通過軟件或硬件的形式在主路由器和副路由器外面增加一個(gè)虛擬的MAC地址（VMAC）和虛擬IP地址（VIP），那么在這種情況下，PC請(qǐng)求VIP的時(shí)候，不管是主路由器處理還是備用路由器處理，PC只是在ARP緩存表中記錄VMAC和VIP的信息。
Keepalived核心概念
要掌握Keepalived之前，我們需要先知道它的核心概念。
1、如何確定誰是主節(jié)點(diǎn)誰是備用節(jié)點(diǎn)（誰的效率高，速度快就用誰，類似選舉投票；手動(dòng)干預(yù)是通過優(yōu)先級(jí)的方式）
2、如果主節(jié)點(diǎn)故障，備用節(jié)點(diǎn)自動(dòng)接管，如果主節(jié)點(diǎn)恢復(fù)了，那么搶占式的方式主節(jié)點(diǎn)會(huì)自動(dòng)接管，類似于奪權(quán)，而非搶占式的方式，主節(jié)點(diǎn)恢復(fù)了，并不會(huì)自動(dòng)接管。
3、主節(jié)點(diǎn)和備用節(jié)點(diǎn)在1個(gè)小組，主節(jié)點(diǎn)正常時(shí)，1秒鐘向小組內(nèi)發(fā)送一次心跳（時(shí)間可以自定義），表示它還正常，如果沒有發(fā)送心跳，則備用節(jié)點(diǎn)自動(dòng)接管，如果主節(jié)點(diǎn)和備用節(jié)點(diǎn)都沒發(fā)送心跳，則兩臺(tái)服務(wù)器都會(huì)認(rèn)為自己是主節(jié)點(diǎn)，從而形成腦裂
Keepalived安裝配置
1、我們準(zhǔn)備一臺(tái)LB01（10.0.0.5）和一臺(tái)LB02（10.0.0.6）兩臺(tái)虛擬主機(jī)
2、兩臺(tái)主機(jī)都安裝keepalived
[root@LB01 ~]# yum -y install keepalived
[root@LB02 ~]# yum -y install keepalived3、配置LB01
[root@LB01 ~]# rpm -qc keepalived #查詢keepalived的配置文件
/etc/keepalived/keepalived.conf
/etc/sysconfig/keepalived
[root@LB01 ~]# cat /etc/keepalived/keepalived.conf
global_defs { #全局配置
router_id LB01 #標(biāo)識(shí)身份->名稱
}
vrrp_instance VI_1 {
state MASTER #標(biāo)識(shí)角色狀態(tài)
interface eth0 #網(wǎng)卡綁定接口
virtual_router_id 50 #虛擬路由id
priority 150 #優(yōu)先級(jí)
advert_int 1 #監(jiān)測(cè)間隔時(shí)間
authentication { #認(rèn)證
auth_type PASS #認(rèn)證方式
auth_pass 1111 #認(rèn)證密碼
}
virtual_ipaddress {
10.0.0.3 #虛擬的VIP地址
}
}4、配置LB02
[root@LB02 ~]# cat /etc/keepalived/keepalived.conf global_defs {
router_id LB02 #與主結(jié)點(diǎn)區(qū)別1：唯一標(biāo)識(shí)
}
vrrp_instance VI_1 {
state BACKUP #與主節(jié)點(diǎn)區(qū)別2：角色狀態(tài)
interface eth0
virtual_router_id 50
priority 100 #與主節(jié)點(diǎn)區(qū)別3：競(jìng)選優(yōu)先級(jí)
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.0.3
}
}5、啟動(dòng)兩個(gè)節(jié)點(diǎn)的keepalived
[root@LB01 ~]# systemctl start keepalived
[root@LB01 ~]# systemctl enable keepalived
[root@LB02 ~]# systemctl start keepalived
[root@LB02 ~]# systemctl enable keepalivedKeepalived測(cè)試搶占式和非搶占式
1、LB01的優(yōu)先級(jí)高于LB02，所以VIP在LB01上面
[root@LB01 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth02、關(guān)閉LB01的keepalived，發(fā)現(xiàn)LB02自動(dòng)接管
[root@LB01 ~]# systemctl stop keepalived
[root@LB01 ~]# ip add | grep 10.0.0.3
[root@LB02 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth03、重啟LB01的keepalived，發(fā)現(xiàn)VIP被強(qiáng)行搶占
[root@LB01 ~]# systemctl start keepalived
[root@LB01 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0
[root@LB02 ~]# ip add | grep 10.0.0.3
4、配置非搶占式
兩個(gè)節(jié)點(diǎn)的state都必須配置為BACKUP，都必須加上配置nopreempt，其中一個(gè)節(jié)點(diǎn)的優(yōu)先級(jí)必須高于另外一個(gè)節(jié)點(diǎn)的優(yōu)先級(jí)。
[root@LB01 ~]# cat /etc/keepalived/keepalived.conf
global_defs { #全局配置
router_id LB01 #標(biāo)識(shí)身份->名稱
}
vrrp_instance VI_1 {
state BACKUP #標(biāo)識(shí)角色狀態(tài)
nopreempt
