Keepalived 介绍
keepalived 基于 VRRP(虚拟路由冗余协议)实现高可用。
-
核心原理是通过竞选机制在多台服务器(主 / 备节点)中选举出一台主节点承担服务,同时备节点持续监控主节点状态:主节点正常时,通过组播发送 VRRP 通告消息宣告存活,独占虚拟 IP(VIP)对外提供服务;
-
当主节点故障(如服务中断、网络异常),备节点因超时未收到通告,会触发重新竞选,优先级最高的备节点升级为主节点并接管 VIP,实现服务无缝切换,确保业务不中断;
-
此外,keepalived 还支持健康检查(如检测端口、URL 状态),可更精准判断服务可用性。
VRRP 原理
-
VRRP(虚拟路由冗余协议)是一种实现路由冗余的协议,核心是通过将多台物理路由器组成一个 “虚拟路由器”,对外提供统一的虚拟 IP(VIP)和虚拟 MAC 地址,避免单点故障;
-
工作时,虚拟路由器内的设备通过优先级竞选主 / 备角色:优先级最高的成为主路由器,承担数据包转发任务,并定期发送 VRRP 通告消息(组播)宣告存活;
-
备份路由器则监听通告,若超时未收到主路由器消息(判定主节点故障),则触发重新竞选,优先级最高的备份节点升级为主路由器,接管 VIP 和虚拟 MAC,继续提供路由服务,整个过程对客户端透明,确保网络持续可用。
Keepalived = VRRP 协议 + 健康检查 + VIP 漂移脚本化,网络层看 224.0.0.18,主机层看 /var/log/messages,应用层看 track_script。
| 现象 | 可能原因 | 定位手段 |
|---|---|---|
| 主备来回漂(flapping) | 1. 网络抖动丢包 2. track_script 误判 | 1. tcpdump -i eth0 host 224.0.0.18 2. 看 /var/log/messages 中 “VRRP_Instance … Entering MASTER/BACKUP” 日志 |
| VIP 飘走不回归 | nopreempt 导致主恢复后不复位 | 去掉 nopreempt 或手动重启 keepalived |
| 双主同时拥有 VIP | 1. VRID 冲突(多台机器用了相同 VRID) 2. 防火墙拦截组播 | 1. 检查所有节点 VRID 唯一性 2. firewall-cmd --add-rich-rule=‘rule protocol value=“vrrp” accept’ |
| 健康检查不生效 | track_script 路径/权限/语法错误 | keepalived -n -D -l 前台调试看输出 |
Keepalived 相关配置
Keepalived 日志功能启用
vim /etc/sysconfig/keepalived
########
KEEPALIVED_OPTIONS="-D -S 6"
########
vim /etc/rsyslog.conf
########
local7.* /var/log/boot.log
local6.* /var/log/keepalived.log # 添加此条
########
systemctl restart rsyslog.service
systemctl restart keepalived.service
# 测试:
cat /var/log/keepalived.log

Keepalived 独立子配置文件
vim /etc/keepalived/keepalived.conf
######
include /etc/keepalived/conf.d/*.conf # 在主配置文件添加
######
# 检查语法
keepalived -t -f /etc/keepalived/keepalived.conf
# 重启服务
systemctl restart keepalived.service
Keepalived 实战部署
Keepalived 单主模式
实验准备:两台 keepalived 主机,两台 rs 主机,一台 client 主机
ka-master 主机:192.168.67.100
ka-slave 主机:192.168.67.200
rs1主机:192.168.13.10
rs2 主机:192.168.13.20
keepalived 主机配置
# 时间同步
# 100 作为服务vim /etc/chrony.conf端,200 作为客户端
# 服务端配置(100)
vim /etc/chrony.conf
...
allow 192.168.67.0/24 # 开启服务端允许 67 网段连接本机
...
systemctl restart chronyd.service
#客户端配置(200)
vim /etc/chrony.conf
...
server 192.168.67.100 iburst
...
systemctl restart chronyd.service
# 客户端测试:查看时间同步结果,显示 ^* 则同步成功
chronyc sources -v

