ARTICLE DETAIL

建站实战干货

来自一线的建站与推广经验沉淀，每一条都经过真实交付验证。

首页 / 资讯中心 / 正文

Keepalived高可用集群搭建与企业实战

2026/9/16 14:49:36 拓冰建站 浏览量
Keepalived高可用集群搭建与企业实战 场景在企业级运维场景中“单点故障”是悬在所有运维人员头顶的利剑——无论是核心路由器、负载均衡器还是数据库服务器一旦单点设备宕机就可能导致整个业务系统瘫痪造成不可估量的损失。而Keepalived作为基于VRRP协议的高可用解决方案凭借其轻量、稳定、易部署的特性成为解决单点故障、保障服务连续性的首选工具。今天这篇博客将从基础概念入手一步步拆解Keepalived的核心原理、部署流程再到企业常用的实战场景一、高可用与Keepalived认识1.1 什么是高可用集群高可用HAHigh Availability的核心目标是减少服务中断时间通过“冗余部署”实现故障自动切换让服务在设备故障时依然能正常对外提供访问。行业内常用SLA服务等级协议衡量可用性核心公式为A MTBF / (MTBF MTTR)其中MTBF是平均无故障时间MTTR是平均故障修复时间。集群类型分为三类Keepalived主要服务于高可用集群LB负载均衡如LVS、HAProxy、Nginx核心是分发请求、提升并发能力HA高可用如Keepalived核心是解决单点故障、保障服务连续性HPC高性能用于海量数据计算如大数据集群。1.2 核心原理VRRP协议Keepalived的高可用能力完全依赖于VRRP虚拟路由冗余协议。简单来说VRRP的作用是“将多个物理路由器伪装成一个虚拟路由器”通过优先级竞争机制确保同一时间只有一个主节点对外提供服务备节点处于待命状态。核心术语虚拟路由器由多个物理节点组成对外提供统一的VIP虚拟IP和VMAC虚拟MACVRID虚拟路由器标识范围0-255同一虚拟路由器的所有节点必须使用相同的VRIDVIP虚拟IP对外提供服务的统一IP也是故障切换时的核心“漂移”对象主节点MASTER优先级最高的节点负责对外提供服务周期性发送心跳通告报文备节点BACKUP优先级低于主节点监听主节点的心跳主节点故障时自动接管VIP。VRRP的工作流程集群启动后所有节点根据优先级竞争主节点优先级最高的成为MASTERMASTER节点每1秒默认发送一次心跳报文告知备节点自己处于正常状态备节点如果在规定时间内未收到心跳判定主节点故障优先级最高的备节点升级为新的MASTER接管VIP原主节点恢复后根据配置的模式抢占/非抢占决定是否重新夺回主节点身份。二、部署前置环境准备与安装各节点时间必须同步ntp, chrony关闭防火墙及SELinux各节点之间可通过主机名互相通信非必须建议使用/etc/hosts文件实现非必须各节点之间的root用户可以基于密钥认证的ssh服务完成互相通信非必须2.2 快速安装Keepalived[rootKA1 ~]# dnf install keepalived -y [rootKA1 ~]# systemctl start keepalived [rootKA1 ~]# ps axf | grep keepalived 2385 pts/0 S 0:00 \_ grep --colorauto keepalived 2326 ? Ss 0:00 /usr/sbin/keepalived -D 2327 ? S 0:00 \_ /usr/sbin/keepalived -D安装完成后核心文件路径主程序/usr/sbin/keepalived主配置文件/etc/keepalived/keepalived.conf配置示例/usr/share/doc/keepalived/系统服务文件/lib/systemd/system/keepalived.service2.3 Keepalived配置说明2.3.1全局配置Global_defs! Configuration File for keepalived global_defs { notification_email { # 故障切换时的通知邮箱 594233887qq.com } notification_email_from keepalivedKA1.timinglee.org # 发件人地址 smtp_server 127.0.0.1 # 邮件服务器地址本地可填127.0.0.1 smtp_connect_timeout 30 # 邮件连接超时时间秒 router_id KA1.timinglee.org # 节点唯一标识建议用主机名不可重复 vrrp_skip_check_adv_addr # 跳过重复的VRRP通告检查提升性能 # vrrp_strict # 严格遵循VRRP协议建议注释启用后无法使用单播、无VIP会启动失败 vrrp_garp_interval 1 # 免费ARP发送间隔秒用于更新网络ARP缓存 vrrp_gna_interval 1 # 免费NA发送间隔秒用于IPv6环境 vrrp_mcast_group4 224.0.0.18 # VRRP多播地址默认即可 }2.3.2 VRRP实例配置vrrp_instance VI_1 { state MASTER # 节点状态MASTER/BACKUP interface eth0 # 绑定的物理网卡需与VIP在同一网卡 virtual_router_id 20 # VRID主备节点必须相同范围0-255 priority 100 # 优先级1-254MASTER优先级高于BACKUP advert_int 1 # 心跳间隔秒默认1秒 authentication { # 认证配置主备节点必须一致 auth_type PASS # 认证类型PASS简单密码推荐AH不推荐 auth_pass 1111 # 认证密码仅前8位有效 } virtual_ipaddress { # 虚拟IPVIP可配置多个 172.25.254.100/24 dev eth0 label eth0:0 # 绑定到eth0网卡标签eth0:0 } }备节点BACKUP配置与主节点基本一致仅需修改3处vrrp_instance VI_1 { state BACKUP # 状态改为BACKUP interface eth0 virtual_router_id 20 # 与主节点一致 priority 80 # 优先级低于主节点如80 advert_int 1 authentication { auth_type PASS auth_pass 1111 # 与主节点一致 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 # 与主节点一致 } }2.4 可选配置日志开启默认情况下Keepalived的日志会输出到系统日志/var/log/messages不方便排查问题建议开启独立日志[rootKA1 ~]# vim /etc/sysconfig/keepalived KEEPALIVED_OPTIONS-D -S 6 # -S 6指定日志级别0-76为info # 2. 配置rsyslog将日志输出到独立文件 [rootKA1 ~]# vim /etc/rsyslog.conf local6.* /var/log/keepalived.log # 添加此行 # 3. 重启服务生效 [rootKA1 ~]# systemctl restart keepalived rsyslog # 4. 查看日志 [rootKA1 ~]# tail -f /var/log/keepalived.log三.Keepalived企业应用示例3.1实现master/slave的Keepalived单主架构单主架构是最基础、最常用的高可用模式——同一时间只有主节点提供服务备节点待命适合业务流量不大、对资源利用率要求不高的场景3.1.1 MASTER配置[rootKA1 ~]# vim /etc/keepalived/keepalived.conf ! Configuration File for keepalived global_defs { notification_email { 594233887qq.com } notification_email_from keepalivedKA1.timinglee.org smtp_server 127.0.0.1 smtp_connect_timeout 30 router_id KA1.timinglee.org vrrp_skip_check_adv_addr #vrrp_strict #添加此选项无法访问vip可以用nft list ruleset查看 vrrp_garp_interval 1 vrrp_gna_interval 1 vrrp_mcast_group4 224.0.0.18 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 20 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } }3.1.2 BACKUP配置#配置文件和master基本一致只需修改三行 [rootKA2 ~]# vim /etc/keepalived/keepalived.conf ! Configuration File for keepalived global_defs { notification_email { 594233887qq.com } notification_email_from keepalivedtiminglee.org smtp_server 127.0.0.1 smtp_connect_timeout 30 router_id KA2.timinglee.org vrrp_skip_check_adv_addr #vrrp_strict vrrp_garp_interval 1 vrrp_gna_interval 1 vrrp_mcast_group4 224.0.0.18 } vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 #相同id管理同一个虚拟路由 priority 80 #低优先级 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } }抓包观察tcpdump -i eth0 -nn host 224.0.0.183.2抢占模式和非抢占模式3.2.1非抢占模式nopreempt默认为抢占模式preempt即当高优先级的主机恢复在线后会抢占低先级的主机的master角色这样会使vip在KA主机中来回漂移造成网络抖动建议设置为非抢占模式nopreempt即高优先级主机恢复后并不会抢占低优先级主机的master角色非抢占模块下,如果原主机down机, VIP迁移至的新主机,后续也发生down时,仍会将VIP迁移回原主机注意要关闭VIP抢占必须将各keepalived服务器state配置为BACKUP#ka1主机配置 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 priority 100 #优先级高 nopreempt #非抢占模式 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } } #KA2主机配置 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 priority 80 #优先级低 advert_int 1 nopreempt #非抢占模式 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } }3.2.2抢占延迟模式preempt_delay抢占延迟模式即优先级高的主机恢复后不会立即抢回VIP而是延迟一段时间默认300s再抢回 VIPpreempt_delay # #指定抢占延迟时间为#s默认延迟300s注意需要各keepalived服务器state为BACKUP,并且不要启用vrrp_strict#ka1主机配置 