interface eth0 #網(wǎng)卡綁定接口
virtual_router_id 50 #虛擬路由id
priority 150 #優(yōu)先級(jí)
advert_int 1 #監(jiān)測(cè)間隔時(shí)間
authentication { #認(rèn)證
auth_type PASS #認(rèn)證方式
auth_pass 1111 #認(rèn)證密碼
}
virtual_ipaddress {
10.0.0.3 #虛擬的VIP地址
}
}
[root@LB01 ~]# systemctl restart keepalived
[root@LB02 ~]# cat /etc/keepalived/keepalived.conf
global_defs {
router_id LB02
}
vrrp_instance VI_1 {
state BACKUP
nopreempt
interface eth0
virtual_router_id 50
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.0.3
}
}
[root@LB02 ~]# systemctl restart keepalived5、通過windows的arp去驗(yàn)證，是否會(huì)切換MAC地址
[root@LB01 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0Windows本地hosts到10.0.0.3，瀏覽器訪問blog.koten.com（LB01分配到Web01里面的域名）
WIN+R調(diào)用運(yùn)行窗口，輸入cmd打開命令提示符arp -a，查看arp緩存區(qū)，此時(shí)物理地址與LB01上10.0.0.3MAC地址一致
將節(jié)點(diǎn)1的keepalived停掉
[root@LB01 ~]# systemctl stop keepalived節(jié)點(diǎn)2接管VIP
[root@LB02 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0?再次查看mac地址，此時(shí)物理地址與LB02上10.0.0.3MAC地址一致
Keepalived故障腦裂
由于某些原因，導(dǎo)致兩臺(tái)keepalived服務(wù)器在指定的時(shí)間內(nèi)，無法檢測(cè)到對(duì)方的心跳，但是兩臺(tái)服務(wù)器都可以正常使用。
一、常見故障原因
1、服務(wù)器網(wǎng)線松動(dòng)等網(wǎng)絡(luò)故障
2、服務(wù)器硬件故障發(fā)生損壞現(xiàn)象而崩潰
3、主備都開啟了firewalld防火墻
二、腦裂故障測(cè)試
1、將主備主機(jī)的防火墻都打開
[root@LB01 ~]# systemctl start firewalld
[root@LB02 ~]# systemctl start firewalld2、將剛剛的配置文件改回去
[root@LB01 ~]# vim /etc/keepalived/keepalived.conf
global_defs {
router_id LB01
}
vrrp_instance VI_1 {
state MASTER
#nopreempt
interface eth0
virtual_router_id 50
priority 150
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.0.3
}
}
[root@LB01 ~]# systemctl restart keepalived
[root@LB02 ~]# cat /etc/keepalived/keepalived.conf
global_defs {
router_id LB02
}
vrrp_instance VI_1 {
state BACKUP
#nopreempt
interface eth0
virtual_router_id 50
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.0.3
}
}
[root@LB02 ~]# systemctl restart keepalived
3、通過抓包查看信息
4、查看LB01和LB02中的IP，發(fā)現(xiàn)都有10.0.0.3
[root@LB01 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0
[root@LB02 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0三、腦裂故障解決方案
解決思路：發(fā)生了腦裂，我們隨便kill掉一臺(tái)即可，可以通過編寫腳本的方式，我們認(rèn)為兩邊的ip add都有10.0.0.3，則發(fā)生了腦裂。我們?cè)贚B01上寫腳本。
做免密鑰方便獲取LB02的ip信息：
[root@LB01 ~]# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:+NyOCiY7aBX8nEPwGeNQHjTLY2EXPKU1o33LTBrm1zk root@LB01
The key's randomart image is:
+---[RSA 2048]----+
| oB.oo= |
| o+o*o= o |
| . =*+o.+ o |
| o.=..o B o . |
| = o So = E |
| . = o .. . |
| .o o . o . |
|...+ . o |
|. .. ... . |
+----[SHA256]-----+
[root@LB01 ~]#
[root@LB01 ~]# ssh-copy-id -i .ssh/id_rsa 10.0.0.6
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
root@10.0.0.6's password:
Number of key(s) added: 1
Now try logging into the machine, with: "ssh '10.0.0.6'"
and check to make sure that only the key(s) you wanted were added.
