keepalived配置文件及相关应用

tonwei139

　　一.keepalived介绍
　　

　　Keepalived is a routing software written in C. The main goal of this project is to provide simple and robust facilities for loadbalancing and high-availability to Linuxsystem and Linux based infrastructures. Loadbalancing framework relies on well-knownand widely used Linux Virtual Server (IPVS)kernel module providing Layer4 loadbalancing. Keepalived implements a set of checkersto dynamically and adaptively maintain and manage loadbalanced server pool accordingtheir health. On the other hand high-availability is achieved by VRRP protocol. VRRP is afundamental brick for router failover. In addition, Keepalived implements a set ofhooks to the VRRP finite state machine providing low-level and high-speed protocolinteractions. Keepalived frameworks can be used independently or all together toprovide resilient infrastructures.
　　keepalived 是用c写的路由软件,主要目的是为基于linux的设备提供一个简单强健的,能实现负载均衡和高可用功能的工具."负载均衡"框架基于"IPVS",能调用一系列的"checker" 动态的维护管理负载均衡服务器和后端的RS."高可用"是基于"VRRP"协议的.两者可同时使用.

　　二.keepalived应用
　　

　　1.负载均衡(主要是ipvs),同时不依赖ipvsadm这个包
　　2.高可用,自动failover(主要用于不具备health aware的服务,如nginx)

　　3.自定义脚本,主要是因为keepalived提供了一种机制,可以在server状态改变时执行相应的策略.至于策略是什么,归用户自定义(可以用来煮咖啡)

　　4.动态,静态路由

　　

　　至于如何实现的,网上大把教程
　　

　　三.keepalive配置文件

　　

　　KEEPALIVED.CONF(5)                     KEEPALIVED.CONF(5)

NAME
    /etc/keepalived/keepalived.conf - configuration file for keepalived

DESCRIPTION
    keepalived.conf is  the configuration file which describes all the
    keepalived keywords. keywords are placed in hierachies of blocks (and
    subblocks), each layer being delimited by ’{’ and ’}’ pairs.
　　(配置文件是用{}括起来的多级块)

    Comments start with ’#’ or ’!’ to the end of the line and can start
    anywhere in a line.
    (用#或!来注释,没有多行注释)
TOP HIERACHY
   GLOBAL CONFIGURATION
   
   VRRP CONFIGURATION
   
   LVS CONFIGURATION
   

GLOBAL CONFIGURATION
    contains subblocks of Global defination and static routes
    全局设定包括"全局定义"和"静态路由"


GLOBAL DEFINATION
    global_defs      # Block id
    {
    notification_email  # To:
        {
        admin@example1.com (邮件接收者)
        ...
        }
    # From: from address that will be in header
    notification_email_from admin@example.com (发送者)
    smtp_server 127.0.0.1  # IP
    smtp_connect_timeout 30 # integer, seconds
    router_id my_hostname  # string identifying the machine,标示本机的字符串
                # (doesn’t have to be hostname).
    enable_traps      # enable SNMP traps
    }



STATIC ROUTES
    keepalived can configure static addresses and routes. These addresses
    are NOT moved by vrrpd, they stay on the machine. If you already have
    IPs and routes on your machines and your machines can ping each other,
    you don't need this section.

    The syntax is the same as for virtual addresses and virtual routes.

    static_ipaddress
    {
    192.168.1.1/24 dev eth0 scope global
    ...
    }

    static_routes
    {
    192.168.2.0/24 via 192.168.1.100 dev eth0
    ...
    }


VRRD CONFIGURATION
    contains  subblocks  of  VRRP  synchronization group(s) and VRRP
    instance(s)

    vrrd配置包括"VRRP同步组"和"vrrp实例"
VRRP synchronization group(s)
    #string, name of group of IPs that failover together
    vrrp_sync_group VG_1 {
      group {
       inside_network  # name of vrrp_instance (below)
       outside_network # One for each moveable IP.
       ...
      }

