Keepalived, VRRP, active-passive failover, VIP
Keepalived, VRRP, active-passive failover, виртуальный IP (VIP).
┌─────────────────┐
│ Virtual IP │
│ 192.168.1.100 │
└────────┬────────┘
│
┌────────────────┼────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────┐ ┌──────────────┐
│ HAProxy 1 │ │ HAProxy 2 │
│ MASTER │ │ BACKUP │
│ 192.168.1.10 │ │ 192.168.1.11 │
└──────────────┘ └──────────────┘
│ │
└────────┬───────┘
│
▼
┌─────────────────┐
│ Backend Servers│
└─────────────────┘
Принцип работы:
VRRP (Virtual Router Redundancy Protocol):
Параметры:
priority — приоритет узла (100 = MASTER, 90 = BACKUP)advert_int — интервал объявлений (1 секунда)virtual_router_id — ID группы VRRPsudo apt update
sudo apt install keepalivedkeepalived -v/etc/keepalived/
└── keepalived.conf
# /etc/keepalived/keepalived.conf
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight -20
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass haproxy123
}
virtual_ipaddress {
192.168.1.100/24
}
track_script {
check_haproxy
}
notify_master "/etc/keepalived/master.sh"
notify_backup "/etc/keepalived/backup.sh"
notify_fault "/etc/keepalived/fault.sh"
}# /etc/keepalived/keepalived.conf
vrrp_script check_haproxy {
script "killall -0 haproxy"
interval 2
weight -20
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass haproxy123
}
virtual_ipaddress {
192.168.1.100/24
}
track_script {
check_haproxy
}
}#!/bin/bash
# /etc/keepalived/master.sh
# Запуск HAProxy
systemctl start haproxy
# Логирование
logger "Keepalived: became MASTER"
# Отправка уведомления (опционально)
# curl -X POST -d "HAProxy is MASTER" https://alerts.example.com/webhook#!/bin/bash
# /etc/keepalived/backup.sh
# Остановка HAProxy (экономия ресурсов)
systemctl stop haproxy
# Логирование
logger "Keepalived: became BACKUP"#!/bin/bash
# /etc/keepalived/fault.sh
# Логирование
logger "Keepalived: entered FAULT state"
# Отправка алерта
curl -X POST -d "HAProxy in FAULT state" https://alerts.example.com/webhookПрава:
chmod +x /etc/keepalived/*.shvrrp_script check_haproxy {
script "/etc/keepalived/check_haproxy.sh"
interval 2
weight -20
fall 3
rise 2
}Скрипт проверки:
#!/bin/bash
# /etc/keepalived/check_haproxy.sh
# Проверка через stats socket
echo "show info" | socat /var/run/haproxy/admin.sock stdio > /dev/null 2>&1
if [ $? -eq 0 ]; then
exit 0
else
exit 1
fivrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
virtual_ipaddress {
192.168.1.100/24
192.168.1.101/24
}
}vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
preempt_delay 300 # Ждать 5 минут перед возвратом VIP
# ...
}Поведение:
preempt_delay предотвращает flappingvrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
nopreempt # Не возвращать VIP автоматически
# ...
}Поведение:
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
unicast_src_ip 192.168.1.10
unicast_peer {
192.168.1.11
}
virtual_ipaddress {
192.168.1.100/24
}
}Преимущества:
#!/bin/bash
# /etc/keepalived/master.sh
# Ассоциация Elastic IP
aws ec2 associate-address \
--instance-id i-12345678 \
--allocation-id eipalloc-12345678 \
--region us-east-1
logger "Keepalived: associated Elastic IP"#!/bin/bash
# /etc/keepalived/master.sh
# Добавление IP alias
gcloud compute instances create-address haproxy-1 \
--address 192.168.1.100 \
--region us-central1
logger "Keepalived: associated IP alias"global
log /dev/log local0
maxconn 50000
defaults
log global
mode http
timeout connect 5s
timeout client 30s
timeout server 30s
frontend https_front
bind *:443 ssl crt /etc/haproxy/certs/site.pem
default_backend web_servers
backend web_servers
balance roundrobin
option httpchk GET /health
server web1 192.168.1.20:8080 check
server web2 192.168.1.21:8080 check# /etc/keepalived/keepalived.conf
vrrp_script check_haproxy {
script "/etc/keepalived/check_haproxy.sh"
interval 2
weight -20
fall 3
rise 2
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 51
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass haproxy123
}
virtual_ipaddress {
192.168.1.100/24
}
track_script {
check_haproxy
}
notify_master "/etc/keepalived/master.sh"
notify_backup "/etc/keepalived/backup.sh"
notify_fault "/etc/keepalived/fault.sh"
}# /etc/keepalived/keepalived.conf
vrrp_script check_haproxy {
script "/etc/keepalived/check_haproxy.sh"
interval 2
weight -20
fall 3
rise 2
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 90
advert_int 1
authentication {
auth_type PASS
auth_pass haproxy123
}
virtual_ipaddress {
192.168.1.100/24
}
track_script {
check_haproxy
}
}# Статус Keepalived
systemctl status keepalived
# Проверка VIP
ip addr show eth0 | grep 192.168.1.100
# Логи
journalctl -u keepalived -f
# VRRP пакеты
tcpdump -i eth0 vrrp# Установка keepalived exporter
docker run -d \
--name keepalived-exporter \
-p 9165:9165 \
containeroo/keepalived-exporterPrometheus config:
scrape_configs:
- job_name: 'keepalived'
static_configs:
- targets: ['keepalived-exporter:9165']groups:
- name: keepalived
rules:
- alert: KeepalivedBackup
expr: keepalived_vrrp_state == 2
for: 5m
labels:
severity: warning
annotations:
summary: "Keepalived в BACKUP режиме"
- alert: KeepalivedFault
expr: keepalived_vrrp_state == 3
for: 1m
labels:
severity: critical
annotations:
summary: "Keepalived в FAULT режиме"# Синтаксис keepalived
keepalived --config-test
# Проверка файлов
ls -la /etc/keepalived/
cat /etc/keepalived/keepalived.conf# Прослушивание VRRP пакетов
tcpdump -i eth0 vrrp -n
# Статус
ip addr show eth0
# Логи
journalctl -u keepalived -f# VRRP не работает
# Проверить firewall (VRRP использует protocol 112)
sudo iptables -A INPUT -p vrrp -j ACCEPT
# VIP не назначается
# Проверить что virtual_router_id одинаковый
# Проверить что priority MASTER > BACKUP
# Частые failover
# Увеличить advert_int
# Включить preempt_delay
# ✅ Хорошо
MASTER: priority 100
BACKUP: priority 90
# Разница 10+ для стабильности
# ❌ Плохо
MASTER: priority 100
BACKUP: priority 99
# Слишком близко, возможны flapping# ✅ Хорошо
vrrp_script check_haproxy {
script "/etc/keepalived/check_haproxy.sh"
interval 2
fall 3
rise 2
}
# ❌ Плохо
# interval 1 # Слишком агрессивно
# fall 1 # Ложные срабатывания# ✅ Хорошо
# - Выделенный network interface для VRRP
# - Unicast для облачных сред
# - Firewall разрешает VRRP (protocol 112)
# ❌ Плохо
# - Multicast в облаках (не поддерживается)
# - Блокировка VRRP firewallИзучим HAProxy в Docker и Kubernetes: ingress controller, helm charts.
Вопросы ещё не добавлены
Вопросы для этой подтемы ещё не добавлены.