[root@LB01 ~]# ssh '10.0.0.6' ip add | grep 10.0.0.3 | wc -l #免密鑰測(cè)試
1腳本編寫并執(zhí)行：
[root@LB01 ~]# cat check_split_brain.sh
LB01_VIP_Number=`ip add | grep 10.0.0.3 | wc -l`
LB02_VIP_Number=`ssh '10.0.0.6' ip add | grep 10.0.0.3 | wc -l`
if [ $LB01_VIP_Number -eq 1 -a $LB02_VIP_Number -eq 1 ]
then
systemctl stop keepalived
fi
[root@LB01 ~]# sh check_split_brain.sh
[root@LB01 ~]# ip add | grep 10.0.0.3
[root@LB02 ~]# ip add | grep 10.0.0.3
inet 10.0.0.3/32 scope global eth0Keepalived與Nginx
Nginx默認(rèn)監(jiān)聽在所有的IP地址上，VIP飄到一臺(tái)節(jié)點(diǎn)上，相當(dāng)于Nginx多了VIP這個(gè)網(wǎng)卡，所以可以訪問到Nginx所在的機(jī)器，但是如果Nginx宕機(jī)，會(huì)導(dǎo)致用戶請(qǐng)求失敗，但是keepalived沒有掛掉不會(huì)進(jìn)行切換，就需要編寫腳本檢測(cè)Nginx存活狀態(tài)，如果不存活則kill掉keepalived，讓VIP自動(dòng)飄到備用服務(wù)器。文章來源：http://www.zghlxwxcb.cn/news/detail-458601.html
一、腳本編寫并增加權(quán)限
[root@LB01 ~]# cat check_nginx.sh
nginxpid=`ps -C nginx --no-header|wc -l`
if [ $nginxpid -eq 0 ]
then
systemctl restart nginx &>/etc/null
if [ $? -ne 0 ]
then
systemctl stop keepalived
fi
fi
[root@LB01 ~]# chmod +x check_nginx.sh
[root@LB01 ~]# ll check_nginx.sh
-rwxr-xr-x 1 root root 150 Apr 12 17:37 check_nginx.sh
二、腳本測(cè)試
[root@LB02 ~]# ip add|grep 10.0.0.3 #當(dāng)前VIP不在LB02
[root@LB01 ~]# ip add|grep 10.0.0.3 #當(dāng)前VIP在LB01上
inet 10.0.0.3/32 scope global eth0
[root@LB01 ~]# systemctl stop nginx #關(guān)閉Nginx
[root@LB01 ~]# ip add|grep 10.0.0.3 #VIP依舊在LB0上，因?yàn)镹ginx對(duì)keepalived沒有影響
inet 10.0.0.3/32 scope global eth0
[root@LB01 ~]# vim /etc/nginx/nginx.conf #修改Nginx配置文件，讓其無法重啟，查看是否會(huì)飄到LB02上
ser nginx;
[root@LB01 ~]# sh check_nginx.sh #執(zhí)行腳本
[root@LB01 ~]# ip add|grep 10.0.0.3 #發(fā)現(xiàn)VIP已經(jīng)不在LB02了
[root@LB02 ~]# ip add | grep 10.0.0.3 #VIP飄移到LB02上了
inet 10.0.0.3/32 scope global eth0三、在配置文件內(nèi)中調(diào)用此腳本
[root@LB01 ~]# cat /etc/keepalived/keepalived.conf
global_defs {
router_id LB01
}
#每5秒執(zhí)行一次腳本，腳本執(zhí)行內(nèi)容不能超過5秒，否則會(huì)中斷再次重新執(zhí)行腳本
vrrp_script check_nginx {
script "/root/check_nginx.sh"
interval 5
}
vrrp_instance VI_1 {
state MASTER
#nopreempt
interface eth0
virtual_router_id 50
priority 150
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
10.0.0.3
}
#調(diào)用并運(yùn)行腳本
track_script {
check_nginx
}
}
注意：在Master的keepalived中調(diào)用腳本，搶占式，僅需在Master配置即可。如果配置為非搶占式，那么需要兩臺(tái)服務(wù)器都使用該腳本。我是koten，10年運(yùn)維經(jīng)驗(yàn)，持續(xù)分享運(yùn)維干貨，感謝大家的閱讀和關(guān)注！文章來源地址http://www.zghlxwxcb.cn/news/detail-458601.html
到了這里，關(guān)于【運(yùn)維知識(shí)進(jìn)階篇】集群架構(gòu)-Nginx高可用Keepalived的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