      # notify scripts and alerts are optional
      #
      # filenames of scripts to run on transitions
      # can be unquoted (if just filename) 监测脚本若接收参数,需用括号引用
      # or quoted (if has parameters)
      # to MASTER transition
      notify_master /path/to_master.sh
      # to BACKUP transition
      notify_backup /path/to_backup.sh
      # FAULT transition
      notify_fault "/path/fault.sh VG_1"

      # for ANY state transition.
      # "notify" script is called AFTER the(notify脚本优先级低于nitofy_开头的)
      # notify_* script(s) and is executed
      # with 3 arguments provided by keepalived
      # (ie don’t include parameters in the notify line).
      # arguments
      # $1 = "GROUP"|"INSTANCE"
      # $2 = name of group or instance
      # $3 = target state of transition
      #   ("MASTER"|"BACKUP"|"FAULT")
      notify /path/notify.sh

      # Send email notifcation during state transition,
      # using addresses in global_defs above.
      smtp_alert
    }


VRRP instance(s)
    describes the moveable IP for each instance  of  a  group  in
    vrrp_sync_group.  Here are described two IPs (on inside_network and on
    outside_network), on machine "my_hostname", which belong to the group
    VG_1 and which will transition together on any state change.
    #You will need to write another block for outside_network.
    vrrp_instance inside_network {
      # Initial state, MASTER|BACKUP
      # As soon as the other machine(s) come up,
      # an election will be held and the machine
      # with the highest "priority" will become MASTER.
      # So the entry here doesn’t matter a whole lot.
      state MASTER (这句话其实不重要,重要的是优先级)

      # interface for inside_network, bound by vrrp
      interface eth0(表明vrrp绑定在哪个设备)

      # Use VRRP Virtual MAC.
      use_vmac (虚拟mac地址,不需要设定,kp会自动分配一个)

      # Ignore VRRP interface faults (default unset)
      dont_track_primary (忽略vrrp设备错误)

      # optional, monitor these as well.
      # go to FAULT state if any of these go down.
      track_interface { (跟踪设备,若出错则进入"fault"状态)
       eth0
       eth1
       ...
      }

      #default IP for binding vrrpd is the primary IP
      #on interface. If you want to hide location of vrrpd,
      #use this IP as src_addr for multicast vrrp packets.
      #(since it’s multicast, vrrpd will get the reply
      #packet no matter what src_addr is used).
      #optional
      mcast_src_ip  (定义多播地址)

      # Binding interface for lvs syncd
      lvs_sync_daemon_interface eth1 (把lvs功能绑定在特定网卡)

      # delay for gratuitous ARP after transition to MASTER
      garp_master_delay 10 # secs, default 5 (进入MASTER状态后10秒发送"garp"广播)

      # arbitary unique number 0..255
      # used to differentiate multiple instances of vrrpd
      # running on the same NIC (and hence same socket).
      virtual_router_id 51 (虚拟路由ID,可借此自动分配"VMAC")

      # for electing MASTER, highest priority wins.
      # to be MASTER, make 50 more than other machines.
      priority 100(你懂的-_-)

      # VRRP Advert interval, secs (use default)
      advert_int 1 (广播 间隔)
      authentication {   # Authentication block
        # PASS||AH (认证方式,明码和IPSEC,推荐使用明码)
        # PASS - Simple Passwd (suggested)
        # AH - IPSEC (not recommended))
        auth_type PASS
        # Password for accessing vrrpd.
        # should be the same for all machines.
        # Only the first eight (8) characters are used.
        auth_pass 1234

      #addresses add|del on change to MASTER, to BACKUP.
      #With the same entries on other machines,
      #the opposite transition will be occuring.
      virtual_ipaddress {
        / brd  dev  scope  label
   
        192.168.200.17/24 dev eth1
        192.168.200.18/24 dev eth2 label eth2:1(定义虚拟IP,可指定设备和LABEL)
      }