# 安装 keepalived 并配置
dnf install keepalived -y
vim /etc/keepalived/keepalived.conf
##################
...
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
# vrrp_strict
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44
}
vrrp_instance VI_1 {
state MASTER # slave 主机设置为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # 优先级,slave 主机设置为 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
...
# 其他都注释掉
##################
# 重启服务
systemctl restart keepalived.service
systemctl enable --now keepalived.service
# 测试:在优先级高的主机上查看 VIP
ifconfig

# 查看组播情况
tcpdump -i eth0 -nn host 224.0.0.44

master 的主机会发送组播消息,告诉 slave 的主机自己存活,如果 master 的主机故障,则会出现 VIP 漂移到 slave 的主机。
如果 master 主机恢复运行,VIP 会重新漂移到 master 主机,因为 master 主机的优先级高于 slave 主机。
Keepalived 非抢占模式
在抢占模式的基础上,修改 Keepalived 主机配置文件
vim /etc/keepalived/keepalived.conf
#######
vrrp_instance VI_1 {
state BACKUP # 两个主机的 state 都需要是 BACKUP,因为非抢占模式没有主备之分
interface eth0
virtual_router_id 51
priority 100 # 优先级,另一台主机设置为 80
nopreempt # 在抢占模式的基础上,添加此条,实现非抢占模式
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
#######
#测试
systemctl restart keepalived.service

# 停止 master 主机服务
# 发生 VIP 漂移
systemctl stop keepalived.service

# 再次重启 master 服务,VIP 不发生漂移
# master 优先级高于 slave 主机,但是服务恢复后,不发生 VIP 抢占
systemctl start keepalived.service
# VIP 仍然在 slave 上

非抢占模式弊端:如果 slave 主机的性能没有 master 主机好,那么让 slave 注意一直承载 VIP 会发生性能瓶颈,所以出现了延迟抢占模式。
Keepalived 延迟抢占模式
在抢占模式的基础上,修改 Keepalived 主机配置文件
vim /etc/keepalived/keepalived.conf
#######
vrrp_instance VI_1 {
state BACKUP # 延迟抢占模式两台主机都为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # slave 主机优先级 80
preempt_delay 10 # 延迟时间配置,默认时间单位 s,不用加 s
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
#######
#测试:延迟抢占模式,master 主机故障,VIP 会漂移到 slave 主机,如果 master 主机恢复 VIP 会在设置的延迟抢占时间完毕后抢占 VIP。
systemctl stop keepalived.service
master 没有 VIP,VIP 漂移到 slave 上

延时10秒后VIP回到master

Keepalived 单播模式
因为 Keepalived 的心跳检测默认是发送组播的形式保活,会造成网络拥堵,所以需要配置单播模式,减少网络流量。
vim /etc/keepalived/keepalived.conf
#######
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 100
preempt_delay 10
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
unicast_src_ip 192.168.67.100 # 本机 IP,注意:两台主机需按需配置
unicast_peer {
192.168.67.200 # 对端主机 IP,注意:两台主机需按需配置
}
}
#######
#测试
# 在承载 vIP 的主机上查看单播情况
tcpdump -i eth0 -nn src host 192.168.67.100 and dst 192.168.67.200

Keepalived 邮件告警
Keepalived 下载软件
注意:Keepalived 主机的主机名要是域名的模式,这样发邮件才不会被卡住。
# 配置主机名
hostnamectl set-hostname ka.ch.com
# 下载软件
dnf install s-nail sendmail -y
vim /etc/mail.rc
######
set from=2678804513@qq.com
set smtp=smtp.qq.com
set smtp-auth-user=2678804513@qq.com
set smtp-auth-password=tdfniezpkroedadj # 此验证码要到邮箱里开启 POP3/IMAP/SMTP/Exchange/CardDAV 服务并获得
set smtp-auth=login
set ssl-verify=ignore
######
systemctl restart sendmail.service
netstat -antlupe | grep 25

