59.keepalived实现高可用

xx.ii2025-09-29 9:46

keepalived实现高可用

Keepalived软件主要是通过VRRP协议实现高可用功能的。VRRP是Virtual Router RedundancyProtocol(虚拟路由器冗余协议）的缩写，VRRP出现的目的就是为了解决静态路由单点故障问题的，它能够保证当个别节点宕机时，整个网络可以不间断地运行

keepalived 有三个重要的功能，分别是：

（1）管理LVS负载均衡软件

（2）实现LVS集群节点的健康检查

（3）作为系统网络服务的高可用性

keepalived不仅可以管理lvs，还可以作为其他服务（例如：Nginx、Haproxy、MySQL等）的高可用解决方案软件。

keepalived高可用故障转移的原理

Keepalived 高可用服务之间的故障切换转移，是通过 VRRP (Virtual Router Redundancy Protocol ,虚拟路由器冗余协议）来实现的。

在Keepalived正常工作时间，主master节点会一直向备backup节点以（组播的方式）发送心跳信息，当主master节点发生故障不再向备backup节点发送心跳信息时，备节点接收不到心跳信息，于是调用自己的接管程序接管主节点的ip资源及服务，顶替主节点对外进行服务，当主节点恢复时，备节点会释放自己接管的服务及ip，恢复到备节点，在主节点工作时，备节点不会进行任何活动。备节点可以有多个，通过优先级竞选，但一般 Keepalived系统运维工作中都是一对。

keepalived部署
master 192.168.100.10
slave 192.168.100.20
vip 192.168.100.150

master和slave节点关闭防火墙和selinux，配置网络yum源和epel

安装常用命令

复制代码 
yum -y install vim wget gcc gcc-c++

安装nginx和keepalived

复制代码 
yum -y install nginx keepalived

在master和slave中添加测试网页

复制代码 
[root@master ~]# cd /usr/share/nginx/html/
[root@master html]# echo "master node" > index.html

[root@slave ~]# cd /usr/share/nginx/html/
[root@slave html]# echo "slave node" > index.html

[root@master html]# systemctl restart nginx
[root@master html]# systemctl enable nginx

[root@slave ~]# systemctl restart nginx
[root@slave ~]# systemctl enable nginx

配置主keepalived

复制代码 
[root@master html]#  cd /etc/keepalived/
[root@master keepalived]# cp keepalived.conf keepalived.conf.bak		#做备份

[root@master keepalived]# vim keepalived.conf

! Configuration File for keepalived

global_defs {
   router_id cy01
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.100.150
    }
! Configuration File for keepalived

global_defs {
   router_id xy1
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.100.150
    }
}

virtual_server 192.168.100.150 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.100.10 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }


    real_server 192.168.100.20 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

重启keepalived，并设置下次启动生效

复制代码 
[root@master keepalived]# systemctl restart keepalived.service
[root@master keepalived]# systemctl enable keepalived.service

在slave节点配置

复制代码 
[root@slave ~]# cd /etc/keepalived/
[root@slave keepalived]# cp keepalived.conf keepalived.conf.bak
[root@slave keepalived]# scp root@192.168.100.10:/etc/keepalived/keepalived.conf .

[root@slave keepalived]# vim keepalived.conf

! Configuration File for keepalived

global_defs {
   router_id xy2
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 51
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.100.150
    }
}

virtual_server 192.168.100.150 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.100.10 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }


    real_server 192.168.100.20 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

重启服务并设置下次启动生效

复制代码 
[root@slave keepalived]# systemctl restart keepalived.service
[root@slave keepalived]# systemctl enable keepalived.service

[root@master ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:9a:72:9a brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.10/24 brd 192.168.100.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet 192.168.100.150/32 scope global ens33
       valid_lft forever preferred_lft forever
    inet6 fe80::6dde:7fb9:b3da:5f30/64 scope link noprefixroute 
       valid_lft forever preferred_lft foreve

可以看到master节点出现了vip150，而backup节点不会出现

修改内核参数，开启侦听vip

复制代码 
[root@slave keepalived]# vim /etc/sysctl.conf
[root@slave keepalived]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1

[root@master ~]# vim /etc/sysctl.conf
[root@master ~]# sysctl -p
net.ipv4.ip_nonlocal_bind = 1

