1. 云原生环境下Keepalived的实验设计与实现最近在帮客户设计云原生高可用方案时发现很多团队对传统高可用工具在云环境下的适配存在认知偏差。今天我就以Keepalived为例分享在云原生环境中的实验配置方法和注意事项。这个方案特别适合需要在Kubernetes集群外维护关键服务高可用的场景比如数据库、消息队列等有状态服务。2. 实验环境规划2.1 基础架构设计实验采用三节点架构2个Keepalived节点主备各11个监控节点用于健康检查共享的VIPVirtual IP: 192.168.1.100节点配置建议操作系统Ubuntu 20.04 LTS内核版本5.4Keepalived版本2.2.4注意云环境需要特别注意VIP的分配方式部分云平台需要额外配置才能支持ARP广播2.2 网络拓扑说明[Master Node] ----\ [VIP:192.168.1.100] [Backup Node]----/3. Keepalived核心配置解析3.1 主配置文件/etc/keepalived/keepalived.confglobal_defs { router_id LVS_DEVEL } vrrp_script chk_nginx { script /usr/bin/killall -0 nginx interval 2 weight -20 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 virtual_ipaddress { 192.168.1.100/24 } track_script { chk_nginx } }关键参数说明virtual_router_id必须相同才能组成VRRP组priority主节点建议100备节点建议90advert_int心跳间隔生产环境建议1-3秒3.2 健康检查配置云原生环境下推荐使用HTTP接口检查vrrp_script chk_service { script curl -s --connect-timeout 2 http://localhost:8080/healthz | grep -q ok interval 2 fall 2 rise 2 timeout 2 }4. 云原生特殊适配4.1 容器化部署方案Docker部署示例FROM ubuntu:20.04 RUN apt-get update apt-get install -y keepalived COPY keepalived.conf /etc/keepalived/ CMD [keepalived, --dont-fork, --log-console]需要特别注意的容器权限NET_ADMIN能力NET_BROADCAST能力/proc文件系统挂载4.2 Kubernetes集成方案使用DaemonSet部署apiVersion: apps/v1 kind: DaemonSet metadata: name: keepalived spec: selector: matchLabels: app: keepalived template: metadata: labels: app: keepalived spec: hostNetwork: true containers: - name: keepalived image: keepalived:2.2.4 securityContext: capabilities: add: [NET_ADMIN, NET_BROADCAST] volumeMounts: - name: config mountPath: /etc/keepalived volumes: - name: config configMap: name: keepalived-config5. 故障排查与优化5.1 常见问题排查表现象可能原因解决方案VIP不切换防火墙阻止VRRP协议开放112端口VRRP协议脑裂问题网络分区配置多播检测或第三方仲裁频繁切换健康检查不稳定调整检查间隔和阈值5.2 性能优化建议调整内核参数echo net.ipv4.ip_nonlocal_bind1 /etc/sysctl.conf sysctl -p日志优化local0.* /var/log/keepalived.log资源限制limit_memory 100M limit_cpu 50%6. 监控与告警集成6.1 Prometheus监控配置scrape_configs: - job_name: keepalived static_configs: - targets: [keepalived-node1:9125]配合keepalived-exporter使用docker run -d -p 9125:9125 \ -v /var/run/keepalived:/var/run/keepalived \ lancew/keepalived-exporter6.2 Grafana看板指标关键监控指标vrrp_state0init,1backup,2mastervrrp_prioritycheck_script_status7. 生产环境注意事项网络隔离VRRP协议需要使用多播224.0.0.18确保网络设备允许通过安全加固使用VRRP认证限制VRRP通信源IP定期轮换认证密钥版本选择生产环境建议使用长期支持版本注意CVE-2021-44228等安全漏洞云平台特殊限制AWS需要配置VPC多播阿里云需要申请高可用虚拟IPGCP需要配置实例组在实际部署中我发现很多团队容易忽视云平台对VRRP协议的特殊限制。比如在某次AWS部署中由于没有启用VPC多播功能导致主备节点无法正常通信。建议在云环境部署前务必查阅对应云平台的VRRP支持文档。