# 测试邮件是否可以发出
echo haha | mailx -s test 2678804513@qq.com

vim /etc/keepalived/mail.sh
######
#!/bin/bash
mail_dest='zhaoyz0911@163.com'
mail_send()
{
mail_subj="$HOSTNAME to be $1 vip 转移"
mail_mess="`date +%F\ %T`: vrrp 转移,$HOSTNAME 变为 $1"
echo "$mail_mess" | mail -s "$mail_subj" $mail_dest
}
case $1 in
master)
mail_send master
;;
backup)
mail_send backup
;;
fault)
mail_send fault
;;
*)
exit 1
;;
esac
######
chmod +x /etc/keepalived/mail.sh
# 修改 Keepalived 配置文件,添加 keepalived 的状态变化时,可以自动触发脚本的功能
vim /etc/keepalived/keepalived.conf
######
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
# vrrp_strict
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44
enable_script_security # 启用脚本安全机制,限制健康检查脚本的执行权限
script_user root # 指定健康检查脚本的执行用户为 root
}
vrrp_instance VI_1 {
state BACKUP
interface eth0
virtual_router_id 51
priority 100
preempt_delay 10
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
unicast_src_ip 192.168.67.100
unicast_peer {
192.168.67.200
}
notify_master "/etc/keepalived/mail.sh master" # 当当前节点从其他状态切换为 master 状态时触发
notify_backup "/etc/keepalived/mail.sh backup" # 当当前节点从其他状态切换为 backup 状态时触发
notify_fault "/etc/keepalived/mail.sh faild" #当前节点因故障进入 fault 状态时触发
}
######
#测试
systemctl restart keepalived.service

Keepalived 双主模式
Keepalived 主机配置
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44
}
vrrp_instance WEB_VIP {
state MASTER # 第二台 Keepalived 主机改为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # 第二台 Keepalived 主机改为 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
vrrp_instance DB_VIP {
state BACKUP # 第二台 Keepalived 主机改为 MASTER
interface eth0
virtual_router_id 52
priority 80 # 第二台 Keepalived 主机改为 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.160/24 dev eth0 label eth0:1
}
}
#测试
systemctl restart keepalived.service


关闭一台 Keepalived 主机,VIP 自动漂移到第二台 Keepalived 主机,则有两个 VIP

Keepalived 高可用部署
Keepalived + LVS - DR 单主模式
实验准备:关闭所有主机的 SElinux 和 防火墙,全都为 NAT 模式网卡
client:192.168.67.123
ka-master:192.168.67.100、VIP:192.168.67.150
ka-slave:192.168.67.200、VIP:192.168.67.150
rs1:192.168.67.10、VIP:192.168.67.150
rs2:198.168.67.20、VIP:192.168.67.150
后端 rs 配置
配置 nginx 服务、配置虚拟网卡添加 VIP、arp 抑制
yum install nginx -y
echo 192.168.67.10 > /usr/share/nginx/html/index.html # 另一个主机配置自己的 IP 作为默认发布文件内容
systemctl enable --now nginx
curl localhost

# 两个主机都需要配置 VIP
nmcli connection add type dummy ifname rstest ipv4.method manual ipv4.addresses 192.168.67.150/32 connection.autoconnect yes
nmcli connection up dummy-rstest
ip a