      #VRRP IP excluded from VRRP
      #optional.
      #For cases with large numbers (eg 200) of IPs
      #on the same interface. To decrease the number
      #of packets sent in adverts, you can exclude
      #most IPs from adverts.
      #The IPs are add|del as for virtual_ipaddress.
      virtual_ipaddress_excluded {  (当一个借口巨量VIP时,排除一些VIP发送过的广播包)
      / brd  dev  scope
      / brd  dev  scope
        ...
      }
      # routes add|del when changing to MASTER, to BACKUP
      virtual_routes { (定义虚拟路由)
        # src  [to] / via|gw   [or
    ] dev  scope  tab
        src 192.168.100.1 to 192.168.109.0/24 via 192.168.200.254 dev
    eth1
        192.168.110.0/24 via 192.168.200.254 dev eth1
        192.168.111.0/24 dev eth2
        192.168.112.0/24 via 192.168.100.254   192.168.113.0/24 via
    192.168.200.254  or  192.168.100.254  dev  eth1    blackhole
    192.168.114.0/24
      }

      # VRRP will normally preempt a lower priority
      # machine when a higher priority machine comes
      # online. "nopreempt" allows the lower priority
      # machine to maintain the master role, even when
      # a higher priority machine comes back online.
      # NOTE: For this to work, the initial state of this
      # entry must be BACKUP.
      nopreempt(VRRP的工作模式分"抢占式"和"非抢占式",后者在优先级比自己高的机器上线时,不转让资源)

      # Seconds after startup until preemption
      # (if not disabled by "nopreempt").
      # Range: 0 (default) to 1,000
      # NOTE: For this to work, the initial state of this
      # entry must be BACKUP.(机器上线后,等5分钟再抢占,初始state必须是backup)
      preempt_delay 300  # waits 5 minutes

      # Debug level, not implemented yet.
      debug (找虫子)

      # notify scripts, alert as above
      notify_master | (状态变为MASTER时运行脚本)
      notify_backup |
      notify_fault |
      notify |
      smtp_alert (邮件警报)
    }


LVS CONFIGURATION
    contains subblocks of Virtual server group(s) and Virtual server(s)

    The subblocks contain arguments for _i_p_v_s_a_d_m_(_8_)_.  A knowlege  of
    _i_p_v_s_a_d_m_(_8_) will be helpful here.


Virtual server group(s)
    # optional(这个组允许一个RS上的一个服务属于多个虚拟服务,而只健康检查一次)
    # this groups allows a service on a real_server
    # to belong to multiple virtual services
    # and to be only health checked once.
    # Only for very large LVSs.
    virtual_server_group  {
        #VIP port
         
         
        ...
        #
        #  has the form
        # XXX.YYY.ZZZ.WWW-VVV eg 192.168.200.1-10
        # range includes both .1 and .10 address
         # VIP range VPORT
         
        ...
        fwmark  # fwmark (防火墙标记)
        fwmark
        ... }


VIRTUAL SERVERS
    A virtual_server can be a declaration of one of

    vip vport (IPADDR PORT pair)

    fwmark

    (virtual server) group

         #setup service
         virtual_server IP port |(tcp类型vs)
         virtual_server fwmark int |(防火墙类型vs)
         virtual_server group string(vs组)
         {
         # delay timer for service polling
         delay_loop

         # LVS scheduler
         lb_algo rr|wrr|lc|wlc|lblc|sh|dh (算法)
         # LVS forwarding method
         lb_kind NAT|DR|TUN (类型)
         # LVS persistence timeout, sec
         persistence_timeout  (持久连接时间)
         # LVS granularity mask (-M in ipvsadm)
         persistence_granularity  (啥是持久连接力度,为啥跟掩码?)
         # Only TCP is implemented
         protocol TCP
         # If VS IP address is not set,
         # suspend healthchecker’s activity
         ha_suspend (如果VIP没设定,不进行RS健康检查)

