[Ipvsman-users] ipvsman and keepalived
Status: Alpha
Brought to you by:
volkerjaenisch
Menu
▾
▴
[Ipvsman-users] ipvsman and keepalived
|
From: Dr. V. J. <vol...@in...> - 2007-05-03 23:26:30
|
Hello Gerry!
>>
>> Yesterday I wrote an import-filter for the keepalived.conf file which
>> is included in the current release. You are welcome to be my first
>> tester. To use the keepalived feature please run ipvsman this way:
>> #ipvsman -k
>> Just try it out and keep me informed.
> Yes, I think I will try this. I should have time in about 2-3 days to
> start.
Just tested myself. If have had no direct experiance with keepalived yet.
Keepalived is not very verbose in error reporting or talking with you at
all.
One syntax error in the config and it is executed incomplete without any
warnings.
Will talk about this on the keepalived list.
To spare you all my pitfalls here a sample configuration that works
on my virtual XEN Cluster:
/etc/keepalived/keepalived.conf:
virtual_server 10.3.0.2 80 {
delay_loop 6
lb_algo wrr
lb_kind NAT
persistence_timeout 300
protocol TCP
real_server 10.4.0.7 80 {
weight 100
HTTP_GET {
connect_timeout 3
url {
path /test.shtml
status_code 200
}
}
}
real_server 10.4.0.8 80 {
weight 100
HTTP_GET {
connect_timeout 3
url {
path /test.shtml
status_code 200
}
}
}
}
Please have a simple file with content "test" as /test.shtml delivered
by your webservers.
do
#/etc/init.d/keepalived start
to stat keepalived as your livekeeper.
No configuration on ipvsman is needed if running ipvsman as:
#ipvsman -a -k
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State
Label Weight Conns CPS State
t:10.3.0.2:80 m wrr t noService
t:10.4.0.7:80 100 0 0 http
t:10.4.0.8:80 100 0 0 http
------------------------------------
200 0 0
====================================
The state "noService" is not entirely correct. ipvsman knows that the
definition of the service
metadata for t:10.3.0.2:80 is not from its own service.cfg file (but
from keepalived.conf) so it complains. Minor bug to be eliminated in
0.9.1-8.
If 10.4.0.7 is shut down:
apoweb3:~# /etc/init.d/apache2 stop
Stopping web server (apache2)...apache2: Could not reliably determine
the server's fully qualified domain name, using 10.4.0.7 for ServerName
you will get
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State
Label Weight Conns CPS State
t:10.3.0.2:80 m wrr t noService suspended
t:10.4.0.7:80 0 0 0 suspended
t:10.4.0.8:80 100 0 0 http
----------------------------------------
100 0 0
========================================
and after restart of 10.4.0.7 we reach the initial state:
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State
Label Weight Conns CPS State
t:10.3.0.2:80 m wrr t noService
t:10.4.0.7:80 100 0 0 http
t:10.4.0.8:80 100 0 0 http
------------------------------------
200 0 0
====================================
Interactively addition and deletion of realserver works as I can see.
But as I stated earlier these changes have to be done manually in the
/etc/keepalived/keepalived.conf to make them permanent.
Please stop keepalived at this point and reset ipvs.
#/etc/init.d/keepalived
#ipvsadm -C
The same as above can be achived with ipvsman/ipvsmand
Define in /etc/ipvsman/service.cfg :
MyCluster:t:10.3.0.2:80 ["web1+:10.4.0.7-8"]
After
# ipvsman -a
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State Label
Weight Conns CPS State
MyCluster m wrr t notRunning noConfig
----------------------------
0 0 0
============================
motRunning : Service has no active realservers yet.
noConfig : Service has no desired configuration.
So lets give it a desired config.
type "a"
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State Label
Weight Conns CPS State
MyCluster m wrr t notRunning noConfig
----------------------------
0 0 0
select reals
============================
[ ] web1
[ ] web2
< OK >
Select e.g. web1 and web2, commit.
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State Label
Weight Conns CPS State
MyCluster m wrr t noConfig web1
100 0 0 http
web2
100 0 0 http
----------------------------
200 0 0
============================
We are running.
An shutdown of apache on web1 yield:
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State Label
Weight Conns CPS State
MyCluster m wrr t suspended web1
0 0 0 suspended
web2
100 0 0 http
--------------------------------
100 0 0
================================
Ups. Let's disable web1. press "a", uncheck web1,commit.
Version 0.9.1-7. Please type "h" for help.
Label FW Shed Tra State Label
Weight Conns CPS State
MyCluster m wrr t web2
100 0 0 http
----------------------------
100 0 0
============================
Now a history of three desired configs have arrived on your harddisc:
1)
/var/lib/ipvsman/ipvscfg-2007-05-03_22:50 :
<empty>
generated by ipvsman from the actual state of the ipvs at first time
starting of ipvsman.
It is empty since we have had cleared ipvs with ipvsadm -C.
2)
/var/lib/ipvsman/ipvscfg-2007-05-03_22:52 :
-A -t 10.3.0.2:80 -s wrr -p 300
-a -t 10.3.0.2:80 -r 10.4.0.7:80 -m -w 100
-a -t 10.3.0.2:80 -r 10.4.0.8:80 -m -w 100
This desired config was written as I commited the addition of web1 and web2.
You see the service first and then the two realserver mappings.
3)
The last desired config file in this history is
/var/lib/ipvsman/ipvscfg-2007-05-03_22:55 :
-A -t 10.3.0.2:80 -s wrr -p 300
-a -t 10.3.0.2:80 -r 10.4.0.8:80 -m -w 100
web1 aka 10.4.0.7:80 is gone.
This short story may have convinced you to use ipvsman/d without keepalived.
The heartbeat vs. VRRP battle still stands out.
After reading the configuration of the keepalived.conf I noticed the absence
of one crucial thing in VRRP : A good measure against a split brain
situation.
We are using heartbeat not at least because we can use robust RS-232
serial cables between
every of our two heartbeat-Servers to assure that in case of a partial
network blackout
not to run into a split brain situation.
VRRP (in the implemetation of keepalived) relies on the availability of
a network connection
between the two failover nodes. Heartbeat seems to me the fairly more
robust approach.
As long as the serial connection between the two nodes stands the two
servers can discuss which
of both has the better chance to fullfill the task of service. E.g. by
comparing the
ping times/counts to the next router.
Thank you. I have learned a lot while writing this for you:
* VRRP is not as robust as heartbeat
* keepalived is much more difficult to run as I assumed
My now adjusted recomendation is to use:
* ipvsman
* ipvsmand
* heartbeat
for your project.
Best regards
Volker
--
====================================================
inqbus it-consulting +49 ( 341 ) 5643800
Dr. Volker Jaenisch http://www.inqbus.de
Herloßsohnstr. 12 0 4 1 5 5 Leipzig
N O T - F Ä L L E +49 ( 170 ) 3113748
====================================================
|