# arp 抑制
echo net.ipv4.conf.all.arp_ignore = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.rstest.arp_ignore = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.all.arp_announce = 2 >> /etc/sysctl.conf
echo net.ipv4.conf.rstest.arp_announce = 2 >> /etc/sysctl.conf
sysctl -p
Keppalived 主机配置
#安装 ipvsadm 工具、配置 Keepalived 实现后端检测和负载均衡
yum install ipvsadm -y
#修改 Keepalived 配置文件
vim /etc/keepalived/keepalived.conf
########
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44 # 组播
}
vrrp_instance WEB_VIP {
state MASTER # 另一个主机设置为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # 另一个主机设置为 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
virtual_server 192.168.67.150 80 { # 类似于 ipvsadm -A 调度主机
delay_loop 6
lb_algo rr
lb_kind DR
protocol TCP
real_server 192.168.67.10 80 { # 类似于 ipvsadm -a 后端主机
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 2
retry 3
delay_before_retry 3
}
}
real_server 192.168.67.20 80 { # 类似于 ipvsadm -a 后端主机
weight 1
TCP_CHECK {
connect_timeout 2
retry 3
delay_before_retry 3
connect_port 80
}
}
}
########
systemctl restart keepalived.service
测试

Keepalived + LVS - DR 双主模式
实验准备:关闭所有主机的 SElinux 和 防火墙,全都为 NAT 模式网卡
后端 rs 配置
配置 nginx 服务:安装软件、默认发布文件、测试
配置虚拟网卡添加 VIP、arp 抑制
yum install nginx -y
echo 192.168.67.10 > /usr/share/nginx/html/index.html # 另一个主机配置自己的 IP 作为默认发布文件内容
systemctl enable --now nginx
curl localhost

# arp 抑制
echo net.ipv4.conf.all.arp_ignore = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.rstest.arp_ignore = 1 >> /etc/sysctl.conf
echo net.ipv4.conf.all.arp_announce = 2 >> /etc/sysctl.conf
echo net.ipv4.conf.rstest.arp_announce = 2 >> /etc/sysctl.conf
sysctl -p

配置 Mariadb 服务:安装软件、配置 server-id、授权用
# 安装 mariadb
yum install mariadb-server -y
vim /etc/my.cnf.d/mariadb-server.cnf
[mysqld]
...
server-id=10 # 添加此行,注意两个主机的 id 需要不一致
...
systemctl enable --now mariadb
mysql -e "grant all on *.* to ch@'%' identified by 'ch'" # 添加可远程登录的用户
# 测试:远程登录 mysql
mysql -uch -pch -h192.168.13.10
mysql -uch -pch -h192.168.13.20
测试

Keppalived 主机配置
#安装 ipvsadm 工具、配置 Keepalived 实现后端检测和负载均衡
yum install ipvsadm -y
#修改 Keepalived 配置文件:双主模式,需要配置两个 vrrp_instance 和两个virtual_server,一个提供 Web 服务,一个提供 Mysql 服务。
vim /etc/keepalived/keepalived.conf
########
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44 # 组播
}
vrrp_instance WEB_VIP {
state MASTER # 另一个主机设置为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # 另一个主机设置为 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
}
vrrp_instance DB_VIP {
state BACKUP # 另一个主机设置为 MASTER
interface eth0
virtual_router_id 52
priority 80 # 另一个主机设置为 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.160/24 dev eth0 label eth0:1
}
}
virtual_server 192.168.67.150 80 { # 提供 Web 服务的 VIP,端口 80
delay_loop 6
lb_algo rr
lb_kind DR
protocol TCP
real_server 192.168.67.10 80 { # 提供 Web 服务的 RS1,端口80
weight 1
HTTP_GET {
url {
path /
status_code 200
}
connect_timeout 2
retry 3
delay_before_retry 3
}
}
real_server 192.168.67.20 80 { # 提供 Web 服务的 RS2,端口80
weight 1
TCP_CHECK {
connect_timeout 2
retry 3
delay_before_retry 3
connect_port 80
}
}
}
virtual_server 192.168.67.160 3306 { # 提供 Mysql 服务的 VIP,端口 3306
delay_loop 6
lb_algo rr
lb_kind DR
protocol TCP
real_server 192.168.67.10 3306 { # 提供 Mysql 服务的 RS1,端口 3306
weight 1
TCP_CHECK {
connect_timeout 10
retry 3
delay_before_retry 5
connect_port 3306
}
}
real_server 192.168.67.20 3306 { # 提供 Mysql 服务的 RS2,端口 3306
weight 1
TCP_CHECK {
connect_timeout 10
retry 3
delay_before_retry 5
connect_port 3306
}
}
}
########
systemctl restart keepalived.service
测试