关闭backup

复制代码 
[root@slave keepalived]# systemctl stop nginx.service
通过keepalived监控nginx负载均衡

在master上编写脚本

复制代码 
[root@master ~]# mkdir /scripts
[root@master ~]# cd /scripts/
[root@master scripts]# vim check.sh

#!/bin/bash
nginx_status=`ps -ef | grep -v "grep" | grep "nginx" | wc -l`
if [ $nginx_status -lt 1 ];then
        systemctl stop keepalived
fi

给执行权限

复制代码 
[root@master scripts]# chmod +x check.sh

写一个触发脚本

复制代码 
[root@master scripts]# vim notify.sh

#!/bin/bash
VIP=$2
sendmail () {
        subject="${VIP}'s server keepalived state is translate"
        content="`date +'%F %T'`: `hostname`'s state change to master"
        echo $content | mail -s "$subject" root@example.com
}
case "$1" in
  master)
        nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
        if [ $nginx_status -lt 1 ];then
                systemctl start nginx
        fi
        sendmail
   ;;
   backup)
        nginx_status=$(ps -ef|grep -Ev "grep|$0"|grep '\bnginx\b'|wc -l)
        if [ $nginx_status -gt 0 ];then
                systemctl stop nginx
        fi
   ;;
   *)
        echo "Usage:$0 master|backup VIP"
   ;;
esac

给执行权限

复制代码 
[root@master scripts]# chmod +x notify.sh

然后在slave上编写脚本

复制代码 
[root@slave scripts]# scp root@192.168.100.10:/scripts/check.sh .
root@192.168.100.10's password: 
check.sh                                                   100%  143   200.4KB/s   00:00    
[root@slave scripts]# scp root@192.168.100.10:/scripts/notify.sh .
root@192.168.100.10's password: 
notify.sh 

[root@slave scripts]# chmod +x check.sh
[root@slave scripts]# chmod +x notify.sh

配置master的keepalived

复制代码 
! Configuration File for keepalived

global_defs {
   router_id xyh1
}

vrrp_script nginx_check {
    script "/scripts/check.sh"
    interval 10
    weight -20
}

vrrp_instance VI_1 {
    state MASTER
    interface ens33
    virtual_router_id 51
    priority 100
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.100.150
    }
    track_script {
        nginx_check
    }
    notify_master "/scripts/notify.sh master 192.168.100.150"
    notify_backup "/scripts/notify.sh backup 192.168.100.150"
}

virtual_server 192.168.100.150 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.100.10 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }


    real_server 192.168.100.20 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}
[root@master scripts]# systemctl restart keepalived.service

配置slave的keepalived

复制代码 
[root@slave ~]# cd /etc/keepalived/
[root@slave keepalived]# scp root@192.168.100.10:/etc/keepalived/keepalived.conf .
root@192.168.100.10's password: 
keepalived.conf

[root@slave keepalived]# vim keepalived.conf

! Configuration File for keepalived

global_defs {
   router_id xyh2
}

vrrp_instance VI_1 {
    state BACKUP
    interface ens33
    virtual_router_id 51
    priority 90
    advert_int 1
    authentication {
        auth_type PASS
        auth_pass 1111
    }
    virtual_ipaddress {
        192.168.100.150
    }
    track_script {
        nginx_check
    }
    notify_master "/scripts/notify.sh master 192.168.100.150"
    notify_backup "/scripts/notify.sh backup 192.168.100.150"
}

virtual_server 192.168.100.150 80 {
    delay_loop 6
    lb_algo rr
    lb_kind DR
    persistence_timeout 50
    protocol TCP

    real_server 192.168.100.10 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }


    real_server 192.168.100.20 80 {
        weight 1
        TCP_CHECK {
            connect_port 80
            connect_timeout 3
            nb_get_retry 3
            delay_before_retry 3
        }
    }
}