         # VirtualHost string for HTTP_GET or SSL_GET
         # eg virtualhost www.firewall.loc
         virtualhost

         # Assume silently all RSs down and healthchecks
         # failed on start. This helps preventing false
         # positive actions on startup. Alpha mode is
         # disabled by default.
         alpha (这些都是啥/? o_0)

         # On daemon shutdown, consider quorum and RS
         # down notifiers for execution, where appropriate.
         # Omega mode is disabled by default.
         omega

         # Minimum total weight of all live servers in
         # the pool necessary to operate VS with no
         # quality regression. Defaults to 1.
         quorum

         # Tolerate this much weight units compared to the
         # nominal quorum, when considering quorum gain
         # or loss. A flap dampener. Defaults to 0.
         hysteresis

         # Script to launch when quorum is gained.
         quorum_up |

         # Script to launch when quorum is lost.
         quorum_down |


         # setup realserver(s)

         # RS to add when all realservers are down
         sorry_server   (全部RS都挂了,就转移到这台机器上)

         # one entry for each realserver
         real_server  
           {
             # relative weight to use, default: 1
             weight
             # Set weight to 0
             # when healthchecker detects failure
             inhibit_on_failure (检测到错误就将此RS权重降低至0)

             # Script to launch when healthchecker
             # considers service as up.
             notify_up | (RS起来了,就触发一个脚本)
             # Script to launch when healthchecker
             # considers service as down.
             notify_down |

             # pick one healthchecker(检测方式)
             # HTTP_GET|SSL_GET|TCP_CHECK|SMTP_CHECK|MISC_CHECK

             # HTTP and SSL healthcheckers
             HTTP_GET|SSL_GET
             {
               # A url to test
               # can have multiple entries here
               url {
                #eg path / , or path /mrtg2/
                path
                # healthcheck needs status_code
                # or status_code and digest
                # Digest computed with genhash
                # eg digest 9b3a0c85a887a256d6939da88aabd8cd
                digest
                # status code returned in the HTTP header
                # eg status_code 200
                status_code  (根据http状态码来检测)
               }
               #IP, tcp port for service on realserver
               connect_port  连接哪个端口
               bindto  
               # Timeout connection, sec
               connect_timeout (连接超时)
               # number of get retry
               nb_get_retry (重试次数)
               # delay before retry
               delay_before_retry (重试间隔)
             } #HTTP_GET|SSL_GET

             #TCP healthchecker (bind to IP port)
             TCP_CHECK
             {
               connect_port (检测哪个端口)
               bindto
               connect_timeout
             } #TCP_CHECK

             # SMTP healthchecker(smtp用的不多吧?)
             SMTP_CHECK
             {
               # An optional host interface to check.
               # If no host directives are present, only
               # the ip address of the real server will
               # be checked.
               host {
                # IP address to connect to
                connect_ip
                # Optional port to connect to if not
                # the default of 25
                connect_port
                # Optional interface to use to
                # originate the connection
                bindto
              }
              # Connection and read/write timeout
              # in seconds
              connect_timeout
              # Number of times to retry a failed check
              retry
              # Delay in seconds before retrying
              delay_before_retry
              # Optional string to use for the smtp HELO request
              helo_name |
             } #SMTP_CHECK

             #MISC healthchecker, run a program
             MISC_CHECK
             {
               # External system script or program
               misc_path |
               # Script execution timeout
               misc_timeout

               # If set, exit code from healthchecker is used
               # to dynamically adjust the weight as follows:
               #  exit status 0: svc check success, weight
               #   unchanged.
               #  exit status 1: svc check failed.
               #  exit status 2-255: svc check success, weight
               #   changed to 2 less than exit status.
               #  (for example: exit status of 255 would set
               #   weight to 253)
               misc_dynamic
             }
           } # realserver defn
         } # virtual service






4th Berkeley Distribution     Jan 2004         KEEPALIVED.CONF(5)