Keepalived + HAProxy(Vrrp)脚本检测修改优先级
Haproxy 实现后端检测和流量分发,Keepalived 实现 HAProxy 的健康检测,如果 HAProxy 故障,通过 VRRP 健康检测脚本实现动态改变优先级,实现 VIP 的漂移。Keepalived + HAProxy 模式只能使用抢占模式和延迟抢占模式,不适用于非抢占模式。
后端 rs 配置
配置 nginx 服务:安装软件、默认发布文件、测试
yum install nginx -y
echo 192.168.67.10 > /usr/share/nginx/html/index.html # 另一个主机配置自己的 IP 作为默认发布文件内容
systemctl enable --now nginx
curl localhost
Keepalived 主机配置 HAProxy 服务
yum install haproxy -y
vim /etc/haproxy/haproxy.cfg
# 除以下内容都注释掉
##########
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats
ssl-default-bind-ciphers PROFILE=SYSTEM
ssl-default-server-ciphers PROFILE=SYSTEM
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
listen webcluster
bind *:80
mode http
balance roundrobin
server web1 192.168.67.10:80 check inter 3 fall 2 rise 2
server web2 192.168.67.20:80 check inter 3 fall 2 rise 2
#############
建立测试脚本
mkdir /etc/keepalived/scrips/
cat >> /etc/keepalived/scrips/haproxy.sh << EOF
#!/bin/bash
killall -0 haproxy &> /dev/null
EOF
chmod +x /etc/keepalived/scrips/haproxy.sh
vim /etc/keepalived/keepalived.conf
#############
! Configuration File for keepalived
global_defs {
notification_email {
haha@haha.org
}
notification_email_from haha@haha.org
smtp_server 127.0.0.0
smtp_connect_timeout 30
router_id ka-master
vrrp_skip_check_adv_addr
vrrp_garp_interval 1
vrrp_gna_interval 1
vrrp_mcast_group4 224.0.0.44
enable_script_security # 启用脚本安全检查机制
script_user root # 指定执行脚本时使用的用户身份为 root
}
vrrp_script TEST_CHECK { # 定义健康检查脚本
script "/etc/keepalived/scrips/haproxy.sh" # 脚本路径
interval 1 # 脚本执行间隔,每1秒检查一次
weight -30 # 脚本返回值非 0 时,当前节点优先级减少30
fall 2 # 连续失败2次后,判定服务异常
rise 2 # 连续成功2次后,判定服务恢复正常
timeout 2 # 脚本执行超时时间,超过2秒视为执行失败
}
vrrp_instance WEB_VIP {
state MASTER # 第二台主机配置为 BACKUP
interface eth0
virtual_router_id 51
priority 100 # 第二台主机配置为 80
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
192.168.67.150/24 dev eth0 label eth0:0
}
track_script { # 关联健康检查脚本
TEST_CHECK # 引用上面定义的 TEST_CHECK 脚本,监控haproxy 状态
}
unicast_src_ip 192.168.67.100 # 单播配置:源 IP,第二台主机配置为本机 IP
unicast_peer {
192.168.67.200 # 单播配置:目标 IP,第二台主机配置为对方 IP
}
}
#############
echo net.ipv4.ip_nonlocal_bind = 1 >> /etc/sysctl.conf
sysctl -p
systemctl start keepalived.service
systemctl enable --now keepalived.service
systemctl start haproxy
systemctl enable --now haproxy
5458

被折叠的 条评论
为什么被折叠?