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 priority 100 #优先级高 preempt_delay 10 #抢占延迟10s advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } } #KA2主机配置 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 priority 80 #优先级低 advert_int 1 preempt_delay 10 #抢占延迟10S authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } }3.3 VIP单播配置默认keepalived主机之间利用多播相互通告消息会造成网络拥塞可以替换成单播减少网络流量# 主节点KA1配置添加单播相关参数 vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 20 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } unicast_src_ip 172.25.254.20 # 本机IP发送单播的源IP unicast_peer { 172.25.254.30 # 对方节点IP接收单播的目标IP } } # 备节点KA2配置对应修改 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 20 priority 80 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } unicast_src_ip 172.25.254.30 # 本机IP unicast_peer { 172.25.254.20 # 对方节点IP } }测试单播效果# 主节点抓包 [rootKA1 ~]# tcpdump -i eth0 -nn src 172.25.254.20 and dst 172.25.254.303.4 状态切换通知邮件告警生产环境中节点状态切换后需要及时通知运维人员避免故障未被发现。Keepalived支持通过脚本触发邮件通知实现故障告警。创建邮件通知脚本/etc/keepalived/mail.sh#!/bin/bash # 邮件接收人 mail_dest594233887qq.com # 邮件发送函数 mail_send() { mail_subj$HOSTNAME to be $1: VIP漂移通知 mail_messdate %F\ %T: VRRP状态切换$HOSTNAME 变为 $1 状态 echo $mail_mess | mail -s $mail_subj $mail_dest } # 根据传入参数触发对应通知 case $1 in master) mail_send master ;; backup) mail_send backup ;; fault) mail_send fault ;; *) exit 1 ;; esac给脚本添加执行权限[rootKA1 ~]# chmod x /etc/keepalived/mail.sh配置keepalived告警#在KA1和KA2中设定配置文件 ! Configuration File for keepalived global_defs { notification_email { timinglee_zln163.com } notification_email_from timinglee_zln163.com smtp_server 127.0.0.1 smtp_connect_timeout 30 router_id KA1 vrrp_skip_check_adv_addr #vrrp_strict vrrp_garp_interval 1 vrrp_gna_interval 1 vrrp_mcast_group4 224.0.0.44 enable_script_security script_user root } vrrp_instance WEB_VIP { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 # unicast_src_ip 172.25.254.50 # unicast_peer { # 172.25.254.60 # } authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } notify_master /etc/keepalived/scripts/waring.sh master notify_backup /etc/keepalived/scripts/waring.sh backup notify_fault /etc/keepalived/scripts/waring.sh fault }[rootKA12 ~]# systemctl restart keepalived.service测试[rootKA1 ~]# systemctl stop keepalived.service #停止服务后查看邮件 [rootKA1 ~]# systemctl start keepalived.service #开启服务后查看邮件3.4双主架构Master/Master单主架构中备节点长期处于空闲状态资源利用率低。双主架构通过配置两个虚拟路由器让两个节点互为主备分别承担不同VIP的服务提升资源利用率。核心思路两个节点分别为两个VRRP实例的主节点同时为对方实例的备节点实现“双主互备”。