Keepalived+HAproxy实现HA

 Keepalived 提供 VRPP 实现，并允许您配置 Linux 机器使负载均衡，预防单点故障。HAProxy 提供可靠、高性能的负载均衡，能与 Keepalived 完美配合

yum install keepalived haproxy psmisc -y

配置HAProxy

vi /etc/haproxy/haproxy.cfg
global
log /dev/log local0 warning
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon

stats socket /var/lib/haproxy/stats

defaults
log global
option httplog
option dontlognull
timeout connect 5000
timeout client 50000
timeout server 50000

frontend kube-apiserver
bind *:6443
mode tcp
option tcplog
default_backend kube-apiserver

backend kube-apiserver
mode tcp
option tcplog
option tcp-check
balance roundrobin
default-server inter 10s downinter 5s rise 2 fall 2 slowstart 60s maxconn 250 maxqueue 256 weight 100
server 后端服务器1的主机名 172.16.0.4:6443 check
server 后端服务器2的主机名 172.16.0.5:6443 check
server 后端服务器13的主机名 172.16.0.6:6443 check


systemctl restart haproxy
systemctl enable haproxy


为什么KeepAlived会在多台主机之间漂移？没看过VRRP协议，但是猜测：

1. keepalived进程都是守护进程，彼此之间肯定是互相通信的，就好像打仗，拿着红旗冲锋，大家都知道红旗在谁手上，一旦某人挂了，其他的某个人会继续把红旗捡起来，往前冲

2. Keepalived肯定调用了某个Linux的命令或者API，给某个网卡再分配一个IP地址，这个我来查一下，也就是说一个网卡上其实是可以有多个IP地址的

vi /etc/keepalived/keepalived.conf
global_defs {
notification_email {
}
router_id LVS_DEVEL
vrrp_skip_check_adv_addr
vrrp_garp_interval 0
vrrp_gna_interval 0
}

vrrp_script chk_haproxy {
script "killall -0 haproxy"
interval 2
weight 2
}

vrrp_instance haproxy-vip {
state BACKUP
priority 100
interface eth0 # 每台安装了Keepalived的主机的网卡名称，一般是eth0
virtual_router_id 60
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
unicast_src_ip 172.16.0.2 # 主机IP地址
unicast_peer {
172.16.0.3 # 组成Keepalived集群的另外一个主机的IP地址
}

virtual_ipaddress {
172.16.0.10/24 # 这个是虚拟IP地址，会在多个Keepalived主机之间漂移
}

track_script {
chk_haproxy
}
}


看看172.16.0.2上面是否还有一个虚拟IP地址？ 确实有，如下图，此时如果把0.2机器关掉，看看0.3上面是否有这个虚拟IP，也就是说VIP会漂移

[root@lb1 ~]# ip a s
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:9e:27:38:c8 brd ff:ff:ff:ff:ff:ff
inet 172.16.0.2/24 brd 172.16.0.255 scope global noprefixroute dynamic eth0
valid_lft 73334sec preferred_lft 73334sec
inet 172.16.0.10/24 scope global secondary eth0 # The VIP address
valid_lft forever preferred_lft forever
inet6 fe80::510e:f96:98b2:af40/64 scope link noprefixroute
valid_lft forever preferred_lft forever


可以看到0.2上面的VIP已经没有了
[root@lb1 ~]# ip a s
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:9e:27:38:c8 brd ff:ff:ff:ff:ff:ff
inet 172.16.0.2/24 brd 172.16.0.255 scope global noprefixroute dynamic eth0
valid_lft 72802sec preferred_lft 72802sec
inet6 fe80::510e:f96:98b2:af40/64 scope link noprefixroute
valid_lft forever preferred_lft forever
现在172.16.0.10/24已经跑到0.3这台机器上了
[root@lb2 ~]# ip a s
1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 52:54:9e:3f:51:ba brd ff:ff:ff:ff:ff:ff
inet 172.16.0.3/24 brd 172.16.0.255 scope global noprefixroute dynamic eth0
valid_lft 72690sec preferred_lft 72690sec
inet 172.16.0.10/24 scope global secondary eth0 # The VIP address
valid_lft forever preferred_lft forever
inet6 fe80::f67c:bd4f:d6d5:1d9b/64 scope link noprefixroute
valid_lft forever preferred_lft forever


ens33: flags=4163 mtu 1500
inet 192.168.2.70 netmask 255.255.255.255 broadcast 192.168.2.70
inet6 fe80::20c:29ff:fe80:1c9d prefixlen 64 scopeid 0x20
ether 00:0c:29:80:1c:9d txqueuelen 1000 (Ethernet)
RX packets 908297 bytes 752709326 (717.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 260326 bytes 122095022 (116.4 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0


实际上Linux是可以通过给网卡添加子网卡的方式来添加一个IP地址的，这就是Linux的辅助IP(secondary ip address)，辅助IP则是由linux系统的ip命令创建和维护的，ip addr add创建的辅助IP用ifconfig是无法看到的，keepalived就是是用的辅助IP提供服务。