实现基于haproxy和keepalived的负载均衡和高可用架构
第一部分
环境准备
Centos系统服务器4台，两台用于做haproxy主从架构，两台作为后端server,服务器配置好yum源，防火墙关闭，各节点时钟服务同步，各节点之间可以通过主机名相互通信
在四台服务上分别执行 ntpdate 172.17.0.1(实现时钟同步)
1.关闭防火墙和selinux
iptables -F setenforce 0
2、先配置keepalived MASTER 和haproxy的MASTER
需要配置一个vip然后再配置一个DIP的VIP
vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
}
notification_email_from root
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id KEEPALIVED_LVS
}
vrrp_instance VI_1 {
state MASTER
interface eth1
virtual_router_id 74
priority 200
advert_int 1
authentication {
auth_type PASS
auth_pass magedu
}
virtual_ipaddress {
172.17.254.100
}
}
vrrp_instance VI_2 {
state MASTER
interface eth0
virtual_router_id 75
priority 200
advert_int 1
authentication {
auth_type PASS
auth_pass magedu
}
virtual_ipaddress {
192.168.150.163
}
实现VIP飘逸
开启路由转发vim /etc/sysctl.conf
net,ipv4,ip_forward=1
sysctl -p 生效
然后从启服务：systemctl start keepalived
配置haproxy的MASTER
vim /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
frontend http
bind 172.17.254.100:80
default_backend httpservers
stats enable
stats uri /haproxy
stats auth admin:admin
stats refresh 10s
stats admin if TRUE
backend httpservers
balance roundrobin
server http1 192.168.150.123:80 check weight 1
server http2 192.168.150.135:80 check weight 1
启动服务:systemctl start haproxy
3、配置haproxy的BACKUP和keepalived的BACKUP
vim /etc/keepalived/keepalived.conf
global_defs {
notification_email {
}
notification_email_from root
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id KEEPALIVED_LVS
}
vrrp_instance VI_1 {
state BACKUP
interface eth1
virtual_router_id 74
priority 190
advert_int 1
authentication {
auth_type PASS
auth_pass magedu
}
virtual_ipaddress {
172.17.250.100
}
}
vrrp_instance VI_2 {
state BACKUP
interface eth0
virtual_router_id 75
priority 190
advert_int 1
authentication {
auth_type PASS
auth_pass magedu
}
virtual_ipaddress {
192.168.150.163
}
}
从启服务：service keepalived start
配置haproxy的BACKUP
vim /etc/haproxy/haproxy.cfg
global
log 127.0.0.1 local2
chroot /var/lib/haproxy
pidfile /var/run/haproxy.pid
maxconn 4000
user haproxy
group haproxy
daemon
stats socket /var/lib/haproxy/stats
defaults
mode http
log global
option httplog
option dontlognull
option http-server-close
option forwardfor except 127.0.0.0/8
option redispatch
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 1m
timeout server 1m
timeout http-keep-alive 10s
timeout check 10s
maxconn 3000
frontend http
bind 172.17.250.100:80
default_backend httpservers
backend httpservers
balance roundrobin
server http1 192.168.150.123:80
server http2 192.168.150.135:80
然后从启服务：service haproxy start
实现转发：vim /etc/sysctl.conf
net,ipv4,ip_forward=1
sysctl -p 生效
（以上的MASTER和BACKUP中web服务80端口不要和haproxy中的80端口同时启动）
4、配置realserver
把web的80端口启动:systemctl start nginx
把网关指向DIP的VIP
ip route add default via 192.168.150.163
5、测试实验
curl 172.17.250.100/index.html
第二部分
Hpaproxy访问控制ACL应用
1 通过ACL限制用户请求速率
2 通过ACL指定可访问的用户
3 根据用户访问内容实现动静分离
1
2
4 根据用户浏览器进行访问控制
5 Haproxy实现真实日志记录
Option forwardfor
6 Haproxy实现会话保持
一 源地址hash（用户IP识别）
二 cookie识别
Haproxy将web服务器返回给客户端的cookie中插入Haproxy中特定的字符串（或添加前缀）在后端的服务器cooke id。
三 Haproxy性能优化参数
Option redispatch 当server对应的服务器挂掉后，强制定向到其他健康的服务器
Option dontlognull 保证haproxy不记录上级负载均衡发送过来的检后面的测状态没有数据的心脏包
Retries 3: //3次连接失败就认为服务器不可用，主要通过后面的check检查
Maxconn 30000 ： //代理时所能接受的最大并发连接数，应该要比后端主机的并发总和要小