[root@slave keepalived]# systemctl restart keepalived.service

模拟nginx故障，停用master节点的nginx

复制代码 
[root@master ~]# systemctl stop nginx.service

[root@master ~]# ss -anlt
State       Recv-Q Send-Q Local Address:Port               Peer Address:Port              
LISTEN      0      128     *:111                 *:*                  
LISTEN      0      128     *:6000                *:*                  
LISTEN      0      5      192.168.122.1:53                  *:*                  
LISTEN      0      128     *:22                  *:*                  
LISTEN      0      128    127.0.0.1:631                 *:*                  
LISTEN      0      100    127.0.0.1:25                  *:*                  
LISTEN      0      128    127.0.0.1:6010                *:*                  
LISTEN      0      128    :::111                :::*                  
LISTEN      0      128    :::6000               :::*                  
LISTEN      0      128    :::22                 :::*                  
LISTEN      0      128       ::1:631                :::*                  
LISTEN      0      100       ::1:25                 :::*                  
LISTEN      0      128       ::1:6010               :::*

80端口断开

查看slave的80端口是否开启

复制代码 
[root@slave ~]# ss -anlt
State       Recv-Q Send-Q          Local Address:Port                         Peer Address:Port              
LISTEN      0      128                         *:111                                     *:*                  
LISTEN      0      128                         *:80                                      *:*                  
LISTEN      0      128                         *:6000                                    *:*                  
LISTEN      0      5               192.168.122.1:53                                      *:*                  
LISTEN      0      128                         *:22                                      *:*                  
LISTEN      0      128                 127.0.0.1:631                                     *:*                  
LISTEN      0      100                 127.0.0.1:25                                      *:*                  
LISTEN      0      128                 127.0.0.1:6010                                    *:*                  
LISTEN      0      128                        :::111                                    :::*                  
LISTEN      0      128                        :::80                                     :::*                  
LISTEN      0      128                        :::6000                                   :::*                  
LISTEN      0      128                        :::22                                     :::*                  
LISTEN      0      128                       ::1:631                                    :::*                  
LISTEN      0      100                       ::1:25                                     :::*                  
LISTEN      0      128                       ::1:6010                                   :::*                  
You have new mail in /var/spool/mail/root

80端口已开启，查看是否有150的ip

复制代码 
[root@slave ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:2d:62:03 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.20/24 brd 192.168.100.255 scope global noprefixroute ens33
       valid_lft forever preferred_lft forever
    inet 192.168.100.150/32 scope global ens33
       valid_lft forever preferred_lft forever
相关推荐
ping某12 小时前
为什么 Nginx 明明监听了 80，转发后端时却用了 4xxxx 端口？
后端·nginx
大树882 天前
金刚石散热越强，管路越先见顶
大数据·运维·服务器·人工智能·ai
摇滚侠2 天前
Linux CentOS7 rpm 安装 MySQL 5.7
linux·运维·mysql
霸道流氓气质2 天前
领域驱动设计（DDD）在 Spring Boot 微服务中的实践指南
运维·spring boot·微服务
Inhand陈工2 天前
基于台达PLC与映翰通IG502的智慧水产养殖精准投喂与远程运维解决方案
运维·人工智能·物联网·阿里云·信息与通信
酣大智2 天前
ARP代理--工作原理
运维·网络·arp·arp代理
shushangyun_2 天前
2026年快消品B2B系统推荐：支持终端门店订货、促销政策自动化的工具？
java·运维·网络·数据库·人工智能·spring·自动化
施努卡机器视觉3 天前
SNK施努卡侧滑门锁上滑轮总成自动化装配线，从零件到组件，全流程精密制造方案
运维·自动化·制造
AC赳赳老秦3 天前
用 OpenClaw 搭建服务器故障应急响应系统，自动处理 80% 常见运维故障
android·运维·服务器·python·rxjava·deepseek·openclaw
java_cj3 天前
深入kube-apiserver认证机制：从Bearer Token到mTLS的完整认证链解析
linux·运维·服务器·云原生·容器·kubernetes
热门推荐
012026年6月AI行业全景：从百模大战到Agent元年，这30天发生了什么？022026年6月AI大模型全景报告：GPT-5.6、Claude Opus 4.8、Gemini 3.5，中美AI三足鼎立谁主沉浮？032026 年 AI 编程工具终极横评：Cursor vs Claude Code vs Copilot vs Windsurf04【AI】2026 年具身智能模型和世界模型总结05GitHub 镜像站点062026 AI 编程工具终极实战指南：Cursor vs Claude Code vs Copilot，开发者该怎么选？07AI科技热点日报 | 2026年6月1日08Codex 下载安装指南：Windows 和 macOS 官方版下载09AI一周事件 · 2026-06-03 至 2026-06-0910上线仅72小时被强制下架：Claude Fable 5 的短命