节点KA1和KA2VIP分别为172.25.254.50和172.25.254.60节点KA1配置# 第一个VRRP实例VI_1主节点VIP 172.25.254.50 vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 50 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.50 dev eth0 label eth0:0 } } # 第二个VRRP实例VI_60备节点VIP 172.25.254.60 vrrp_instance VI_60 { state BACKUP interface eth0 virtual_router_id 60 priority 80 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.60 dev eth0 label eth0:1 } }节点KA2配置与KA1互为主备# 第一个VRRP实例VI_1备节点VIP 172.25.254.50 vrrp_instance VI_1 { state BACKUP interface eth0 virtual_router_id 50 priority 80 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.50 dev eth0 label eth0:0 } } # 第二个VRRP实例VI_60主节点VIP 172.25.254.60 vrrp_instance VI_60 { state MASTER interface eth0 virtual_router_id 60 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.60 dev eth0 label eth0:1 } }实战案例三个节点的三主架构实现#第一个节点ka1配置 Vrrp instance 1MASTER优先级100 Vrrp instance 2BACKUP优先级80 Vrrp instance 3BACKUP优先级60 #第二个节点ka2配置 Vrrp instance 1BACKUP优先级60 Vrrp instance 2MASTER优先级100 Vrrp instance 3BACKUP优先级80 #第三个节点ka3配置 Vrrp instance 1BACKUP优先级80 Vrrp instance 2BACKUP优先级60 Vrrp instance 3MASTER优先级1003.5Keepalived LVS-DR 高可用负载均衡Keepalived与LVS结合可实现负载均衡高可用双重保障——LVS负责分发请求Keepalived负责LVS节点的故障切换和后端RS真实服务器的检测。2台LVS节点KA1、KA22台后端RS节点RS1172.25.254.101RS2172.25.254.102VIP172.25.254.100。配置后端RS节点两台RS配置一致# 安装httpd [rootrs1 ~]# dnf install httpd -y [rootrs1 ~]# echo RS1 - 172.25.254.101 /var/www/html/index.html [rootrs1 ~]# systemctl start httpd # 绑定VIP到lo网卡 [rootrs1 ~]# ip addr add 172.25.254.100/32 dev lo # 配置ARP参数避免VIP冲突 [rootrs1 ~]# echo 1 /proc/sys/net/ipv4/conf/all/arp_ignore [rootrs1 ~]# echo 1 /proc/sys/net/ipv4/conf/lo/arp_ignore [rootrs1 ~]# echo 2 /proc/sys/net/ipv4/conf/lo/arp_announce配置LVS主节点KA1的Keepalivedvrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 20 priority 100 advert_int 1 authentication { auth_type PASS auth_pass 1111 } virtual_ipaddress { 172.25.254.100/24 dev eth0 label eth0:0 } } # LVS配置 virtual_server 172.25.254.100 80 { delay_loop 6 # 健康检测间隔秒 lb_algo wrr # 负载均衡算法加权轮询 lb_kind DR # 集群模式DR模式推荐 protocol TCP # 服务协议 sorry_server 172.25.254.30 80 # 所有RS故障时备用服务器 # 后端RS1配置TCP健康检测 real_server 172.25.254.101 80 { weight 1 # 权重值越大分配到的请求越多 TCP_CHECK { connect_timeout 5 # 连接超时时间秒 retry 3 # 重试次数 delay_before_retry 3 # 重试延迟秒 connect_port 80 # 检测端口 } } # 后端RS2配置HTTP健康检测 real_server 172.25.254.102 80 { weight 1 HTTP_GET { url { path / # 检测路径 status_code 200 # 健康状态响应码 } connect_timeout 1 retry 3 delay_before_retry 1 } } }配置LVS备节点KA2与主节点配置基本一致仅修改state为BACKUP、priority为80。测试效果# 查看IPVS规则 [rootKA1 ~]# ipvsadm -Ln # 模拟RS1故障查看是否自动剔除 [rootrs1 ~]# systemctl stop httpd [rootKA1 ~]# ipvsadm -Ln # 看不到RS1的规则 # 模拟主节点故障查看备节点是否接管 [rootKA1 ~]# systemctl stop keepalived [rootKA2 ~]# ipvsadm -Ln # 备节点会生成IPVS规则接管服务