1. 云原生环境下Keepalived的实验设计与实现最近在帮客户设计云原生高可用方案时发现很多团队对传统高可用工具在云环境下的适配存在认知偏差。今天我就以Keepalived为例分享在云原生环境中的实验配置方法和注意事项。这个方案特别适合需要在Kubernetes集群外维护关键服务高可用的场景比如数据库、消息队列等有状态服务。2. 实验环境规划2.1 基础架构设计实验采用三节点架构2个Keepalived节点主备各11个监控节点用于健康检查共享的VIPVirtual IP: 192.168.1.100节点配置建议操作系统Ubuntu 20.04 LTS内核版本5.4Keepalived版本2.2.4注意云环境需要特别注意VIP的分配方式部分云平台需要额外配置才能支持ARP广播2.2 网络拓扑说明[Master Node] ----\ [VIP:192.168.1.100] [Backup Node]----/3. Keepalived核心配置解析3.1 主配置文件/etc/keepalived/keepalived.confglobal_defs { router_id LVS_DEVEL } vrrp_script chk_nginx { script /usr/bin/killall -0 nginx interval 2 weight -20 } vrrp_instance VI_1 { state MASTER interface eth0 virtual_router_id 51 priority 100 advert_int 1 virtual_ipaddress { 192.168.1.100/24 } track_script { chk_nginx } }关键参数说明virtual_router_id必须相同才能组成VRRP组priority主节点建议100备节点建议90advert_int心跳间隔生产环境建议1-3秒3.2 健康检查配置云原生环境下推荐使用HTTP接口检查vrrp_script chk_service { script curl -s --connect-timeout 2 http://localhost:8080/healthz | grep -q ok interval 2 fall 2 rise 2 timeout 2 }4. 云原生特殊适配4.1 容器化部署方案Docker部署示例FROM ubuntu:20.04 RUN apt-get update apt-get install -y keepalived COPY keepalived.conf /etc/keepalived/ CMD [keepalived, --dont-fork, --log-console]需要特别注意的容器权限NET_ADMIN能力NET_BROADCAST能力/proc文件系统挂载4.2 Kubernetes集成方案使用DaemonSet部署apiVersion: apps/v1 kind: DaemonSet metadata: name: keepalived spec: selector: matchLabels: app: keepalived template: metadata: labels: app: keepalived spec: hostNetwork: true containers: - name: keepalived image: keepalived:2.2.4 securityContext: capabilities: add: [NET_ADMIN, NET_BROADCAST] volumeMounts: - name: config mountPath: /etc/keepalived volumes: - name: config configMap: name: keepalived-config5. 故障排查与优化5.1 常见问题排查表现象可能原因解决方案VIP不切换防火墙阻止VRRP协议开放112端口VRRP协议脑裂问题网络分区配置多播检测或第三方仲裁频繁切换健康检查不稳定调整检查间隔和阈值5.2 性能优化建议调整内核参数echo net.ipv4.ip_nonlocal_bind1 /etc/sysctl.conf sysctl -p日志优化local0.* /var/log/keepalived.log资源限制limit_memory 100M limit_cpu 50%6. 监控与告警集成6.1 Prometheus监控配置scrape_configs: - job_name: keepalived static_configs: - targets: [keepalived-node1:9125]配合keepalived-exporter使用docker run -d -p 9125:9125 \ -v /var/run/keepalived:/var/run/keepalived \ lancew/keepalived-exporter6.2 Grafana看板指标关键监控指标vrrp_state0init,1backup,2mastervrrp_prioritycheck_script_status7. 生产环境注意事项网络隔离VRRP协议需要使用多播224.0.0.18确保网络设备允许通过安全加固使用VRRP认证限制VRRP通信源IP定期轮换认证密钥版本选择生产环境建议使用长期支持版本注意CVE-2021-44228等安全漏洞云平台特殊限制AWS需要配置VPC多播阿里云需要申请高可用虚拟IPGCP需要配置实例组在实际部署中我发现很多团队容易忽视云平台对VRRP协议的特殊限制。比如在某次AWS部署中由于没有启用VPC多播功能导致主备节点无法正常通信。建议在云环境部署前务必查阅对应云平台的VRRP支持文档。
